This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 51%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJE%3C/text%3E%3C/svg%3E)
Currently running Exchange SE and I need to update our Exchange Delegation Federation Certificate. I am seeing links and documentation that points to Exchange 2013 steps. Are these steps still valid for Exchange SE?
The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 1%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEE%3C/text%3E%3C/svg%3E)
@Hani-Ng I am running SE, did the HCW run, but no Federation Certificate was created. Does running this when the current Federation Certificate has expired have any impact?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 84%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHN%3C/text%3E%3C/svg%3E)
Hi Emmanuel Eze
Since a different set of requirements from the original question, I recommend creating a new thread and including these details there. This helps avoid mixing multiple issues in one discussion and allows moderators to focus on your specific use case more effectively.
Creating a separate thread will also enable us to request additional information via private message if needed, while helping protect personal or organizational data.
Thank you for your understanding.
Thank you for reaching out to Microsoft Q&A forum.
Based on your description, I would like to share this official Microsoft Learn article, as the procedure is applicable to both Exchange 2019 and Exchange SE. You can follow the article below; the PowerShell commands listed there are fully compatible with Exchange SE. (Exchange 2013 has reached End of Support, as have Exchange 2016 and 2019. However, the architecture for the Federation Trust (and the Microsoft Federation Gateway) has remained consistent since those versions. Consequently, the steps utilized in previous versions are still the valid and supported method for Exchange SE).
Renew the federation certificate: Exchange 2013 Help | Microsoft Learn
If you are running Exchange SE in a Hybrid environment, the most reliable method to update this certificate is to download and run the latest Hybrid Configuration Wizard (HCW). The wizard is updated regularly to support Exchange SE and will automatically rotate the certificate for you, ensuring the trust with Entra ID (Azure AD) is maintained correctly.
If you must perform this manually (for on-premises only scenarios), please use the PowerShell steps in the link above, as the Exchange Admin Center (EAC) in Exchange SE does not support this workflow.
I hope this information is helpful, and if you need any additional details, please feel free to ask. I’m here to help.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
While this may work to update the Hybrid Cert I am still not seeing the Exchange Delegation Federation certificate be updated or changed.
Thank you for the update. I understand the confusion, and I appreciate you testing the Hybrid Configuration Wizard (HCW) first. I would like to share some information from my side, and based on my research, I hope it will be useful.
The HCW is recommended as the first step because it attempts to repair missing or broken federation trusts automatically. If your Federation Trust had been completely invalid or missing, the HCW would have generated a new certificate and established the trust from scratch. This is the safest method for most user to ensure the underlying metadata matches Microsoft 365.
The HCW logic is designed to be non-intrusive regarding existing Federation Trusts. When you run the wizard:
If the HCW did not trigger an automatic rotation (likely because it sees the current trust as technically "functional"), you should now proceed with the manual PowerShell steps to force the rotation that the HCW skipped. You can proceed with the New-ExchangeCertificate and Set-FederationTrust commands.
I hope this explains the logic behind the recommendation and confirms the next steps for your environment.
I just wanted to follow up to see if you need any additional information regarding this matter. Please don’t hesitate to reach out!