MODIFIED docs/identity/hybrid/connect/how-to-connect-install-multiple-domains.md

Modified by Jackline Omondi on Sep 18, 2025 6:50 PM
📖 View on learn.microsoft.com

+53 / -51 lines changed

Commit: fix blocking issues

Changes:

Before

After

---
title: Microsoft Entra Connect Multiple Domains
description: This document describes setting up and configuring multiple top level domains with Microsoft 365 and Microsoft Entra ID.
author: omondiatieno
manager: mwongerapk
ms.author: jomondi
---
# Multiple Domain Support for Federating with Microsoft Entra ID
The following documentation provides guidance on how to use multiple top-level domains and subdomains when federating with Microsoft 365 or Microsoft Entra domains.
 
## Multiple top-level domain support
Federating multiple, top-level domains with Microsoft Entra ID requires some extra configuration that isn't required when federating with one top-level domain.
 
When a domain is federated with Microsoft Entra ID, several properties are set on the domain in Azure. One important one is IssuerUri. This property is a URI that is used by Microsoft Entra ID to identify the domain that the token is associated with. The URI doesn’t need to resolve to anything but it must be a valid URI. By default, Microsoft Entra ID sets the URI to the value of the federation service identifier in your on-premises AD FS configuration.
 
> [!NOTE]
> The federation service identifier is a URI that uniquely identifies a federation service. The federation service is an instance of AD FS that functions as the security token service.
>
>
 

---
title: Multiple Domain Support for Federating with Microsoft Entra ID
description: This document describes setting up and configuring multiple top level domains with Microsoft 365 and Microsoft Entra ID.
author: omondiatieno
manager: mwongerapk
ms.author: jomondi
---
# Multiple Domain Support for Federating with Microsoft Entra ID
 
This article provides guidance on using multiple top-level domains and subdomains when federating with Microsoft 365 or Microsoft Entra domains.
 
## Multiple top-level domain support
Federating multiple, top-level domains with Microsoft Entra ID requires some extra configuration that isn't required when federating with one top-level domain.
 
When a domain is federated with Microsoft Entra ID, several properties are set on the domain in Azure. One important property is IssuerUri. This property is a URI that is used by Microsoft Entra ID to identify the domain that the token is associated with. The URI doesn’t need to resolve to anything, but it must be a valid URI. By default, Microsoft Entra ID sets the URI to the value of the federation service identifier in your on-premises AD FS configuration.
 
> [!NOTE]
> The federation service identifier is a URI that uniquely identifies a federation service. The federation service is an instance of AD FS that acts as the security token service.
 
You can view the IssuerUri by using the PowerShell command `Get-EntraDomainFederationSettings -DomainName <your domain>`.

MODIFIED docs/identity/hybrid/connect/how-to-connect-emergency-ad-fs-certificate-rotation.md

Modified by Jackline Omondi on Sep 18, 2025 11:37 AM
📖 View on learn.microsoft.com

+26 / -19 lines changed

Commit: Updates on how to get entra federation property

Changes:

Before

After

ms.service: entra-id
ms.custom: no-azure-ad-ps-ref
ms.topic: how-to
ms.date: 04/09/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
 
## Determine your Token Signing Certificate thumbprint
 
To revoke the old Token Signing Certificate that AD FS is currently using, you need to determine the thumbprint of the token-signing certificate. Do the following:
 
1. Connect to the Microsoft Online Service by running in PowerShell `Connect-MsolService`.
 
1. Document both your on-premises and cloud Token Signing Certificate thumbprint and expiration dates by running `Get-MsolFederationProperty -DomainName <domain>`.
1. Copy down the thumbprint. You'll use it later to remove the existing certificates.
 
You can also get the thumbprint by using AD FS Management. Go to **Service** > **Certificates**, right-click the certificate, select **View certificate**, and then select **Details**.
 
 

ms.service: entra-id
ms.custom: no-azure-ad-ps-ref
ms.topic: how-to
ms.date: 09/18/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
 
## Determine your Token Signing Certificate thumbprint
 
To revoke the old Token Signing Certificate that AD FS is currently using, you need to determine the thumbprint of the token-signing certificate. From your ADFS Server do the following:
 
1.  Connect to the Microsoft Entra PowerShell module:
 
   `Connect-Entra -Scopes 'Domain.Read.All'`.
 
1. Document both your on-premises and cloud Token Signing Certificate thumbprint and expiration dates by running:
  
   *`Get-AdfsCertificate -CertificateType token-signing>`
 

MODIFIED docs/identity/hybrid/connect/how-to-connect-fed-o365-certs.md

Modified by Jackline Omondi on Sep 18, 2025 11:37 AM
📖 View on learn.microsoft.com

+24 / -11 lines changed

Commit: Updates on how to get entra federation property

Changes:

Before

After

ms.tgt_pltfrm: na
ms.custom: no-azure-ad-ps-ref, sfi-image-nochange
ms.topic: how-to
ms.date: 04/09/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
Check the certificates configured in AD FS and Microsoft Entra ID trust properties for the specified domain.
 
```azurepowershell-interactive
Get-EntraFederationProperty -DomainName <domain.name> | FL Source, TokenSigningCertificate
```
If the thumbprints in both the outputs match, your certificates are in sync with Microsoft Entra ID.
 
Two certificates should be listed now, one of which has a **NotAfter** date of approximately one year in the future, and for which the **IsPrimary** value is **False**.
 
### Step 2: Update the new token signing certificates for the Microsoft 365 trust
Update Microsoft 365 with the new token signing certificates to be used for the trust, as follows.
 
1. Open Azure PowerShell.

ms.tgt_pltfrm: na
ms.custom: no-azure-ad-ps-ref, sfi-image-nochange
ms.topic: how-to
ms.date: 09/18/2025
ms.subservice: hybrid-connect
ms.author: jomondi
---
Check the certificates configured in AD FS and Microsoft Entra ID trust properties for the specified domain.
 
```azurepowershell-interactive
Get-EntraFederationProperty -DomainName <domain.name> | FL Source, SigningCertificate
```
If the thumbprints in both the outputs match, your certificates are in sync with Microsoft Entra ID.
 
Two certificates should be listed now, one of which has a **NotAfter** date of approximately one year in the future, and for which the **IsPrimary** value is **False**.
 
### Step 2: Update the new token signing certificates for the Microsoft 365 trust
 
Update Microsoft 365 with the new token signing certificates to be used for the trust, as follows.
 

📋 Microsoft Entra Documentation Changes

📊 Summary

📝 Modified Documentation Files