Unable to configure flexible federated credential with issuer : https://token.actions.abc-xyz.ghe.com

The error occurs because flexible federated identity credentials and claims matching expressions are only available in supported regions/tenants and through supported issuers and APIs. When the feature or expression engine is not enabled for the cloud/region, Microsoft Entra ID returns an error similar to what is shown in the screenshot.

To configure a similar permission today, use one of the supported approaches for federated identity credentials instead of the flexible (preview) claims-matching expression:

1. Configure a standard federated identity credential using Other issuer:
   1. In Microsoft Entra admin center, open the target app registration.
   2. Go to Certificates & secrets → Federated credentials → + Add credential.
   3. For Federated credential scenario, select Other issuer.
   4. Set Issuer to the external IdP’s OIDC issuer URL (must match the iss claim in its tokens).
   5. Use Explicit subject identifier and set Subject identifier to match the sub claim from the external IdP token (for example, the unique ID of the service account or workload identity).
   6. Save the credential.
2. If flexible federated identity credentials are required (for example, to use a claims['sub'] matches 'repo:...:ref:refs/heads/*' expression), ensure that:
   • The tenant/region supports flexible federated identity credentials (preview).
   • The issuer is a valid OIDC issuer URL that Entra ID can use to retrieve signing keys.
   • The audience is the single supported audience api://AzureADTokenExchange when creating via Microsoft Graph, as shown in the example:

          {
            "audiences": [
              "api://AzureADTokenExchange"
            ],
            "issuer": "https://token.actions.githubusercontent.com",
            "name": "MyFlexibleFIC",
            "claimsMatchingExpression": {
              "value": "claims['sub'] matches 'repo:contoso/contoso-repo:ref:refs/heads/*'",
              "languageVersion": 1
            }
          }
     

3. If Azure CLI, Azure PowerShell, or Terraform are being used, do not attempt to manage flexible federated identity credentials directly with their native commands, because they do not yet support this feature. Use Microsoft Graph (or az rest) instead when working with flexible credentials.

If the tenant’s region does not yet support flexible federated identity credentials, only the standard “Other issuer” configuration with explicit subject identifier can be used until the feature is available.

References:

• Set up a Flexible Federated identity credential (preview)
• Flexible federated identity credentials (preview)
• Configure an app to trust an external identity provider (identity-wif-apps-methods-azp)
• Important considerations and restrictions for federated identity credentials