Set-EntraDomainFederationSettings

Module:

Microsoft.Entra.DirectoryManagement Module v1.3

Updates settings for a federated domain.

Set-EntraDomainFederationSettings

 -DomainName <String>
 [-SigningCertificate <String>]
 [-NextSigningCertificate <String>]
 [-LogOffUri <String>]
 [-PassiveLogOnUri <String>]
 [-ActiveLogOnUri <String>]
 [-IssuerUri <String>]
 [-FederationBrandName <String>]
 [-MetadataExchangeUri <String>]
 [-PreferredAuthenticationProtocol <AuthenticationProtocol>]
 [-SigningCertificateUpdateStatus <SigningCertificateUpdateStatus>]
 [-PromptLoginBehavior <PromptLoginBehavior>]
 [<CommonParameters>]

The Set-EntraDomainFederationSettings cmdlet is used to update the settings of a single sign-on domain.

For delegated scenarios, the calling user must be assigned at least one of the following Microsoft Entra roles:

• Domain Name Administrator
• External Identity Provider Administrator
• Hybrid Identity Administrator
• Security Administrator

Connect-Entra -Scopes 'Domain.ReadWrite.All'
$domain = 'contoso.com'
$authProtocol = 'WsFed'
$promptLoginBehavior = 'TranslateToFreshPasswordAuth' # Or 'NativeSupport' or 'Disabled', depending on the requirement
Set-EntraDomainFederationSettings -DomainName $domain -PreferredAuthenticationProtocol $authProtocol -PromptLoginBehavior $promptLoginBehavior

This command updates the PromptLoginBehavior to either TranslateToFreshPasswordAuth, NativeSupport, or Disabled. These possible values are described:

• TranslateToFreshPasswordAuth - means the default Microsoft Entra ID behavior of translating prompt=login to wauth=https://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password and wfresh=0.
• NativeSupport - means that the prompt=login parameter is sent as is to ADFS.
• Disabled - means that only wfresh=0 is sent to ADFS

Use the Get-EntraDomainFederationSettings -DomainName <your_domain_name> | Format-List * to get the values for PreferredAuthenticationProtocol and PromptLoginBehavior for the federated domain.

• -DomainName parameter specifies the fully qualified domain name to retrieve.
• -PreferredAuthenticationProtocol parameter specifies the preferred authentication protocol.
• -PromptLoginBehavior parameter specifies the prompt sign-in behavior.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.