How to Synchronize AD FS Token-Signing Certificates
Question details
The user needs to resolve a mismatch between primary token-signing and token-decrypting certificate thumbprints across on-premises and Azure AD FS servers.
- Product
- Active Directory Federation Services (AD FS)
- Device & OS
- not provided
- Scenario
- Managing certificate rollover and maintaining federation trust between on-premises infrastructure and Azure AD.
- Observed behavior
- Primary certificate thumbprints differ between the environments while secondary certificates match, causing concerns about federation reliability.
Ensure you have administrative access to both your on-premises Active Directory Federation Services (AD FS) server and the Microsoft Entra ID (Azure AD) portal before making any certificate changes.
Review AutoCertificateRollover and Update Federation Trust
Verify your automatic certificate rollover settings and manually update the relying party trust to force the environments to synchronize.
When AD FS automatically generates new token-signing and decrypting certificates, Azure AD must poll the federation metadata to update its records. If this polling fails or is delayed, a thumbprint mismatch occurs.
You can manually force this synchronization using Windows PowerShell to ensure single sign-on (SSO) remains functional.
Open Windows PowerShell as an Administrator on your primary AD FS server. Run the command 'Get-ADFSProperties' and check that the 'AutoCertificateRollover' property is set to True.
Using the Azure Active Directory PowerShell module, connect to your tenant by running 'Connect-MsolService'. Then, run 'Update-MsolFederatedDomain -DomainName <YourDomainName>' to pull the latest certificate thumbprints from your on-premises server to Azure AD.
If the certificates still do not match or your environment uses a complex third-party topology, gather your federation details and seek assistance in the Microsoft Technical Q&A community. Modifying AD FS properties improperly can disrupt organization-wide access.
Discover WPS Office for Your Enterprise Documentation
While managing complex IT infrastructure like AD FS and Active Directory, you need reliable tools for creating system documentation and reports. WPS Office provides a highly compatible, lightweight alternative to Microsoft Office for your daily administrative tasks.
Frequently Asked Questions
What is AutoCertificateRollover in AD FS?
AutoCertificateRollover is a built-in AD FS feature that automatically generates new token-signing and token-decrypting certificates before the current ones expire. This ensures uninterrupted federation services without requiring manual administrative intervention.
Why do my primary and secondary AD FS certificates have different thumbprints in Azure AD?
This mismatch typically occurs during a certificate rollover period. The on-premises AD FS server may have generated a new primary certificate, but Azure AD has not yet completed its automated polling process to update its federation metadata with the new thumbprint.
How long does it take for Azure AD to automatically update AD FS certificates?
By default, Azure AD checks the federation metadata of the on-premises AD FS server regularly. However, if the automatic background sync fails or is blocked by network changes, you must manually force the synchronization using the Update-MsolFederatedDomain PowerShell command.
Can I manually change AD FS token-signing certificates?
Yes, but doing so requires temporarily disabling the AutoCertificateRollover feature. Manual management is generally only recommended for advanced configurations or when organizational policies require the use of third-party public certificates.
