Share via

Domain should match the passive sign in uri

mohamed assem 0 Reputation points
2024-05-04T17:41:24.8066667+00:00

I am trying to configure an external identity provider in Entra. When I try to do it I get the error "domain should match the passive sign in uri" I tried editing in the DNS of the domain exactly as its shown in the error:

TXT Record:

Domain_name "DirectFedAuthUrl=passiveauthenticationURL"

Also tried with DirectFedPassiveSignInUri instead of DirectFedAuthUrl. Still getting the same error, any ideas ?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,769 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. James Hamil 22,186 Reputation points Microsoft Employee
    2024-05-07T20:03:24.1+00:00

    Hi @mohamed assem , this error occurs when the domain name in the TXT record does not match the domain name in the passive sign-in URI. To resolve this issue, you need to ensure that the domain name in the TXT record matches the domain name in the passive sign-in URI.

    Here are the steps to follow:

    1. Check the passive sign-in URI of your external identity provider to see if the domain matches the target domain or a host within the target domain.
    2. If the passive sign-in URI is a host within the same domain, then no DNS changes are needed.
    3. If the passive sign-in URI is not within the same domain, then you need to add a TXT record to your domain's DNS records.
    4. The TXT record should have the following format: Domain_name IN TXT DirectFedAuthUrl=passiveauthenticationURL Replace Domain_name with your domain name and passiveauthenticationURL with the passive sign-in URI of your external identity provider.
    5. Wait for the DNS changes to propagate. This can take up to 24 hours.
    6. After the DNS changes have propagated, try configuring your external identity provider again.

    Please let me know if you have any questions and I can help you further.

    If this answer helps you please mark "Accept Answer" so other users can reference it.

    Thank you,

    James

    0 comments