AD FS – Updating the Token-signing and Token-decrypting certificates in AD FS

Update notice — September 2026: This article contains commands from the Azure AD or MSOnline PowerShell modules maintained since its original publication. Microsoft has deprecated these modules and recommends Microsoft Graph PowerShell for current automations. Do not use the legacy commands in new implementations.

Source: Guidance for migrating to Microsoft Graph: “Azure AD, Azure AD Preview and MSOnline PowerShell modules are deprecated.”

Hello everyone. Are you one of those administrators who shudders just seeing that the time is coming to update the AD FS certificates? 😱

In today’s article I’ll explain how to update the AD FS Token-signing and Token-decrypting certificates automatically and manually, while keeping the AD FS environment functional.

What is the Token-signing Certificate used for?

AD FS servers use the token-signing type certificate to prevent hackers from making changes to authorization tokens and gaining access to federated services. Private and public keys are used to ensure that the security token is not generated by anything other than a trusted source and is not altered by third parties.

What is the Token-decrypting Certificate used for?

The token-decrypting type certificate is used to decrypt tokens that were encrypted by other federated resources. All certificates have a private key.

Changing the Token-signing and Token-decrypting certificates automatically

By default, the TS (Token-signing) and TD (Token-Decrypting) certificates are configured to be updated automatically through the feature called AutoCertificateRollover.

This setting can be observed by running the command below on a primary AD FS server:

Get-AdfsProperties

The available parameters are:

AutoCertificateRollover: If active, allows the AD FS service to manage the issuance and replacement of certificates automatically by generating a secondary certificate and then promoting it.
CertificateCriticalThreshold: Contains the number of days before the expiration of the primary TS or TD certificate. When the value set in this parameter is reached, the certificate replacement process starts by generating a new certificate and promoting it to primary.
CertificateDuration: Contains the number of days that certificates in the AD FS service can remain valid.
CertificateGenerationThreshold: Contains the number of days before the AD FS service generates a new certificate. When the number of days specified in this parameter is reached, the service starts creating the new certificate, naming it as secondary. At this point, applications that consume the AD FS settings through the metadata file can already access information about the new certificate before it replaces the current one, avoiding unavailability resulting from the change.
CertificatePromotionThreshold: Contains the number of days the new certificate remains as secondary before being promoted to primary.
CertificateRolloverInterval: Contains the time in minutes at which AD FS checks whether any new certificate needs to be generated.
CertificateThresholdMultiplier: Contains the time multiplier. By default, this parameter has the number of minutes in a day (1440). It is changed only in specific cases where you want to set a certificate expiration time shorter than one day.

If you keep the default with AutoCertificateRollover active, the TS and TD certificates will be generated automatically and consumed by the Relying Parties through the AD FS metadata file available through the URL https://server.domain.com/FederationMetadata/2007-06/FederationMetadata.xml.

For applications that do not support automatic updating, you must export the certificate generated by AD FS and schedule the change with the service provider responsible for the application.

When the certificate is generated, you can observe the certificates identified as secondary, being promoted automatically when CertificatePromotionThreshold is reached.

Changing the Token-signing and Token-decrypting certificates manually

To manually run the certificate creation, we’ll need to activate the Auto Certificate Rollover parameter with the command below:

Set-ADFSProperties -AutoCertificateRollover $true

To identify the active TS certificate on the AD FS server, let’s run the command below:

Get-ADFSCertificate –CertificateType token-signing

To generate a new secondary TS certificate on the AD FS server, let’s run the command below:

Update-ADFSCertificate –CertificateType token-signing

We can observe the new certificate identified as secondary in the AD FS console:

If you need to generate a new certificate and immediately replace the primary one, you can use the -urgent attribute as shown below:

Update-ADFSCertificate –CertificateType token-signing -urgent

Note: When using the -urgent parameter, the RPs need to be updated immediately. As shown below, we can see that only the new certificate appears as primary.

With the command below we can see that the new certificate is configured in AD FS.

Get-ADFSCertificate –CertificateType token-signing

Let’s now run the command below to identify the TD certificate in AD FS.

Get-ADFSCertificate –CertificateType token-decrypting

Let’s run the command below to generate a new TD certificate in AD FS.

Update-ADFSCertificate –CertificateType token-decrypting

We can see that the new certificate was generated and is identified in the AD FS console as secondary.

Just as with the TS certificate change, let’s run the command below to replace the current certificate immediately in AD FS.

Update-ADFSCertificate –CertificateType token-decrypting -urgent

We can see below that the new certificate is now configured as primary and in use in the AD FS console.

Updating the new TS certificate in Azure

To ensure access to applications hosted in Azure, it is necessary to update the certificates generated by AD FS in Microsoft Entra ID. Let’s start this update by running the commands below in case you don’t have the MSOnline module installed

Install-Module MSOnline

Import-Module MSOnline

Run the command below to connect to the MSOnline service.

Connect-MsolService

Sign in with a credential that has global administrator permission in Azure.

By running the command below, we can see that the certificate generated by AD FS does not match the certificate configured in Office 365.

Get-MsolFederationProperty -DomainName <domain> | FL Source, TokenSigningCertificate

Let’s now run the command below to update the certificate generated by AD FS in Azure.

Update-MSOLFederatedDomain –DomainName <domain> -SupportMultipleDomain

Let’s run the command below to validate the certificate update in Office 365.

Get-MsolFederationProperty -DomainName <domain> | FL Source, TokenSigningCertificate

With the command below, we can observe the TS certificates configured in Office 365.

Get-MsolDomainFederationSettings -domain <domain>

Summary

In today’s article, we talked about the ways to update the token-signing and token-decrypting certificates used by AD FS.

I hope this content has contributed to enriching your knowledge of AD FS.

Did you like the post? Like and share it. 🙂

If you have any suggestions or comments, let us know.

[ ]’s

Ulysses Neves

Related guides: Browse the Microsoft Identity Troubleshooting Index or the Microsoft AD FS topic archive.