Create federated credentials for GH or ADO

New-FederatedCredentials.ps1

function New-FederatedCredentials {
    [CmdletBinding(DefaultParameterSetName='GitHub')]
    param(
        [Parameter(Mandatory)]
        [string]$managedIdentityName,

        [Parameter(Mandatory, ParameterSetName='GitHub', Position=0)]
        [string]$githubOrg,
        [Parameter(Mandatory, ParameterSetName='GitHub', Position=1)]
        [string]$githubRepo,
        [Parameter(Mandatory, ParameterSetName='GitHub', Position=2)]
        [string]$githubEnvironmentName,

        [Parameter(Mandatory, ParameterSetName='ADO', Position=0)]
        [string]$adoOrg,
        [Parameter(Mandatory, ParameterSetName='ADO', Position=1)]
        [string]$adoProject,
        [Parameter(Mandatory, ParameterSetName='ADO', Position=2)]
        [string]$adoOrgGUID,
        [Parameter(Mandatory, ParameterSetName='ADO', Position=3)]
        [string]$adoServiceConnectionName
    )

    switch ($PSCmdlet.ParameterSetName) {
        'GitHub' {
            $subject  = "repo:$githubOrg/$githubRepo:environment:$githubEnvironmentName"
            $issuer   = "https://token.actions.githubusercontent.com"
            $credName = "gh-oidc-$githubOrg-$githubRepo-$githubEnvironmentName"
        }
        'ADO' {
            $subject  = "sc://$adoOrg/$adoProject/$adoServiceConnectionName"
            $issuer   = "https://vstoken.dev.azure.com/$adoOrgGUID"
            $credName = "ado-oidc-$adoOrg-$adoProject-$adoServiceConnectionName"
        }
    }

    # normalize
    $credName = ($credName.ToLower() -replace ' ', '-')
    $subject  = ($subject.ToLower()  -replace ' ', '-')

    try {
        $param = @{
            Name         = $credName
            IdentityName = $managedIdentityName
            Audience     = @('api://AzureADTokenExchange')
            Issuer       = $issuer
            Subject      = $subject
        }
        New-AzADServicePrincipalFederatedIdentityCredential @param -ErrorAction SilentlyContinue
        Write-Host "✔ Created federated credential '$credName' for managed identity '$managedIdentityName'"
    }
    catch {
        Write-Warning "Failed to create federated credential '$credName': $_"
    }
}