I ran into an issue with the OIDC audience used when I used a different environment. I expected the default audience of the environment to be used but instead it was always api://AzureADTokenExchange

I would like the action to set the default audience based on the environment (with a user-specified still value overriding it). If that is not feasible or desirable, I would like the documentation to more explicitly document the need to change the audience when not using commercial cloud.

I would be happy to contribute either of these changes if they would be valuable. For the former, we would need a list of each environment's default audiences

When I was using this to log in to Azure Government with OIDC, I set the following:

      - name: Azure login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          environment: 'AzureUSGovernment'

I expected this to work as is, with the environment setting up any defaults for Azure Government . The default audience when i created my federated id in Azure Government was something like: api://AzureADTokenExchangeUSGov, so I had to set that, like below:

      - name: Azure login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          environment: 'AzureUSGovernment'
          audience: api://AzureADTokenExchangeUSGov