Summary

Many large GitHub Enterprise customers use Service Principals to serve their automation needs in a centralised, auditable and secure fashion. Service Principals support the full identity and credential lifecycle for automation scenarios.

Intended Outcome

In this initiative, we will enable support for Azure AD Service Principles for GHEC EMUs as credentials on GitHub apps. We will later bring this capability to GHAE and GHES.

How will it work?

To begin, enterprise customers will first need to configure a GHEC EMU Enterprise utilizing Azure AD OpenID Connect (OIDC). Next, an Azure AD admin will create the application and service principal objects in the application's AAD tenant. Finally, an organization owner will register the Service Principal as a credential on a GitHub Application within their GHEC EMU Enterprise, installed to one or more organizations.