Snippets

KQL snippet: diagnose Workload Identity Federation failures in CI

A short query to find federated principal sign-in failures before falling back to a client secret.

21 Jun 2026 azureentra-idworkload-identityoidcciidentitykqllogsrunbook

When a CI pipeline fails after moving to OIDC, check service principal sign-ins before recreating a client secret.

kusto workload-identity-ci-failures.kql

let Window = 24h;
let PrincipalAppId = "00000000-0000-0000-0000-000000000000";
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(Window)
| where AppId == PrincipalAppId or ServicePrincipalId == PrincipalAppId
| project TimeGenerated,
        AppDisplayName,
        ServicePrincipalId,
        ResultType,
        ResultDescription,
        ConditionalAccessStatus,
        IPAddress,
        ResourceDisplayName,
        CorrelationId,
        UniqueTokenIdentifier
| order by TimeGenerated desc

Quick read: no row at all points to OIDC issuer, subject or audience; an explicit denial points to the federated credential or Entra policy; success in Entra with a downstream failure points to Azure RBAC, Key Vault or the target resource.