Updating an Expired Office 365 v2 SAML Token-Signing Certificate


To avoid user interruptions, it's important to update your OneLogin certificate in Office 365's when it expires. To do this, you'll generate a new certificate in OneLogin, then use Microsoft PowerShell to copy the new certificate to Microsoft Office. This method is required, as SAML and single sign-on (SSO) settings do not appear in the Microsoft 365 Admin Portal.

Related Documentation

Microsoft Support

Prerequisites

 

 

OneLogin

  1. In your OneLogin admin portal, create a new certificate with the following recommended criteria:

    Key Length

    At least 2048

    Signature

    SHA256

    Expiration

    5 Years

    Certificate Keys

    Do not select.
    New Certificate

  2. Once generated, use the clipboard icon to copy the entirety of your new certificate and paste it into a temporary text file for later use.

    X.509 Certificate - Copy to Clipboard

    Tip! To avoid potential errors, we recommended avoiding spaces in both the file name and its directory, such as C:\Temp\OL-O365-New-Cert.txt.

  3. Go to your Applications and locate the Office 365 V2 app. In its SSO settings, choose Manual configuration and select Change under your X.509 Certificate. Use the dropdown menu to replace the current certificate with the new certificate created at the beginning of this process.

    SSO - Manual Configuration

  4. Set the SAML Signature Algorithm to SHA-256 and Save your changes.

PowerShell

  1. Open PowerShell as an administrator.

  2. Modify the PowerShell execution policy by setting the Execution Policy to Remote Signed by running Set-ExecutionPolicy RemoteSigned. Answer A to confirm the change to the Execution Policy.

  3. Install the PowershellGet Module for Windows PowerShell (if it is not already installed) by running Install-Module PowershellGet. Answer Y to install the NuGet Provider, and A to Answer Yes to All to install from PSGallery.

  4. Install the Microsoft.Graph Module for Windows PowerShell (if it is not already installed) by running Install-Module Microsoft.Graph.

  5. Authenticate to Microsoft Graph with the appropriate permissions by running Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All", "Organization.ReadWrite.All", "Directory.ReadWrite.All".

  6. Enter your Microsoft global admin credentials when prompted.

  7. Set PowerShell variables for each configuration item that will be used to update the certificate as follows:

    [string]$newcert = Get-Content "certificate"
$domainId = "domain"
$currentFedConfig = Get-MgDomainFederationConfiguration -DomainId $domainId

    For certificate, enter the full file path to the certificate previously downloaded, and for domain, enter your Office 365 domain. For example, if your domain is example.com and you used the file path in the previous example, you would set the variables like this:

    [string]$newcert = Get-Content "C:\Temp\OL-O365-New-Cert.txt"
$domainId = "example.com"
$currentFedConfig = Get-MgDomainFederationConfiguration -DomainId $domainId

  8. In case of later issues, make a note of the current federation configuration by running the command: $currentFedConfig | Format-List

  9. Update the federation configuration to use the new certificate with this command:

    Update-MgDomainFederationConfiguration -DomainId $domainId -InternalDomainFederationId $currentFedConfig.Id -signingCertificate $newcert

  10. Use this command to check that the federation configuration has been updated to use the new certificate:

    Get-MgDomainFederationConfiguration -DomainId $domainId | Format-List

    You should see that the “SigningCertificate” parameter now contains the new certificate.

  11. Finally, disconnect from the Graph connection using Disconnect-MgGraph. Your update is complete!