Create samlOrWsFedExternalDomainFederation

Namespace: microsoft.graph


APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Create a new samlOrWsFedExternalDomainFederation object.


One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.

Permission type Permissions (from least to most privileged)
Delegated (work or school account) Domain.Read.All, Domain.ReadWrite.All
Delegated (personal Microsoft account) Not supported.
Application Domain.Read.All, Domain.ReadWrite.All

The work or school account needs to belong to one of the following roles:

  • Global Administrator
  • External Identity Provider Administrator

HTTP request

POST /directory/federationConfigurations

Request headers

Name Description
Authorization Bearer {token}. Required.
Content-Type application/json. Required.

Request body

In the request body, supply a JSON representation of the samlOrWsFedExternalDomainFederation object.

The following table shows the properties that are required when you create the samlOrWsFedExternalDomainFederation.

Property Type Description
displayName String The display name of the SAML/WS-Fed based identity provider. Inherited from identityProviderBase.
issuerUri String Issuer URI of the federation server. Inherited from samlOrWsFedProvider.
metadataExchangeUri String URI of the metadata exchange endpoint used for authentication from rich client applications. Inherited from samlOrWsFedProvider.
passiveSignInUri String URI that web-based clients are directed to when signing in to Azure AD services. Inherited from samlOrWsFedProvider.
preferredAuthenticationProtocol String Preferred authentication protocol. Supported values include saml or wsfed. Inherited from samlOrWsFedProvider.
signingCertificate String Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class.

This property is used in the following scenarios:
  • if a rollover is required outside of the autorollover update
  • a new federation service is being set up
  • if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.

Azure AD updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Azure AD monitors the metadata daily and will update the federation settings for the domain when a new certificate is available.


If successful, this method returns a 201 Created response code and a samlOrWsFedExternalDomainFederation object in the response body.



Content-Type: application/json
Content-length: 283

    "@odata.type": "microsoft.graph.samlOrWsFedExternalDomainFederation",
    "issuerUri": "",
    "displayName": "contoso display name",
    "metadataExchangeUri": "",
    "passiveSignInUri": "",
    "preferredAuthenticationProtocol": "wsFed",
    "domains": [
            "@odata.type": "microsoft.graph.externalDomainName",
            "id": ""
    "signingCertificate": "MIIDADCCAeigAwIBAgIQEX41y8r6"


The following is an example of the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-Type: application/json

    "id": "3c41f317-9af3-4266-8ccf-26283ceec888",
    "displayName": "contoso display name"