Security Policy Errors

How to Fix the Managed-to-Federated Domain Error in Update-MgDomain

Muhammad Talha Oct 21, 2026 868 views

Question details

The user is encountering an error when attempting to change a managed subdomain to federated authentication using the Update-MgDomain cmdlet.

How to Fix the Managed-to-Federated Domain Error in Update-MgDomain

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Using Microsoft Graph PowerShell to update the authentication type of a subdomain.
Observed behavior: Update-MgDomain fails to apply the federated authentication type because subdomains automatically inherit their authentication settings from the root domain.

Before you start

Ensure you have Global Administrator privileges in Microsoft Entra ID and the latest version of the Microsoft Graph PowerShell SDK installed before executing domain changes.

Solution 1Recommended

Promote the Subdomain to a Root Domain

To apply a different authentication type, you must first break the inheritance by promoting the subdomain to a root domain.

By design, Microsoft Entra ID subdomains inherit the authentication configuration (managed or federated) of their parent root domain. The Update-MgDomain cmdlet cannot override this inheritance directly. Promoting the subdomain effectively isolates it, allowing you to configure its authentication independently.

Connect to Microsoft Graph

Open PowerShell as an administrator and run the 'Connect-MgGraph' cmdlet. Ensure you authenticate with an account that has the required directory scopes (e.g., Domain.ReadWrite.All).

Promote the Subdomain

Use the appropriate Microsoft Graph endpoint or PowerShell script provided in Microsoft's official documentation to promote your target subdomain to a root domain within your tenant.

Update Authentication Type

Once the domain is successfully promoted and recognized as a root domain, run the 'Update-MgDomain' cmdlet again to change its authentication type from managed to federated.

Microsoft Documentation: Review Microsoft's official documentation on changing subdomain authentication types using PowerShell and Graph for exact syntax and parameter requirements.

Free Microsoft Office alternative

Manage Your IT Documentation Efficiently with WPS Office

While resolving complex Microsoft Entra ID deployments, you still need a reliable office suite for logging IT scripts, generating reports, and writing technical documentation. WPS Office is a highly compatible, free, and lightweight alternative to Microsoft Office.

1. Download the Installer: Visit the official WPS Office website and click the free download button.
2. Run the Installation: Open the downloaded installer file and follow the quick setup wizard.
3. Start Creating: Launch WPS Office and instantly open your existing Microsoft Office documents to continue working.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx) for seamless documentation sharing.Lightweight architecture ensures fast startup times, even on heavily loaded IT administration machines.Familiar tabbed user interface allows for a quick transition without a steep learning curve.Built-in PDF toolkit makes it easy to edit, convert, and sign technical manuals and security policies.

Frequently Asked Questions

Why does Microsoft Entra ID force subdomains to inherit authentication types?

Microsoft Entra ID enforces inheritance by default to simplify administration and ensure consistent security policies across a unified namespace. To apply different security or authentication policies, the subdomain must be promoted.

Can I promote a subdomain using the Microsoft Entra admin center UI?

Currently, advanced domain structure changes, such as promoting a managed subdomain to a root domain to change its authentication type, generally require the use of Microsoft Graph API or the Microsoft Graph PowerShell SDK.

Where can I find more help if Update-MgDomain still fails?

If you continue to experience issues after promoting the domain, it is highly recommended to seek assistance on the Microsoft Q&A forums under the Microsoft Graph SDK or Azure Active Directory tags.

Microsoft Office Security Issues