Update internalDomainFederation

Namespace: microsoft.graph

Update the properties of an internalDomainFederation object.

Permissions

One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type	Permissions (from least to most privileged)
Delegated (work or school account)	Domain.ReadWrite.All
Delegated (personal Microsoft account)	Not supported
Application	Domain.ReadWrite.All

The calling user must be assigned the Global Administrator Azure AD role.

HTTP request

PATCH /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}

Request headers

Name	Description
Authorization	Bearer {token}. Required.
Content-Type	application/json. Required.

Request body

In the request body, supply only the values for properties that should be updated. Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values.

The following table specifies the properties that can be updated.

Property	Type	Description
activeSignInUri	String	URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Azure Active Directory (Azure AD). Corresponds to the ActiveLogOnUri property of the Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet.
displayName	String	The display name of the federated identity Provider (IdP).
federatedIdpMfaBehavior	federatedIdpMfaBehavior	Determines whether Azure AD accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: acceptIfMfaDoneByFederatedIdp, enforceMfaByFederatedIdp, rejectMfaByFederatedIdp, unknownFutureValue. For more information, see federatedIdpMfaBehavior values.
isSignedAuthenticationRequestRequired	Boolean	If true, when SAML authentication requests are sent to the federated SAML IdP, Azure AD will sign those requests using the OrgID signing key. If false (default), the SAML authentication requests sent to the federated IdP are not signed.
issuerUri	String	Issuer URI of the federation server.
metadataExchangeUri	String	URI of the metadata exchange endpoint used for authentication from rich client applications.
nextSigningCertificate	String	Fallback token signing certificate that is used to sign tokens when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the signingCertificate, the nextSigningCertificate property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate is not present in the federation properties after the federation service certificate has been updated.
passiveSignInUri	String	URI that web-based clients are directed to when signing into Azure AD services.
preferredAuthenticationProtocol	authenticationProtocol	Preferred authentication protocol. The possible values are: wsFed, saml, unknownFutureValue.
promptLoginBehavior	promptLoginBehavior	Sets the preferred behavior for the sign-in prompt. The possible values are: translateToFreshPasswordAuthentication, nativeSupport, disabled, unknownFutureValue.
signingCertificate	String	Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. This property is used in the following scenarios: If a rollover is required outside of the autorollover update A new federation service is being set up If the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated. Azure AD updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Azure AD monitors the metadata daily and will update the federation settings for the domain when a new certificate is available. Inherited from samlOrWsFedProvider.
signingCertificateUpdateStatus	signingCertificateUpdateStatus	Provides status and timestamp of the last update of the signing certificate.
signOutUri	String	URI that clients are redirected to when they sign out of Azure AD services. Corresponds to the LogOffUri property of the Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet.

federatedIdpMfaBehavior values

Member	Description
acceptIfMfaDoneByFederatedIdp	Azure AD accepts MFA that's performed by the federated identity provider. If the federated identity provider didn't perform MFA, Azure AD performs the MFA.
enforceMfaByFederatedIdp	Azure AD accepts MFA that's performed by federated identity provider. If the federated identity provider didn't perform MFA, it redirects the request to federated identity provider to perform MFA.
rejectMfaByFederatedIdp	Azure AD always performs MFA and rejects MFA that's performed by the federated identity provider.

Note

federatedIdpMfaBehavior is an evolved version of the SupportsMfa property of the Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet.

• Switching between federatedIdpMfaBehavior and SupportsMfa is not supported.
• When federatedIdpMfaBehavior property is set, Azure AD ignores the SupportsMfa setting.
• If the federatedIdpMfaBehavior property is never set, Azure AD will continue to honor the SupportsMfa setting.
• If neither federatedIdpMfaBehavior nor SupportsMfa is set, Azure AD will default to acceptIfMfaDoneByFederatedIdp behavior.

Response

If successful, this method returns a 200 OK response code and an updated internalDomainFederation object in the response body.

Examples

Request

HTTP

PATCH https://graph.microsoft.com/v1.0/domains/contoso.com/federationConfiguration/6601d14b-d113-8f64-fda2-9b5ddda18ecc
Content-Type: application/json

{
  "displayName": "Contoso name change",  
  "federatedIdpMfaBehavior": "acceptIfMfaDoneByFederatedIdp"
}

C#

GraphServiceClient graphClient = new GraphServiceClient( authProvider );

var internalDomainFederation = new InternalDomainFederation
{
	DisplayName = "Contoso name change",
	FederatedIdpMfaBehavior = FederatedIdpMfaBehavior.AcceptIfMfaDoneByFederatedIdp
};

await graphClient.Domains["{domain-id}"].FederationConfiguration["{internalDomainFederation-id}"]
	.Request()
	.UpdateAsync(internalDomainFederation);

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

JavaScript

const options = {
	authProvider,
};

const client = Client.init(options);

const internalDomainFederation = {
  displayName: 'Contoso name change',  
  federatedIdpMfaBehavior: 'acceptIfMfaDoneByFederatedIdp'
};

await client.api('/domains/contoso.com/federationConfiguration/6601d14b-d113-8f64-fda2-9b5ddda18ecc')
	.update(internalDomainFederation);

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Java

GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

InternalDomainFederation internalDomainFederation = new InternalDomainFederation();
internalDomainFederation.displayName = "Contoso name change";
internalDomainFederation.federatedIdpMfaBehavior = FederatedIdpMfaBehavior.ACCEPT_IF_MFA_DONE_BY_FEDERATED_IDP;

graphClient.domains("contoso.com").federationConfiguration("6601d14b-d113-8f64-fda2-9b5ddda18ecc")
	.buildRequest()
	.patch(internalDomainFederation);

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Go

//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClient(requestAdapter)

requestBody := graphmodels.NewInternalDomainFederation()
displayName := "Contoso name change"
requestBody.SetDisplayName(&displayName) 
federatedIdpMfaBehavior := graphmodels.ACCEPTIFMFADONEBYFEDERATEDIDP_FEDERATEDIDPMFABEHAVIOR 
requestBody.SetFederatedIdpMfaBehavior(&federatedIdpMfaBehavior) 

result, err := graphClient.DomainsById("domain-id").FederationConfigurationById("internalDomainFederation-id").Patch(context.Background(), requestBody, nil)

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

PowerShell

Import-Module Microsoft.Graph.Identity.DirectoryManagement

$params = @{
	DisplayName = "Contoso name change"
	FederatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp"
}

Update-MgDomainFederationConfiguration -DomainId $domainId -InternalDomainFederationId $internalDomainFederationId -BodyParameter $params

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

PHP

<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new InternalDomainFederation();
$requestBody->setDisplayName('Contoso name change');

$requestBody->setFederatedIdpMfaBehavior(new FederatedIdpMfaBehavior('acceptifmfadonebyfederatedidp'));



$requestResult = $graphServiceClient->domainsById('domain-id')->federationConfigurationById('internalDomainFederation-id')->patch($requestBody);

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.

Response

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-Type: application/json

{
  "@odata.type": "#microsoft.graph.internalDomainFederation",
  "id": "6601d14b-d113-8f64-fda2-9b5ddda18ecc",
   "displayName": "Contoso name change",
   "issuerUri": "http://contoso.com/adfs/services/trust",
   "metadataExchangeUri": "https://sts.contoso.com/adfs/services/trust/mex",
   "signingCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",
   "passiveSignInUri": "https://sts.contoso.com/adfs/ls",
   "preferredAuthenticationProtocol": "wsFed",
   "activeSignInUri": "https://sts.contoso.com/adfs/services/trust/2005/usernamemixed",
   "signOutUri": "https://sts.contoso.com/adfs/ls",
   "promptLoginBehavior": "nativeSupport",
   "isSignedAuthenticationRequestRequired": true,
   "nextSigningCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",
   "signingCertificateUpdateStatus": {
        "certificateUpdateResult": "Success",
        "lastRunDateTime": "2021-08-25T07:44:46.2616778Z"
    },
   "federatedIdpMfaBehavior": "acceptIfMfaDoneByFederatedIdp"
}