Cannot authenticate to deploy Function App - Error: No subscriptions found for ***.

[dubnemo]

Run azure/login@v2
Running Azure CLI Login.
C:\Windows\system32\cmd.exe /D /S /C ""C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd" cloud set -n azurecloud"
Done setting cloud: "azurecloud"
Federated token details:
issuer - https://token.actions.githubusercontent.com/
subject claim - repo:dubnemo/Traceability-API:ref:refs/heads/main
audience - api://AzureADTokenExchange
job_workflow_ref - dubnemo/Traceability-API/.github/workflows/main_function-app-traceability-api.yml@refs/heads/main
Attempting Azure CLI login by using OIDC...
Error: AADSTS7002138: No matching federated identity record found for presented assertion subject 'repo:dubnemo/Traceability-API:ref:refs/heads/main'. The subject matches with case-insensitive comparison, but not with case-sensitive comparison. Check your federated identity credential Subject, Audience and Issuer against the presented assertion. See documentation at: https://learn.microsoft.com/entra/workload-id/workload-identity-federation. See breaking change notification and remediation at: https://learn.microsoft.com/en-us/entra/identity-platform/reference-breaking-changes#august-2024. Trace ID: fd4a11c4-8ae9-4dce-8119-9bfa0481c200 Correlation ID: 6959dd16-7ee3-4987-998e-e9af2242023c Timestamp: 2025-08-18 02:35:41Z

Error: Run the command below to authenticate interactively; additional arguments may be added as needed:
az logout
az login

Error: Login failed with Error: The process 'C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd' failed with exit code 1. Double check if the 'auth-type' is correct. Refer to https://github.com/Azure/login#readme for more information.

[dubnemo]

Found this and added a comment:
https://learn.microsoft.com/en-us/answers/questions/2181284/github-quit-deploying-to-azure?comment=question&translated=false#newest-question-comment

[dubnemo]

For application registrations
Sign in to the Microsoft Entra admin center.
Select App registrations from the left-hand navigation pane.
Find and select the application you are configuring.
Select Certificates & secrets from the left-hand navigation pane.
Click on the Federated credentials tab. The configured credentials will be listed here.

[dubnemo]

Google AI is suggesting that my function app should be listed under Entra ID Application Registrations. There are no applications registered at all. The script that walked me through the creation of my Function App should have creating the app registration in another prompt or stopped altogether, suggesting my Entra ID was not properly setup, and provided resources that directed me how to proceed. I do not understand the next steps and how to associate my function app in Entra application registration. Or perhaps this is not the issue??

[dubnemo]

https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade/quickStartType~/null/sourceType/Microsoft_AAD_IAM

[dubnemo]

To register an existing Azure Function App in Microsoft Entra ID (formerly Azure Active Directory) for authentication and authorization, you need to perform the following steps:

• Create an App Registration in Microsoft Entra ID:
• Sign in to the Azure portal and navigate to Microsoft Entra ID.
• Under Manage, select App registrations, then click New registration.
• Provide a Name for your application registration (e.g., "MyFunctionApp-Auth").
• Choose the Supported account types based on your requirements (e.g., "Accounts in this organizational directory only").
• (Optional) If your Function App needs to interact with user-facing applications, configure a Redirect URI for the appropriate platform (Web, Mobile/Desktop, etc.). For a Web API, you can use any valid web address.
• Click Register.
• Note down the Application (client) ID and Directory (tenant) ID from the overview page of your newly created app registration.

Configure Authentication for your Azure Function App:

• Navigate to your Azure Function App in the Azure portal.
• In the left-hand menu, under Settings, select Authentication.
• Click Add identity provider.
• Choose Microsoft as the identity provider.
• Under App registration, select Provide the details of an existing app registration.
• Enter the Application (client) ID you noted earlier.
• (Optional) If you are using client credentials flow, you might need to generate a Client secret for your app registration in Entra ID (under Certificates & secrets in the app registration) and provide it here.
• Configure any other necessary settings like Issuer URL or Allowed token audiences if required for your specific scenario.
• Click Add.

Define API Permissions (if needed):

• If your Function App needs to access other Microsoft Graph or custom APIs, go back to your app registration in Microsoft Entra ID.
• Under Manage, select API permissions.
• Click Add a permission and choose the APIs and permissions required by your Function App.
• Grant admin consent if necessary.

By following these steps, your Azure Function App will be registered in Microsoft Entra ID and configured to use Entra ID for authentication and authorization.

[dubnemo]

[dubnemo]

[dubnemo]

Run azure/login@v2
with:
client-id: ***
tenant-id: ***
subscription-id: ***
enable-AzPSSession: false
environment: azurecloud
allow-no-subscriptions: false
audience: api://AzureADTokenExchange
auth-type: SERVICE_PRINCIPAL
env:
AZURE_FUNCTIONAPP_PACKAGE_PATH: .
DOTNET_VERSION: 8.0.x
DOTNET_ROOT: C:\Users\runneradmin\AppData\Local\Microsoft\dotnet
Running Azure CLI Login.
C:\Windows\system32\cmd.exe /D /S /C ""C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd" cloud set -n azurecloud"
Done setting cloud: "azurecloud"
Federated token details:
issuer - https://token.actions.githubusercontent.com/
subject claim - repo:dubnemo/Traceability-API:ref:refs/heads/main
audience - api://AzureADTokenExchange
job_workflow_ref - dubnemo/Traceability-API/.github/workflows/main_function-app-traceability-api.yml@refs/heads/main
Attempting Azure CLI login by using OIDC...
Error: AADSTS7002138: No matching federated identity record found for presented assertion subject 'repo:dubnemo/Traceability-API:ref:refs/heads/main'. The subject matches with case-insensitive comparison, but not with case-sensitive comparison. Check your federated identity credential Subject, Audience and Issuer against the presented assertion. See documentation at: https://learn.microsoft.com/entra/workload-id/workload-identity-federation. See breaking change notification and remediation at: https://learn.microsoft.com/en-us/entra/identity-platform/reference-breaking-changes#august-2024. Trace ID: f1325a31-433a-4dc6-ad73-8a7f76af7c00 Correlation ID: 23b022b6-b392-4d5e-b20f-2ceaa286a408 Timestamp: 2025-11-05 02:56:53Z

[dubnemo]