What problem does it solve? GitHub Actions workflows fail to authenticate to Azure with the cryptic error "AADSTS700213: No matching federated identity record found for presented assertion subject", which looks like a permissions problem but is actually an exact-string mismatch between the OIDC token's subject claim and the federated identity credentials registered on the Azure app registration. ## Core Features & Use Cases - Triage workflow: Three commands (gh api, az ad app list, az ad app federated-credential list) to compare the subject presented in the failing run against the credentials actually registered. - Temporary unblock: Add a single per-branch federated credential so a blocked developer can re-run immediately without merging a PR. - Permanent fix: Create a flexible federated credential using claimsMatchingExpression to match any branch, then declare the app registration and credentials in Terraform with the azuread provider. - Use Case: A developer's manual workflow_dispatch from a feature branch fails azure/login even though pull_request runs succeed; this Skill identifies that the trigger type changes the subject claim and fixes the credential accordingly. ## Quick Start Ask the assistant to diagnose why my GitHub Actions azure/login step is failing with AADSTS700213 and fix the federated credential on the app registration.
