The client application

Hi @Amartya Modi

Thank you for reaching out to Microsoft Q&A.

Confirm Tenant ID:

Go to Azure Portal → Entra ID → Enterprise applications

Search for your Application ID (client-id)

Confirm the Tenant ID shown there matches:

tenant-id: ${{ secrets.AZURE_TENANT_ID }}

1. Update the GitHub secret if needed

App registration exists, but Service Principal is missing

Symptom

App Registration is visible under App registrations

App does NOT appear under Enterprise applications

Why

Creating an App Registration does not always create a Service Principal automatically, especially if:

Admin consent was never granted

App was created but never used

SP was deleted manually

How to fix

Create or re-create the Service Principal:

az ad sp create --id <APP_ID>

Authentication mode mismatch (OIDC vs client secret)

Symptom

Secrets exist, but login type doesn’t match workflow config

Error may surface as missing SP

Why

azure/login@v2 supports multiple auth modes, and mixing them can break authentication:

OIDC does not use client secrets

Secret-based login requires creds or client-secret

Correct configurations

OIDC (recommended):

permissions:
  id-token: write
  contents: read
- uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

Hello Amartya Modi

The error AADSTS7000229 occurs because the Service Principal for the specified client-id does not exist in the tenant used by the GitHub Actions login. GitHub Actions authenticates against the Service Principal (enterprise application), not just the App Registration.

• Confirm that the TenantID where the Service Principal is present matches the tenant-id in the workflow.

   az ad sp show --id <client-id>

If not, create it using : az ad sp create --id <client-id>

• Verify that the authentication technique (client secret vs. OIDC) matches with the workflow.
• Assign the Service Principal the necessary RBAC roles.

The GitHub Actions login will be successful and deployment resumes after the Service Principal is present in the appropriate tenant with a proper auth setting.