Why the federation metadata xml cannot be updated?

Question

The certificate used for single sign-on to Palo Alto Networks - GlobalProtect will be expired, we renewed Global Protect certificate and download the new Federation Metadata XML, but after we upload the new xml file to PA440 device and found the expired date did not updated, Could you please give us some suggestion ?

Thanks

Answer 1

Hello Wang, Xinchuan (Admin)

Thank you for reaching out to Microsoft Q&A.

Why the Federation Metadata XML did not update: -

What you are seeing is normal and by design in Microsoft Entra ID (Azure AD).

1. Federation Metadata XML always contains multiple signing certificates

Microsoft Entra ID publishes both the active and next (rollover) token‑signing certificates in the Federation Metadata XML at the same time to support zero‑downtime certificate rollover.

That means:

The expired (or soon‑to‑expire) certificate may still appear

The new certificate is already present

Palo Alto may continue to display the old expiration date if it is still reading the primary certificate

Microsoft confirms this behavior in its federation documentation.

For your reference: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-o365-certs

2. The metadata URL does not change

The Federation Metadata endpoint is static:

https://login.microsoftonline.com/<tenant-id>/federationmetadata/2007-06/federationmetadata.xml

Microsoft rotates certificates inside the XML, not by changing the URL.

If Palo Alto expects a “new file with a new expiry only”, it may look like nothing changed, even though it has.

This is confirmed in Microsoft Q&A and Learn documentation. [learn.microsoft.com]

3. Palo Alto often caches or prioritizes the old primary certificate

On Palo Alto firewalls:

Importing metadata does not always switch to the new signing cert

The firewall may continue validating against the old certificate until:

It expires, or

You manually re‑import / recreate the IdP profile

This is a Palo Alto behavior, not a Microsoft issue, and is common with SAML SPs.

How to prove the new certificate is already in the metadata (Microsoft‑side)

Download the Federation Metadata XML again from Entra ID.

Open it and locate:

<KeyDescriptor use="signing">

  <X509Certificate>...</X509Certificate>

</KeyDescriptor>

You will typically see two certificates:

One expiring soon / expired

One with a later expiration date

Microsoft documents this rollover design explicitly

For your reference: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-o365-certs

Below is the resolution: -

Option 1

Do nothing on Entra ID

Microsoft automatically switches the active signing certificate when the old one expires.

What to do on Palo Alto:

Re‑import the metadata after rollover

Or delete and recreate the SAML Identity Provider profile

Commit changes

This aligns with Microsoft’s zero‑downtime federation model. [learn.microsoft.com]

Option 2 (Manual but Immediate Fix – Common for Palo Alto)

If Palo Alto must show the new expiry immediately:

In Microsoft Entra Admin Center

Go to Enterprise Applications → Palo Alto Networks – GlobalProtect

SAML Certificates

Download the new certificate (.cer) (not metadata)

On PA‑440

Import the certificate manually

Assign it to the SAML IdP profile

Commit

Answer 2

The expiration date shown on the Palo Alto PA‑440 will not change until the firewall actually consumes and applies a SAML signing certificate with a different validity period from the metadata. Common reasons why the date appears unchanged after uploading the new Federation Metadata XML include:

1. The new certificate in Microsoft Entra ID is not yet active

• When a new SAML signing certificate is created in Microsoft Entra ID, it is initially Inactive.
• The Federation Metadata XML downloaded from Microsoft Entra ID contains the certificate that is active at the time of download.
• If the old (expiring) certificate is still active, the metadata may still reference that certificate, so the Palo Alto device continues to show the old expiration date.

Action:

1. In Microsoft Entra admin center, go to:
   • Entra ID > Enterprise apps > Palo Alto Networks - GlobalProtect > Single sign-on.
2. Under SAML Certificates (or SAML Signing Certificate), ensure the new certificate is created and then use Make certificate active on the new certificate.
3. After it is active, download Federation Metadata XML again.
4. Re‑import this new XML into the PA‑440 under Device > SAML Identity Provider.
5. Wrong file or wrong place imported on Palo Alto

• Palo Alto requires the IdP metadata file to be imported under the SAML IdP profile.
• If another file (for example, only a .cer) is imported, or it is imported into the wrong object, the SAML IdP profile may still reference the old certificate.

Action on PA‑440:

1. Open the firewall GUI as administrator.
2. Go to Device.
3. Select SAML Identity Provider and click Import.
4. In Identity Provider Metadata, browse and select the new Federation Metadata XML downloaded after activating the new certificate.
5. Confirm that the correct Profile Name is used and save/commit the configuration.
6. Metadata not updated because only a new certificate was created, not saved

• In Microsoft Entra ID, creating a new certificate requires explicitly saving it.
• If the new certificate row was created but not saved, the metadata will still contain the old certificate.

Action:

1. Follow the steps in Create a new certificate to:
   • Create the new certificate.
   • Adjust the expiration date if needed.
   • Select Save so the certificate appears with status Inactive.
2. Then make it active, download the metadata, and re‑import into Palo Alto as above.
3. Palo Alto still showing cached or old profile

• If multiple SAML IdP profiles exist on the firewall, GlobalProtect may still be bound to the old profile.

Action:

• Verify that the GlobalProtect portal/gateway configuration is using the updated SAML IdP profile (the one where the new metadata was imported).
• Commit the configuration and then recheck the certificate details in that profile.

Summary of recommended sequence

1. In Microsoft Entra ID:
   • Create and Save a new SAML signing certificate for the GlobalProtect app.
   • Make certificate active.
   • Download Federation Metadata XML from SAML Signing Certificate / SAML Certificates.
2. On PA‑440:
   • Import this XML under Device > SAML Identity Provider.
   • Ensure GlobalProtect uses this SAML IdP profile.
   • Commit changes and verify the new expiration date.

If after these steps the expiration date still does not change, verify that the metadata XML actually contains the new certificate (different expiration date and thumbprint) before importing it into the firewall.

---

References:

• Configure Palo Alto Networks - GlobalProtect for Single sign-on with Microsoft Entra ID
• Tutorial: Manage certificates for federated single sign-on
• Configure Skills Base for Single sign-on with Microsoft Entra ID