Microsoft Security | Active Directory Federation Services
Federated identity management using Active Directory Federation Services
Tried to update the latest ADFS certificate to primary but we could not access the URL since then
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 64%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBD%3C/text%3E%3C/svg%3E)
Bhavya Dundigalla
0
Reputation points
Hi Team,
I have updated the latest certificate to Primary certificate in ad fs manager for both Tocken-Decrypting and Token-Signing.
But from then on I could not access the URL with below error:
- Activity ID: 28dcd7a2-4933-4ad8-1600-0080030000e8
- Relying party: Infor_XIPORTAL_XiPlatform_W1615456339
- Error details: MSIS7042: The same client browser session has made '6' requests in the last '9' seconds. Contact your administrator for details.
- Node name: af60009a-937a-4e6e-ad84-20c18cc4b1d3
- Error time: Fri, 12 Sep 2025 07:31:03 GMT
- Cookie: enabled
- User agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Can you please review this and let us know what needs to be done. Please note that ADFS is in separate server and Application is installed in separate server.
Thank you..!
Microsoft Security | Active Directory Federation Services
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 7.000000000000001%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
Carolyne 1,151 Reputation points Microsoft Employee2026-03-18T16:43:03.8666667+00:00 This error MSIS7042 means AD FS loop detection is triggering—your relying party keeps redirecting the browser back to AD FS because it’s rejecting the issued token. This commonly occurs after promoting a new Token‑Signing/Decrypting certificate when the relying party still trusts the old certificate or hasn’t refreshed federation metadata.
To resolve, try to update the relying party (Infor_XIPORTAL) to trust the new primary token‑signing certificate (or re‑import AD FS federation metadata) and restart the app/IIS. By design, once a cert is Primary, AD FS signs tokens only with it; secondary certs won’t authenticate requests.
You can tune or briefly disable loop detection to confirm the root cause, but re‑enable it after fixing trust. Example:
Set-AdfsProperties -EnableLoopDetection $false(diagnostics only) or adjust thresholds per Microsoft guidance
Sign in to comment
Sign in to answer