Trying to update a cert with a federated Azure domain, cannot verify domain.

Question

-Hybrid Azure tenant -Fortiauthenticator MFA(SAML through federated domain in Azure, not in AD)

My MFA broke the other day when I was setting a new configuration. The UI informed me that our current cert to our federated domain is out of date and since I had made changes, it would not allow it to save without a valid cert. I found the new cert and changed it in Fortiauth. Then, I went to go change it for our federated domain and ran the following powershell cmdlets: Get-MSOLDomainFederationSettings

-This showed me the old certificate was definitely still in use and showed my federated domain.

Set-MsolDomainFederationSettings

-Added the new cert and all domain information, no error.

Confirm-MsolDomain

-Error: confirm-Unable to verify this domain because it is used elsewhere in office 365. Remove the verified domain from the other service before adding it here.

Get-MSOLDomainFederationSettings

-Old cert still in place despite Set-MsolDomainFederationSettings giving no error.

Our domain(ie: contoso.com) is federated and verified in our tenant. However, when our tenant was created, they set it as a different name(ie: contosoonline.onmicrosoft.com). I am new to the company but previously, users were given carte blanche to do what they wanted. It seems like someone maybe made a tenant with the federated domain(ie: contoso.onmicrosoft.com). I tried the PowerBI trial trick to get the "rogue tenant"(https://learn.microsoft.com/en-us/entra/identity/users/domains-admin-takeover)"learn.microsoft.com") but it never gave me access and only assigned me back to our current tenant. So now I need to update the certificate at the very least, but also reclaim the tenant. I'm currently sitting on hold for 3 hours with Microsoft support waiting for any assistance, but I'm hoping someone else might have an idea to help me.

Also.. I would like to move our MFA off this and to an Enterprise App(Whoever did this as a federated is on my list) but I can't at this time without breaking everyone.

And we do NOT have a ADFS.

Answer 1

Hi @Kay Peek,

Thank you for posting your query on Microsoft Q&A.

Based on your query, I understand that you have an issue while updating the certificate for a federated domain.

As per the description, you have tried updating the federate domain certificate using Confirm-MsolDomain. This command is used to verify the federated domain, that is the reason you have seen the error. If you would like to update the certificate for federated domain, you need to use set commands. Here is the document which helps you in understanding the update of certificates: Set-MsolDomainFederationSettings

Here is the command to check the status of updated certificate:

 Set-MsolDomainFederationSettings [-SigningCertificateUpdateStatus <SigningCertificateUpdateStatus>]

Once you update the certificate you can restart the services of federation to check the status accordingly.

If this does not help you, you can also update the certificate using MgGraph:

1. Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
2. Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force
3. Get-InstalledModule Microsoft.Graph
4. Update-MgDomainFederationConfiguration -DomainId <String> -InternalDomainFederationId <String> [-SigningCertificate <String>]
5. Restart-Service -Name winmgmt(Name of the service)

Here is the referenced document: Update-MgDomainFederationConfiguration

I see you also had a discussion with our service team regarding the admin lost access. If you lost access to the tenant, our team would collect the required information and validates it. Once the validation is done, you will be assisted further in gaining the access back. If your still not resolved, kindly let me know we are happy to assist you from our end.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment"