Does your deployment pipeline still authenticate with a client secret? In the best case it lives in a vault and rotates on a schedule nobody loves. In the worst case they are stored somewhere unsecured and nobody has touched them since 2021.

Workload Identity Federation replaces that secret with a trust relationship. Nothing to leak, nothing to rotate, nothing stored outside Azure.

In this session we'll explore the systems behind WIF and OpenID Connect and how the two relate. We set up WIF from scratch in both GitHub Actions and Azure DevOps, and go through the limitations that decide whether it works for you. You leave with a migration path and a clear answer if anyone asks you if WIF is the most secure form of authentication