federation_configuration

Creates, updates, deletes, gets or lists a federation_configuration resource.

Overview

Name	federation_configuration
Type	Resource
Id	entra_id.domains.federation_configuration

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activeSignInUri	string	URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Microsoft Entra ID. Corresponds to the ActiveLogOnUri property of the Set-EntraDomainFederationSettings PowerShell cmdlet.
displayName	string	The display name of the identity provider.
federatedIdpMfaBehavior		Determines whether Microsoft Entra ID accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: acceptIfMfaDoneByFederatedIdp, enforceMfaByFederatedIdp, rejectMfaByFederatedIdp, unknownFutureValue. For more information, see federatedIdpMfaBehavior values.
isSignedAuthenticationRequestRequired	boolean	If true, when SAML authentication requests are sent to the federated SAML IdP, Microsoft Entra ID will sign those requests using the OrgID signing key. If false (default), the SAML authentication requests sent to the federated IdP aren't signed.
issuerUri	string	Issuer URI of the federation server.
metadataExchangeUri	string	URI of the metadata exchange endpoint used for authentication from rich client applications.
nextSigningCertificate	string	Fallback token signing certificate that can also be used to sign tokens, for example when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the signingCertificate, the nextSigningCertificate property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.
passiveSignInUri	string	URI that web-based clients are directed to when signing in to Microsoft Entra services.
passwordResetUri	string
preferredAuthenticationProtocol		Preferred authentication protocol. The possible values are: wsFed, saml, unknownFutureValue.
promptLoginBehavior		Sets the preferred behavior for the sign-in prompt. The possible values are: translateToFreshPasswordAuthentication, nativeSupport, disabled, unknownFutureValue.
signOutUri	string	URI that clients are redirected to when they sign out of Microsoft Entra services. Corresponds to the LogOffUri property of the Set-EntraDomainFederationSettings PowerShell cmdlet.
signingCertificate	string	Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. This property is used in the following scenarios: if a rollover is required outside of the autorollover update a new federation service is being set up if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated. Microsoft Entra ID updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Microsoft Entra ID monitors the metadata daily and will update the federation settings for the domain when a new certificate is available.
signingCertificateUpdateStatus		Provides status and timestamp of the last update of the signing certificate.

list

Retrieved collection

Name	Datatype	Description
id	string	The unique identifier for an entity. Read-only.
activeSignInUri	string	URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Microsoft Entra ID. Corresponds to the ActiveLogOnUri property of the Set-EntraDomainFederationSettings PowerShell cmdlet.
displayName	string	The display name of the identity provider.
federatedIdpMfaBehavior		Determines whether Microsoft Entra ID accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: acceptIfMfaDoneByFederatedIdp, enforceMfaByFederatedIdp, rejectMfaByFederatedIdp, unknownFutureValue. For more information, see federatedIdpMfaBehavior values.
isSignedAuthenticationRequestRequired	boolean	If true, when SAML authentication requests are sent to the federated SAML IdP, Microsoft Entra ID will sign those requests using the OrgID signing key. If false (default), the SAML authentication requests sent to the federated IdP aren't signed.
issuerUri	string	Issuer URI of the federation server.
metadataExchangeUri	string	URI of the metadata exchange endpoint used for authentication from rich client applications.
nextSigningCertificate	string	Fallback token signing certificate that can also be used to sign tokens, for example when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the signingCertificate, the nextSigningCertificate property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.
passiveSignInUri	string	URI that web-based clients are directed to when signing in to Microsoft Entra services.
passwordResetUri	string
preferredAuthenticationProtocol		Preferred authentication protocol. The possible values are: wsFed, saml, unknownFutureValue.
promptLoginBehavior		Sets the preferred behavior for the sign-in prompt. The possible values are: translateToFreshPasswordAuthentication, nativeSupport, disabled, unknownFutureValue.
signOutUri	string	URI that clients are redirected to when they sign out of Microsoft Entra services. Corresponds to the LogOffUri property of the Set-EntraDomainFederationSettings PowerShell cmdlet.
signingCertificate	string	Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. This property is used in the following scenarios: if a rollover is required outside of the autorollover update a new federation service is being set up if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated. Microsoft Entra ID updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Microsoft Entra ID monitors the metadata daily and will update the federation settings for the domain when a new certificate is available.
signingCertificateUpdateStatus		Provides status and timestamp of the last update of the signing certificate.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	domain_id, internal_domain_federation_id		Read the properties and relationships of an internalDomainFederation object.
list	select	domain_id		Read the properties of the internalDomainFederation objects for the domain. This API returns only one object in the collection.
insert	insert	domain_id		Create a new internalDomainFederation object.
update	update	domain_id, internal_domain_federation_id		Update the properties of an internalDomainFederation object.
delete	delete	domain_id, internal_domain_federation_id	If-Match	Delete an internalDomainFederation object.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
domain_id	string	The unique identifier of domain
internal_domain_federation_id	string	The unique identifier of internalDomainFederation
If-Match	string	ETag

SELECT examples

get

Read the properties and relationships of an internalDomainFederation object.

SELECT
id,
activeSignInUri,
displayName,
federatedIdpMfaBehavior,
isSignedAuthenticationRequestRequired,
issuerUri,
metadataExchangeUri,
nextSigningCertificate,
passiveSignInUri,
passwordResetUri,
preferredAuthenticationProtocol,
promptLoginBehavior,
signOutUri,
signingCertificate,
signingCertificateUpdateStatus
FROM entra_id.domains.federation_configuration
WHERE domain_id = '{{ domain_id }}' -- required
AND internal_domain_federation_id = '{{ internal_domain_federation_id }}' -- required
;

list

Read the properties of the internalDomainFederation objects for the domain. This API returns only one object in the collection.

SELECT
id,
activeSignInUri,
displayName,
federatedIdpMfaBehavior,
isSignedAuthenticationRequestRequired,
issuerUri,
metadataExchangeUri,
nextSigningCertificate,
passiveSignInUri,
passwordResetUri,
preferredAuthenticationProtocol,
promptLoginBehavior,
signOutUri,
signingCertificate,
signingCertificateUpdateStatus
FROM entra_id.domains.federation_configuration
WHERE domain_id = '{{ domain_id }}' -- required
;

INSERT examples

insert

Create a new internalDomainFederation object.

INSERT INTO entra_id.domains.federation_configuration (
id,
displayName,
issuerUri,
metadataExchangeUri,
passiveSignInUri,
preferredAuthenticationProtocol,
signingCertificate,
activeSignInUri,
federatedIdpMfaBehavior,
isSignedAuthenticationRequestRequired,
nextSigningCertificate,
passwordResetUri,
promptLoginBehavior,
signingCertificateUpdateStatus,
signOutUri,
domain_id
)
SELECT 
'{{ id }}',
'{{ displayName }}',
'{{ issuerUri }}',
'{{ metadataExchangeUri }}',
'{{ passiveSignInUri }}',
'{{ preferredAuthenticationProtocol }}',
'{{ signingCertificate }}',
'{{ activeSignInUri }}',
'{{ federatedIdpMfaBehavior }}',
{{ isSignedAuthenticationRequestRequired }},
'{{ nextSigningCertificate }}',
'{{ passwordResetUri }}',
'{{ promptLoginBehavior }}',
'{{ signingCertificateUpdateStatus }}',
'{{ signOutUri }}',
'{{ domain_id }}'
RETURNING
id,
activeSignInUri,
displayName,
federatedIdpMfaBehavior,
isSignedAuthenticationRequestRequired,
issuerUri,
metadataExchangeUri,
nextSigningCertificate,
passiveSignInUri,
passwordResetUri,
preferredAuthenticationProtocol,
promptLoginBehavior,
signOutUri,
signingCertificate,
signingCertificateUpdateStatus
;

Manifest

# Description fields are for documentation purposes
- name: federation_configuration
props:
  - name: domain_id
    value: "{{ domain_id }}"
    description: Required parameter for the federation_configuration resource.
  - name: id
    value: "{{ id }}"
    description: |
      The unique identifier for an entity. Read-only.
  - name: displayName
    value: "{{ displayName }}"
    description: |
      The display name of the identity provider.
  - name: issuerUri
    value: "{{ issuerUri }}"
    description: |
      Issuer URI of the federation server.
  - name: metadataExchangeUri
    value: "{{ metadataExchangeUri }}"
    description: |
      URI of the metadata exchange endpoint used for authentication from rich client applications.
  - name: passiveSignInUri
    value: "{{ passiveSignInUri }}"
    description: |
      URI that web-based clients are directed to when signing in to Microsoft Entra services.
  - name: preferredAuthenticationProtocol
    value: "{{ preferredAuthenticationProtocol }}"
    description: |
      Preferred authentication protocol. The possible values are: wsFed, saml, unknownFutureValue.
  - name: signingCertificate
    value: "{{ signingCertificate }}"
    description: |
      Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class.   This property is used in the following scenarios:  if a rollover is required outside of the autorollover update a new federation service is being set up  if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.   Microsoft Entra ID updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Microsoft Entra ID monitors the metadata daily and will update the federation settings for the domain when a new certificate is available.
  - name: activeSignInUri
    value: "{{ activeSignInUri }}"
    description: |
      URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Microsoft Entra ID. Corresponds to the ActiveLogOnUri property of the Set-EntraDomainFederationSettings PowerShell cmdlet.
  - name: federatedIdpMfaBehavior
    value: "{{ federatedIdpMfaBehavior }}"
    description: |
      Determines whether Microsoft Entra ID accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: acceptIfMfaDoneByFederatedIdp, enforceMfaByFederatedIdp, rejectMfaByFederatedIdp, unknownFutureValue. For more information, see federatedIdpMfaBehavior values.
  - name: isSignedAuthenticationRequestRequired
    value: {{ isSignedAuthenticationRequestRequired }}
    description: |
      If true, when SAML authentication requests are sent to the federated SAML IdP, Microsoft Entra ID will sign those requests using the OrgID signing key. If false (default), the SAML authentication requests sent to the federated IdP aren't signed.
  - name: nextSigningCertificate
    value: "{{ nextSigningCertificate }}"
    description: |
      Fallback token signing certificate that can also be used to sign tokens, for example when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the signingCertificate, the nextSigningCertificate property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.
  - name: passwordResetUri
    value: "{{ passwordResetUri }}"
  - name: promptLoginBehavior
    value: "{{ promptLoginBehavior }}"
    description: |
      Sets the preferred behavior for the sign-in prompt. The possible values are: translateToFreshPasswordAuthentication, nativeSupport, disabled, unknownFutureValue.
  - name: signingCertificateUpdateStatus
    value: "{{ signingCertificateUpdateStatus }}"
    description: |
      Provides status and timestamp of the last update of the signing certificate.
  - name: signOutUri
    value: "{{ signOutUri }}"
    description: |
      URI that clients are redirected to when they sign out of Microsoft Entra services. Corresponds to the LogOffUri property of the Set-EntraDomainFederationSettings PowerShell cmdlet.

UPDATE examples

update

Update the properties of an internalDomainFederation object.

UPDATE entra_id.domains.federation_configuration
SET 
id = '{{ id }}',
displayName = '{{ displayName }}',
issuerUri = '{{ issuerUri }}',
metadataExchangeUri = '{{ metadataExchangeUri }}',
passiveSignInUri = '{{ passiveSignInUri }}',
preferredAuthenticationProtocol = '{{ preferredAuthenticationProtocol }}',
signingCertificate = '{{ signingCertificate }}',
activeSignInUri = '{{ activeSignInUri }}',
federatedIdpMfaBehavior = '{{ federatedIdpMfaBehavior }}',
isSignedAuthenticationRequestRequired = {{ isSignedAuthenticationRequestRequired }},
nextSigningCertificate = '{{ nextSigningCertificate }}',
passwordResetUri = '{{ passwordResetUri }}',
promptLoginBehavior = '{{ promptLoginBehavior }}',
signingCertificateUpdateStatus = '{{ signingCertificateUpdateStatus }}',
signOutUri = '{{ signOutUri }}'
WHERE 
domain_id = '{{ domain_id }}' --required
AND internal_domain_federation_id = '{{ internal_domain_federation_id }}' --required
RETURNING
id,
activeSignInUri,
displayName,
federatedIdpMfaBehavior,
isSignedAuthenticationRequestRequired,
issuerUri,
metadataExchangeUri,
nextSigningCertificate,
passiveSignInUri,
passwordResetUri,
preferredAuthenticationProtocol,
promptLoginBehavior,
signOutUri,
signingCertificate,
signingCertificateUpdateStatus;

DELETE examples

delete

Delete an internalDomainFederation object.

DELETE FROM entra_id.domains.federation_configuration
WHERE domain_id = '{{ domain_id }}' --required
AND internal_domain_federation_id = '{{ internal_domain_federation_id }}' --required
AND If-Match = '{{ If-Match }}'
;