Update samlOrWsFedExternalDomainFederation
Namespace: microsoft.graph
Important
APIs under the /beta
version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.
Update the properties of a samlOrWsFedExternalDomainFederation object.
This API is available in the following national cloud deployments.
Global service | US Government L4 | US Government L5 (DOD) | China operated by 21Vianet |
---|---|---|---|
✅ | ✅ | ✅ | ✅ |
Permissions
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
Permission type | Least privileged permissions | Higher privileged permissions |
---|---|---|
Delegated (work or school account) | IdentityProvider.ReadWrite.All | Not available. |
Delegated (personal Microsoft account) | Not supported. | Not supported. |
Application | IdentityProvider.ReadWrite.All | Not available. |
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported Microsoft Entra role or a custom role with a supported role permission. External Identity Provider Administrator is the least privileged role supported for this operation.
HTTP request
PATCH directory/federationConfigurations/graph.samlOrWsFedExternalDomainFederation/{samlOrWsFedExternalDomainFederation ID}
Request headers
Name | Description |
---|---|
Authorization | Bearer {token}. Required. Learn more about authentication and authorization. |
Content-Type | application/json. Required. |
Request body
In the request body, provide a JSON object with one or more properties that need to be updated for a samlOrWsFedExternalDomainFederation object in Microsoft Entra tenant.
The following table shows the properties that you may update for a samlOrWsFedExternalDomainFederation object.
Property | Type | Description |
---|---|---|
displayName | String | The display name of the SAML/WS-Fed based identity provider. Inherited from identityProviderBase. |
issuerUri | String | Issuer URI of the federation server. Inherited from samlOrWsFedProvider. |
metadataExchangeUri | String | URI of the metadata exchange endpoint used for authentication from rich client applications. Inherited from samlOrWsFedProvider. |
passiveSignInUri | String | URI that web-based clients are directed to when signing in to Microsoft Entra services. Inherited from samlOrWsFedProvider. |
preferredAuthenticationProtocol | String | Preferred authentication protocol. Supported values include saml or wsfed . Inherited from samlOrWsFedProvider. |
signingCertificate | String | Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. This property is used in the following scenarios:
Microsoft Entra ID updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Microsoft Entra ID monitors the metadata daily and will update the federation settings for the domain when a new certificate is available. |
Response
If successful, this method returns a 200 OK
response code and an updated samlOrWsFedExternalDomainFederation object in the response body.
Examples
Request
PATCH https://graph.microsoft.com/beta/directory/federationConfigurations/graph.samlOrWsFedExternalDomainFederation/d5a56845-6845-d5a5-4568-a5d54568a5d5
Content-Type: application/json
{
"displayName": "Contoso name change",
"issuerUri": "http://contoso-test.com/adfs/services/trust",
"metadataExchangeUri": null,
"signingCertificate": "M66C6DCCAdCgAwIBAgIQQ6vYJIVKQ",
"passiveSignInUri": "https://contoso-test.com/adfs/ls/",
"preferredAuthenticationProtocol": "wsFed"
}
Response
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-Type: application/json
{
"id": "d5a56845-6845-d5a5-4568-a5d54568a5d5",
"displayName": "Contoso name change",
"issuerUri": "http://contoso-test.com/adfs/services/trust",
"metadataExchangeUri": null,
"signingCertificate": "M66C6DCCAdCgAwIBAgIQQ6vYJIVKQ",
"passiveSignInUri": "https://contoso-test.com/adfs/ls/",
"preferredAuthenticationProtocol": "wsFed",
"domains": [
{
"id": "contoso.com"
}
]
}