Workload Identity 連携を使用すると、GKE on Azure が Google サービス アカウントを使用して Azure に対する認証を行うことができます。Azure に対するこの認証方法は、証明書を管理し、手動で Azure Active Directory（AD）にアップロードする必要があった従来の AzureClient 認証方式よりもシンプルです。
Azure AD アプリケーションで連携 ID 認証情報を構成するには、次のコマンドを実行します。各 Azure AD アプリケーションには最大 20 個の認証情報を追加できます。
credential.json という名前の JSON ファイルを作成します。
{
"name": "CREDENTIAL_NAME",
"issuer": "https://accounts.google.com",
"subject": "service-PROJECT_NUMBER@gcp-sa-gkemulticloud.iam.gserviceaccount.com",
"audiences": ["api://AzureADTokenExchange"],
"description": "Allow GKE on Azure to authenticate to the Azure AD application using a Google service account."
}
CREDENTIAL_NAME: 認証情報の名前。
PROJECT_NUMBER: クラスタをホストする Google Cloud プロジェクトの番号。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-30 UTC。"],[],[],null,["# Create an Azure Active Directory application\n============================================\n\nIn this section, you create an\n[Azure Active Directory](https://azure.microsoft.com/en-us/services/active-directory/)\n(Azure AD) application and service principal objects. GKE on Azure\nuses these objects to store configuration information on Azure.\n\n1. To create the Azure AD application, run the following command:\n\n az ad app create --display-name \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e with a name for your\n application---for example, `anthos-clusters`.\n2. To save the application's ID to an environment variable for later use, run\n the following command:\n\n APPLICATION_ID=$(az ad app list --all \\\n --query \"[?displayName=='\u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e'].appId\" \\\n --output tsv)\n\n Replace \u003cvar translate=\"no\"\u003eAPPLICATION_NAME\u003c/var\u003e with the name of your\n application.\n3. To create a service principal for the application, run the following command:\n\n az ad sp create --id \"${APPLICATION_ID}\"\n\nSet up Workload identity federation\n-----------------------------------\n\n\u003cbr /\u003e\n\n| **Note:** GKE on Azure provides two\n| methods of authenticating to Azure: workload identity federation\n| authentication and *AzureClient* authentication. We recommend that you use\n| the workload identity federation method described in this document, because\n| it's simpler and more secure.\n\n\u003cbr /\u003e\n\nWorkload identity federation allows GKE on Azure to authenticate to Azure\nusing a Google service account. This method of authenticating to Azure is\nsimpler than the legacy AzureClient authentication method, which requires\nyou to manage certificates and manually upload them to Azure Active Directory\n(AD).\n\nTo configure a federated identity credential on your Azure AD\napplication, run the following commands. Note that you can add up to twenty\ncredentials to each Azure AD application.\n\n1. Create a JSON file named `credential.json`.\n\n ```json\n {\n \"name\": \"CREDENTIAL_NAME\",\n \"issuer\": \"https://accounts.google.com\",\n \"subject\": \"service-PROJECT_NUMBER@gcp-sa-gkemulticloud.iam.gserviceaccount.com\",\n \"audiences\": [\"api://AzureADTokenExchange\"],\n \"description\": \"Allow GKE on Azure to authenticate to the Azure AD application using a Google service account.\"\n }\n ```\n - \u003cvar translate=\"no\"\u003eCREDENTIAL_NAME\u003c/var\u003e: the credential name.\n - \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the number of the Google Cloud project that hosts the cluster.\n2. Create a federated identity credential on the Azure AD application:\n\n az ad app federated-credential create --id \"${APPLICATION_ID}\" --parameters credential.json\n\nFor more details, see the Azure documentation\n[Azure AD workload identity federation with Google Cloud](https://blog.identitydigest.com/azuread-federate-gcp/).\n\nYou can also provision the Azure federated identity credential using Terraform.\nFor details, see [azuread_application_federated_identity_credential](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/application_federated_identity_credential).\n\nWhat's next\n-----------\n\n- [Create Azure role assignments](/kubernetes-engine/multi-cloud/docs/azure/how-to/create-azure-role-assignments)"]]
