Need to change SAML SSO certificate expire notification email

Question

Hello All,

I have certain SAML SSO applications configured in Azure but I need to change certificate expiring email notification to admin.

So do we have any command to change for all the applications.

Regards,

Answer 1

@Anonymous You will need to update them individually for now as there is no such bulk edit option via GUI/API yet. By default the notification email address address is currently set to the email account with which the user logged in and Added the Application on Azure AD.

Answer 2

I was not able to bulk edit yet but was able to run this command in ms graph and find all the apps I wanted to change.

Run GET https://graph.microsoft.com/beta/serviceprincipals?$filter=preferredSingleSignOnMode eq 'saml'&$select=appDisplayName,notificationEmailAddresses

Answer 3

Is this still not able to be done? I need to do a bulk edit on all of my Enterprise applications to first a check the email and then change it to a new email address.

Answer 4

It's been a long time since your question, but I hope my answer helps you and everyone else who has this concern. I was facing the same issue and needed to change all the Enterprise Application SAML SSO certificate expiration notification emails in my organization. I tried with MS Graph, but it didn't work because I didn't have enough permissions.

Looking at all the Azure CLI commands I've found az ad sp update. Which helps update the attributes of a service principal.

This is a draft example of how you might approach developing a script that automates this.

# Create a function to search all the Service Principals that it's preferredSSOMode is saml and then store the id of all SP that've matched

az ad sp list --filter "preferredSingleSignOnMode eq 'saml'"

# Create another function that takes all the ids of the SP and modifies the attribute notificationEmailAddresses (which is a list) one SP at a time.

az ad sp update --id <ids[$i]> --set notificationEmailAddresses='["******@ex.com","******@ex.com","******@ex.com"]'

Hope this helps someone, it took me a while to figure it out!