Help my Github claims matching expressions are no longer working!

Github recently introduced Immutable subject claims for GitHub Actions OIDC tokens. The feature is enabled for all new repos by default, but there has also been some changes in Entra ID. After this rolled out, and Entra ID was updated, creating rules with the old patterns will yield the following message:

Failed to update federated credential. Error detail: The FederatedIdentityCredential.ClaimsMatchingExpression.Value is invalid. Rule exception: Expression configured for issuer ‘https://token.actions.githubusercontent.com‘ either lacks all required claims or contains unallowed claims. paramName: FederatedIdentityCredential.ClaimsMatchingExpression.Value, paramValue: claims[‘sub’] matches ‘repo:xxx@*:pull_request’, objectType: Microsoft.Online.DirectoryServices.Application

As a part of the change, the documentation for flexible federated identity credentials has been updated with the following requirement for Github:

Before this change, our organization used the below expression, which no longer works:

claims['sub'] matches 'repo:fortytwoservices@*:pull_request'

To fix this credential, the following updated expression must be used for old repositories:

claims['sub'] matches 'repo:fortytwoservices@*:pull_request' and claims['repository_owner_id'] eq '108670737'

And this one for newer repositories:

claims['sub'] matches 'repo:fortytwoservices@108670737/*:pull_request' and claims['repository_owner_id'] eq '108670737'

As you can see, the change locks the flexible federated identity credential to the organization, independently of a potential name change – as the repository_owner_id is kept through a name change.

Have fun!