+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+The following is an example of a request.

+The following is an example of the response.

+ },

+ "managedBy": "windows365"

+The following is an example of a request.

+The following is an example of the response.

+ ],

+ "managedBy": "windows365"

+}

+```

+### Example 3: Get the selected properties of the specified provisioning policy

+The following example shows a request that retrieves the selected properties of the specified provisioning policy.

+#### Request

+The following is an example of a request.

+# [HTTP](#tab/http)

+<!-- {

+ "blockType": "request",

+ "name": "get_cloudpcprovisioningpolicy_3"

+}

+-->

+``` http

+GET https://graph.microsoft.com/beta/deviceManagement/virtualEndpoint/provisioningPolicies/60b94f83-3e22-430e-a69d-440f65b922d6?$select=id,description,displayName,displayName,domainJoinConfiguration,imageDisplayName,imageId,imageType,onPremisesConnectionId,windowsSettings,managedBy,cloudPcGroupDisplayName,gracePeriodInHours,localAdminEnabled,alternateResourceUrl

+```

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+#### Response

+The following is an example of the response.

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.cloudPcProvisioningPolicy"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.type": "#microsoft.graph.cloudPcProvisioningPolicy",

+ "alternateResourceUrl": "https://ms.portal.azure.com/#contoso.com/resource/subscriptions/827f2432-9c7b-4637-b694-570b3c2f969c/resourceGroups/myResourceGroupName/providers/Microsoft.Fidalgo/projects/myProjectName/pools/myPoolName",

+ "cloudPcGroupDisplayName": "MyCloudPcGroup",

+ "description": "The ProvisioningPolicy for West US employees.",

+ "displayName": "WestUsPolicy",

+ "domainJoinConfiguration": {

+ "onPremisesConnectionId": "4e47d0f6-6f77-44f0-8893-c0fe1701ffff",

+ "regionName": null,

+ "type": "hybridAzureADJoin"

+ },

+ "gracePeriodInHours": 2,

+ "id": "1d164206-bf41-4fd2-8424-a3192d39ffff",

+ "imageDisplayName": "myCustomImage",

+ "imageId": "d4e0541a-f7bb-4bdf-ad8f-b92b915a229f",

+ "imageType": "custom",

+ "localAdminEnabled": true,

+ "managedBy": "windows365",

+ "onPremisesConnectionId": "4e47d0f6-6f77-44f0-8893-c0fe1701ffff",

+ "windowsSettings": {

+ "language": "en-US"

+ }

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+> [!NOTE]

+> The values in the Meetings Organized Count might not be the sum of the Ad Hoc Meetings Organized Count, Scheduled One-time Meetings Organized Count, and Scheduled Recurring Meetings Organized Count that a user organized during the specified time period. This is because the Unclassified meetings value is not inlcuded in the output CSV file. For details, see [Microsoft Teams user activity report](https://docs.microsoft.com/en-us/microsoftteams/teams-analytics-and-reports/user-activity-report).

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+```

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+```

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+ },

+ "managedBy": "windows365"

+ },

+ "managedBy": "windows365"

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+|traceRouteHops|[microsoft.graph.callRecords.traceRouteHop](callrecords-traceroutehop.md) collection|List of network trace route hops collected for this media stream.\*|

+> [!NOTE]

+> \*By default, **traceRouteHops** will always return an empty array. Contact Microsoft support to enable reporting of trace route data for your organization.

+|adDomainUsername|String|The username of an Active Directory account (user or service account) that has permissions to create computer objects in Active Directory. Required format: `admin@contoso.com`. Optional.|

+|alternateResourceUrl|String|The interface URL of the partner service's resource that links to this Azure network connection. Returned only on `$select`.|

+|displayName|String|The display name for the Azure network connection.|

+|healthCheckStatus|[cloudPcOnPremisesConnectionStatus](#cloudpconpremisesconnectionstatus-values)|The status of the most recent health check done on the Azure network connection. For example, if status is `passed`, the Azure network connection has passed all checks run by the service. Possible values are: `pending`, `running`, `passed`, `failed`, `unknownFutureValue`. Read-only.|

+|healthCheckStatusDetails|[cloudPcOnPremisesConnectionStatusDetails](../resources/cloudpconpremisesconnectionstatusdetails.md)|The details of the connection's health checks and the corresponding results. Returned only on `$select`. For an example that shows how to get the **inUse** property, see [Example 2: Get the selected properties of an Azure network connection, including healthCheckStatusDetails](../api/cloudpconpremisesconnection-get.md). Read-only.|

+|id|String|Unique identifier for the Azure network connection. Read-only.|

+|managedBy|[cloudPcManagementService](#cloudpcmanagementservice-values)|Specifies which services manage the Azure network connection. Possible values are: `windows365`, `devBox,` `unknownFutureValue`. Read-only.|

+|organizationalUnit|String|The organizational unit (OU) in which the computer account is created. If left null, the OU thatΓÇÖs configured as the default (a well-known computer object container) in your Active Directory domain (OU) is used. Optional.|

+|resourceGroupId|String|The ID of the target resource group. Required format: `/subscriptions/{subscription-id}/resourceGroups/{resourceGroupName}`.|

+|subnetId|String|The ID of the target subnet. Required format: `/subscriptions/{subscription-id}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkId}/subnets/{subnetName}`.|

+|subscriptionId|String|The ID of the target Azure subscription thatΓÇÖs associated with your tenant.|

+|subscriptionName|String|The name of the target Azure subscription. Read-only.|

+|type|[cloudPcOnPremisesConnectionType](#cloudpconpremisesconnectiontype-values)|Specifies how the provisioned Cloud PC will be joined to Azure Active Directory. Default value is `hybridAzureADJoin`. Possible values are: `azureADJoin`, `hybridAzureADJoin`, `unknownFutureValue`.|

+|virtualNetworkId|String|The ID of the target virtual network. Required format: `/subscriptions/{subscription-id}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{virtualNetworkName}`.|

+|unknownFutureValue|Evolvable enumeration sentinel value. Do not use.|

+ "adDomainUsername": "String",

+ "alternateResourceUrl": "String",

+ "displayName": "String",

+ "healthCheckStatus": "String",

+ {

+ "additionalDetails": "String",

+ "startDateTime": "String (timestamp)",

+ "status": "String"

+ ],

+ "startDateTime": "String (timestamp)"

+ "id": "String (identifier)",

+ "inUse": "Boolean",

+ "managedBy": "String",

+ "organizationalUnit": "String",

+ "resourceGroupId": "String",

+ "subnetId": "String",

+ "subscriptionId": "String",

+ "subscriptionName": "String",

+ "type": "String",

+ "virtualNetworkId": "String"

+|alternateResourceUrl|String|The URL of the alternate resource that links to this provisioning policy. Read-only.|

+|cloudPcGroupDisplayName|String|The display name of the Cloud PC group that the Cloud PCs reside in. Read-only.|

+|gracePeriodInHours|Int32|The number of hours to wait before reprovisioning/deprovisioning happens. Read-only.|

+|localAdminEnabled|Boolean|Indicates whether the local admin option is enabled. If the local admin option is enabled, the end user can be an admin of the Cloud PC device. Read-only.|

+|managedBy|[cloudPcManagementService](../resources/cloudpconpremisesconnection.md#cloudpcmanagementservice-values)|Specifies which services manage the Azure network connection. Possible values are: `windows365`, `devBox`, `unknownFutureValue`. Read-only.|

+ "alternateResourceUrl": "String",

+ "cloudPcGroupDisplayName": "String",

+ "gracePeriodInHours": "Integer",

+ "localAdminEnabled": "Boolean",

+ "managedBy": "String",

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [HTTP](#tab/http)

+# [C#](#tab/csharp)

+# [JavaScript](#tab/javascript)

+# [Java](#tab/java)

+# [Go](#tab/go)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+ Title: "Create federationConfiguration"

+description: "Create a new internalDomainFederation object."

+ms.localizationpriority: medium

+# Create federationConfiguration

+Namespace: microsoft.graph

+Create a new [internalDomainFederation](../resources/internaldomainfederation.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Domain.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported|

+|Application|Domain.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+POST /domains/{domainsId}/federationConfiguration

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+In the request body, supply a JSON representation of the [internalDomainFederation](../resources/internaldomainfederation.md) object.

+You can specify the following properties when creating an **internalDomainFederation**.

+|Property|Type|Description|

+|:|:|:|

+|displayName|String|The display name of the federated identity provider.|

+|issuerUri|String|Issuer URI of the federation server.|

+|metadataExchangeUri|String|URI of the metadata exchange endpoint used for authentication from rich client applications.|

+|signingCertificate|String|Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. <br>This property is used in the following scenarios: <li> If a rollover is required outside of the autorollover update <li> A new federation service is being set up <li> If the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.<br>Azure AD updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Azure AD monitors the metadata daily and will update the federation settings for the domain when a new certificate is available.|

+|passiveSignInUri|String|URI that web-based clients are directed to when signing in to Azure AD services.|

+|preferredAuthenticationProtocol|authenticationProtocol|Preferred authentication protocol. The possible values are: `wsFed`, `saml`, `unknownFutureValue`.|

+|activeSignInUri|String|URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Azure Active Directory (Azure AD). Corresponds to the **ActiveLogOnUri** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).|

+|signOutUri|String|URI that clients are redirected to when they sign out of Azure AD services. Corresponds to the **LogOffUri** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).|

+|promptLoginBehavior|promptLoginBehavior|Sets the preferred behavior for the sign-in prompt. The possible values are: `translateToFreshPasswordAuthentication`, `nativeSupport`, `disabled`, `unknownFutureValue`.|

+|isSignedAuthenticationRequestRequired|Boolean|If true, when SAML authentication requests are sent to the federated SAML IDP, Azure AD will sign those requests using the OrgID signing key. If false (default), the SAML authentication requests sent to the federated IDP are not signed.|

+|nextSigningCertificate|String|Fallback token signing certificate that is used to sign tokens when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the **signingCertificate**, the **nextSigningCertificate** property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate is not present in the federation properties after the federation service certificate has been updated.|

+|signingCertificateUpdateStatus|[signingCertificateUpdateStatus](../resources/signingcertificateupdatestatus.md)|Provides status and timestamp of the last update of the signing certificate.|

+|federatedIdpMfaBehavior|federatedIdpMfaBehavior|Determines whether Azure AD accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: `acceptIfMfaDoneByFederatedIdp`, `enforceMfaByFederatedIdp`, `rejectMfaByFederatedIdp`, `unknownFutureValue`. For more information, see [federatedIdpMfaBehavior values](#federatedidpmfabehavior-values).|

+### federatedIdpMfaBehavior values

+| Member | Description |

+| : | : |

+| acceptIfMfaDoneByFederatedIdp | Azure AD accepts MFA that's performed by the federated identity provider. If the federated identity provider didn't perform MFA, Azure AD performs the MFA. |

+| enforceMfaByFederatedIdp | Azure AD accepts MFA that's performed by federated identity provider. If the federated identity provider didn't perform MFA, it redirects the request to federated identity provider to perform MFA. |

+| rejectMfaByFederatedIdp | Azure AD always performs MFA and rejects MFA that's performed by the federated identity provider. |

+>[!NOTE]

+>**federatedIdpMfaBehavior** is an evolved version of the **SupportsMfa** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).

+>+ Switching between **federatedIdpMfaBehavior** and **SupportsMfa** is not supported.

+>+ When **federatedIdpMfaBehavior** property is set, Azure AD ignores the **SupportsMfa** setting.

+>+ If the **federatedIdpMfaBehavior** property is never set, Azure AD will continue to honor the **SupportsMfa** setting.

+>+ If neither **federatedIdpMfaBehavior** nor **SupportsMfa** is set, Azure AD will default to `acceptIfMfaDoneByFederatedIdp` behavior.

+## Response

+If successful, this method returns a `201 Created` response code and an [internalDomainFederation](../resources/internaldomainfederation.md) object in the response body.

+## Examples

+### Request

+<!-- {

+ "blockType": "request",

+ "name": "create_internaldomainfederation_from_"

+}

+-->

+``` http

+POST https://graph.microsoft.com/v1.0/domains/contoso.com/federationConfiguration

+Content-Type: application/json

+{

+ "@odata.type": "#microsoft.graph.internalDomainFederation",

+ "displayName": "Contoso",

+ "issuerUri": "http://contoso.com/adfs/services/trust",

+ "metadataExchangeUri": "https://sts.contoso.com/adfs/services/trust/mex",

+ "signingCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "passiveSignInUri": "https://sts.contoso.com/adfs/ls",

+ "preferredAuthenticationProtocol": "wsFed",

+ "activeSignInUri": "https://sts.contoso.com/adfs/services/trust/2005/usernamemixed",

+ "signOutUri": "https://sts.contoso.com/adfs/ls",

+ "promptLoginBehavior": "nativeSupport",

+ "isSignedAuthenticationRequestRequired": true,

+ "nextSigningCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "federatedIdpMfaBehavior": "rejectMfaByFederatedIdp"

+}

+```

+### Response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.internalDomainFederation"

+}

+-->

+``` http

+HTTP/1.1 201 Created

+Content-Type: application/json

+{

+ "@odata.type": "#microsoft.graph.internalDomainFederation",

+ "id": "6601d14b-d113-8f64-fda2-9b5ddda18ecc",

+ "displayName": "Contoso",

+ "issuerUri": "http://contoso.com/adfs/services/trust",

+ "metadataExchangeUri": "https://sts.contoso.com/adfs/services/trust/mex",

+ "signingCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "passiveSignInUri": "https://sts.contoso.com/adfs/ls",

+ "preferredAuthenticationProtocol": "wsFed",

+ "activeSignInUri": "https://sts.contoso.com/adfs/services/trust/2005/usernamemixed",

+ "signOutUri": "https://sts.contoso.com/adfs/ls",

+ "promptLoginBehavior": "nativeSupport",

+ "isSignedAuthenticationRequestRequired": true,

+ "nextSigningCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "signingCertificateUpdateStatus": {

+ "certificateUpdateResult": "Success",

+ "lastRunDateTime": "2021-08-25T07:44:46.2616778Z"

+ },

+ "federatedIdpMfaBehavior": "rejectMfaByFederatedIdp"

+}

+```

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+ Title: "Delete internalDomainFederation"

+description: "Delete an internalDomainFederation object."

+ms.localizationpriority: medium

+# Delete internalDomainFederation

+Namespace: microsoft.graph

+Delete an [internalDomainFederation](../resources/internaldomainfederation.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Domain.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported|

+|Application|Domain.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+DELETE /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `204 No Content` response code.

+## Examples

+### Request

+<!-- {

+ "blockType": "request",

+ "name": "delete_internaldomainfederation"

+}

+-->

+``` http

+DELETE https://graph.microsoft.com/v1.0/domains/contoso.com/federationConfiguration/96db02e2-80c1-5555-bc3a-de92ffb8c5be

+```

+### Response

+<!-- {

+ "blockType": "response",

+ "truncated": true

+}

+-->

+``` http

+HTTP/1.1 204 No Content

+```

+ Title: "Get internalDomainFederation"

+description: "Read the properties and relationships of an internalDomainFederation object."

+ms.localizationpriority: medium

+# Get internalDomainFederation

+Namespace: microsoft.graph

+Read the properties and relationships of an [internalDomainFederation](../resources/internaldomainfederation.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Domain.Read.All, Domain.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported|

+|Application|Domain.Read.All, Domain.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+GET /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}

+```

+## Optional query parameters

+This method does not support OData query parameters to help customize the response. For general information, see [OData query parameters](/graph/query-parameters).

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+## Request body

+Do not supply a request body for this method.

+## Response

+If successful, this method returns a `200 OK` response code and an [internalDomainFederation](../resources/internaldomainfederation.md) object in the response body.

+## Examples

+### Request

+<!-- {

+ "blockType": "request",

+ "name": "get_internaldomainfederation"

+}

+-->

+``` http

+GET https://graph.microsoft.com/v1.0/domains/contoso.com/federationConfiguration/6601d14b-d113-8f64-fda2-9b5ddda18ecc

+```

+### Response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.internalDomainFederation"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "value": {

+ "@odata.type": "#microsoft.graph.internalDomainFederation",

+ "id": "6601d14b-d113-8f64-fda2-9b5ddda18ecc",

+ "displayName": "Contoso",

+ "issuerUri": "http://contoso.com/adfs/services/trust",

+ "metadataExchangeUri": "https://sts.contoso.com/adfs/services/trust/mex",

+ "signingCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "passiveSignInUri": "https://sts.contoso.com/adfs/ls",

+ "preferredAuthenticationProtocol": "wsFed",

+ "activeSignInUri": "https://sts.contoso.com/adfs/services/trust/2005/usernamemixed",

+ "signOutUri": "https://sts.contoso.com/adfs/ls",

+ "promptLoginBehavior": "nativeSupport",

+ "isSignedAuthenticationRequestRequired": true,

+ "nextSigningCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "signingCertificateUpdateStatus": {

+ "certificateUpdateResult": "Success",

+ "lastRunDateTime": "2021-08-25T07:44:46.2616778Z"

+ },

+ "federatedIdpMfaBehavior": "rejectMfaByFederatedIdp"

+ }

+}

+```

+ Title: "Update internalDomainFederation"

+description: "Update the properties of an internalDomainFederation object."

+ms.localizationpriority: medium

+# Update internalDomainFederation

+Namespace: microsoft.graph

+Update the properties of an [internalDomainFederation](../resources/internaldomainfederation.md) object.

+## Permissions

+One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Permissions](/graph/permissions-reference).

+|Permission type|Permissions (from least to most privileged)|

+|:|:|

+|Delegated (work or school account)|Domain.ReadWrite.All|

+|Delegated (personal Microsoft account)|Not supported|

+|Application|Domain.ReadWrite.All|

+## HTTP request

+<!-- {

+ "blockType": "ignored"

+}

+-->

+``` http

+PATCH /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}

+```

+## Request headers

+|Name|Description|

+|:|:|

+|Authorization|Bearer {token}. Required.|

+|Content-Type|application/json. Required.|

+## Request body

+|Property|Type|Description|

+|:|:|:|

+|activeSignInUri|String|URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Azure Active Directory (Azure AD). Corresponds to the **ActiveLogOnUri** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).|

+|displayName|String|The display name of the federated identity Provider (IdP). |

+|federatedIdpMfaBehavior|federatedIdpMfaBehavior|Determines whether Azure AD accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: `acceptIfMfaDoneByFederatedIdp`, `enforceMfaByFederatedIdp`, `rejectMfaByFederatedIdp`, `unknownFutureValue`. For more information, see [federatedIdpMfaBehavior values](#federatedidpmfabehavior-values).|

+|isSignedAuthenticationRequestRequired|Boolean|If `true`, when SAML authentication requests are sent to the federated SAML IdP, Azure AD will sign those requests using the OrgID signing key. If `false` (default), the SAML authentication requests sent to the federated IdP are not signed.|

+|issuerUri|String|Issuer URI of the federation server.|

+|metadataExchangeUri|String|URI of the metadata exchange endpoint used for authentication from rich client applications.|

+|nextSigningCertificate|String|Fallback token signing certificate that is used to sign tokens when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the **signingCertificate**, the **nextSigningCertificate** property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate is not present in the federation properties after the federation service certificate has been updated.|

+|passiveSignInUri|String|URI that web-based clients are directed to when signing into Azure AD services. |

+|preferredAuthenticationProtocol|authenticationProtocol|Preferred authentication protocol. The possible values are: `wsFed`, `saml`, `unknownFutureValue`. |

+|promptLoginBehavior|promptLoginBehavior|Sets the preferred behavior for the sign-in prompt. The possible values are: `translateToFreshPasswordAuthentication`, `nativeSupport`, `disabled`, `unknownFutureValue`.|

+|signingCertificate|String|Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. <br>This property is used in the following scenarios: <li> If a rollover is required outside of the autorollover update <li> A new federation service is being set up <li> If the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.<br>Azure AD updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Azure AD monitors the metadata daily and will update the federation settings for the domain when a new certificate is available. Inherited from [samlOrWsFedProvider](../resources/samlorwsfedprovider.md).|

+|signingCertificateUpdateStatus|[signingCertificateUpdateStatus](../resources/signingcertificateupdatestatus.md)|Provides status and timestamp of the last update of the signing certificate.|

+|signOutUri|String|URI that clients are redirected to when they sign out of Azure AD services. Corresponds to the **LogOffUri** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).|

+### federatedIdpMfaBehavior values

+| Member | Description |

+| : | : |

+| acceptIfMfaDoneByFederatedIdp | Azure AD accepts MFA that's performed by the federated identity provider. If the federated identity provider didn't perform MFA, Azure AD performs the MFA. |

+| enforceMfaByFederatedIdp | Azure AD accepts MFA that's performed by federated identity provider. If the federated identity provider didn't perform MFA, it redirects the request to federated identity provider to perform MFA. |

+| rejectMfaByFederatedIdp | Azure AD always performs MFA and rejects MFA that's performed by the federated identity provider. |

+>[!NOTE]

+>**federatedIdpMfaBehavior** is an evolved version of the **SupportsMfa** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).

+>+ Switching between **federatedIdpMfaBehavior** and **SupportsMfa** is not supported.

+>+ When **federatedIdpMfaBehavior** property is set, Azure AD ignores the **SupportsMfa** setting.

+>+ If the **federatedIdpMfaBehavior** property is never set, Azure AD will continue to honor the **SupportsMfa** setting.

+>+ If neither **federatedIdpMfaBehavior** nor **SupportsMfa** is set, Azure AD will default to `acceptIfMfaDoneByFederatedIdp` behavior.

+## Response

+If successful, this method returns a `200 OK` response code and an updated [internalDomainFederation](../resources/internaldomainfederation.md) object in the response body.

+## Examples

+### Request

+<!-- {

+ "blockType": "request",

+ "name": "update_internaldomainfederation"

+}

+-->

+``` http

+PATCH https://graph.microsoft.com/v1.0/domains/contoso.com/federationConfiguration/6601d14b-d113-8f64-fda2-9b5ddda18ecc

+Content-Type: application/json

+{

+ "displayName": "Contoso name change",

+ "federatedIdpMfaBehavior": "acceptIfMfaDoneByFederatedIdp"

+}

+```

+### Response

+>**Note:** The response object shown here might be shortened for readability.

+<!-- {

+ "blockType": "response",

+ "truncated": true,

+ "@odata.type": "microsoft.graph.internalDomainFederation"

+}

+-->

+``` http

+HTTP/1.1 200 OK

+Content-Type: application/json

+{

+ "@odata.type": "#microsoft.graph.internalDomainFederation",

+ "id": "6601d14b-d113-8f64-fda2-9b5ddda18ecc",

+ "displayName": "Contoso name change",

+ "issuerUri": "http://contoso.com/adfs/services/trust",

+ "metadataExchangeUri": "https://sts.contoso.com/adfs/services/trust/mex",

+ "signingCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "passiveSignInUri": "https://sts.contoso.com/adfs/ls",

+ "preferredAuthenticationProtocol": "wsFed",

+ "activeSignInUri": "https://sts.contoso.com/adfs/services/trust/2005/usernamemixed",

+ "signOutUri": "https://sts.contoso.com/adfs/ls",

+ "promptLoginBehavior": "nativeSupport",

+ "isSignedAuthenticationRequestRequired": true,

+ "nextSigningCertificate": "MIIE3jCCAsagAwIBAgIQQcyDaZz3MI",

+ "signingCertificateUpdateStatus": {

+ "certificateUpdateResult": "Success",

+ "lastRunDateTime": "2021-08-25T07:44:46.2616778Z"

+ },

+ "federatedIdpMfaBehavior": "acceptIfMfaDoneByFederatedIdp"

+}

+```

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+### Request

+### Response

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+>**Note**: For delegated permissions to allow apps to read service usage reports on behalf of a user, the tenant administrator must have assigned the user the appropriate Azure AD limited administrator role. For more details, see [Authorization for APIs to read Microsoft 365 usage reports](/graph/reportroot-authorization).

+> [!NOTE]

+> The values in the Meetings Organized Count might not be the sum of the Ad Hoc Meetings Organized Count, Scheduled One-time Meetings Organized Count, and Scheduled Recurring Meetings Organized Count that a user organized during the specified time period. This is because the Unclassified meetings value is not inlcuded in the output CSV file. For details, see [Microsoft Teams user activity report](https://docs.microsoft.com/en-us/microsoftteams/teams-analytics-and-reports/user-activity-report).

+### Request

+### Response

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+# [PowerShell](#tab/powershell)

+|traceRouteHops|[microsoft.graph.callRecords.traceRouteHop](callrecords-traceroutehop.md) collection|List of network trace route hops collected for this media stream.\*|

+> [!NOTE]

+> \*By default, **traceRouteHops** will always return an empty array. Contact Microsoft support to enable reporting of trace route data for your organization.

+|federationConfiguration|[internalDomainFederation](internaldomainfederation.md)| Domain settings configured by a customer when federated with Azure AD. Supports `$expand`.|

+### federatedIdpMfaBehavior values

+|Member|

+|:|

+|acceptIfMfaDoneByFederatedIdp|

+|enforceMfaByFederatedIdp|

+|rejectMfaByFederatedIdp|

+|unknownFutureValue|

+#### promptLoginBehavior values

+|Member|

+|:|

+|translateToFreshPasswordAuthentication|

+|nativeSupport|

+|disabled|

+|unknownFutureValue|

+ Title: "internalDomainFederation resource type"

+description: "Represents configurations of the domains in a tenant that are federated with Azure AD."

+ms.localizationpriority: medium

+# internalDomainFederation resource type

+Namespace: microsoft.graph

+Represents configurations of tenant domains that are federated with Azure AD. Use this resource to configure federation settings when setting up federation with Azure AD. For information on federation, see [What is federation with Azure AD?](/azure/active-directory/hybrid/whatis-fed).

+Inherits from [samlOrWsFedProvider](../resources/samlorwsfedprovider.md).

+## Methods

+|Method|Return type|Description|

+|:|:|:|

+|[Create federationConfiguration](../api/domain-post-federationconfiguration.md)|[internalDomainFederation](../resources/internaldomainfederation.md)|Create a new [internalDomainFederation](../resources/internaldomainfederation.md) object.|

+|[Get internalDomainFederation](../api/internaldomainfederation-get.md)|[internalDomainFederation](../resources/internaldomainfederation.md)|Read the properties and relationships of an [internalDomainFederation](../resources/internaldomainfederation.md) object.|

+|[Update internalDomainFederation](../api/internaldomainfederation-update.md)|[internalDomainFederation](../resources/internaldomainfederation.md)|Update the properties of an [internalDomainFederation](../resources/internaldomainfederation.md) object.|

+|[Delete internalDomainFederation](../api/internaldomainfederation-delete.md)|None|Delete an [internalDomainFederation](../resources/internaldomainfederation.md) object.|

+## Properties

+|Property|Type|Description|

+|:|:|:|

+|activeSignInUri|String|URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Azure Active Directory (Azure AD). Corresponds to the **ActiveLogOnUri** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).|

+|displayName|String|The display name of the federated identity Provider (IdP). Inherited from [identityProviderBase](../resources/identityproviderbase.md).|

+|federatedIdpMfaBehavior|federatedIdpMfaBehavior|Determines whether Azure AD accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: `acceptIfMfaDoneByFederatedIdp`, `enforceMfaByFederatedIdp`, `rejectMfaByFederatedIdp`, `unknownFutureValue`. For more information, see [federatedIdpMfaBehavior values](#federatedidpmfabehavior-values).|

+|id|String|The identifier of the federated identity provider. Inherited from [entity](../resources/entity.md).|

+|isSignedAuthenticationRequestRequired|Boolean|If `true`, when SAML authentication requests are sent to the federated SAML IdP, Azure AD will sign those requests using the OrgID signing key. If `false` (default), the SAML authentication requests sent to the federated IdP are not signed.|

+|issuerUri|String|Issuer URI of the federation server. Inherited from [samlOrWsFedProvider](../resources/samlorwsfedprovider.md).|

+|metadataExchangeUri|String|URI of the metadata exchange endpoint used for authentication from rich client applications. Inherited from [samlOrWsFedProvider](../resources/samlorwsfedprovider.md).|

+|nextSigningCertificate|String|Fallback token signing certificate that is used to sign tokens when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the signingCertificate, the nextSigningCertificate property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate is not present in the federation properties after the federation service certificate has been updated.|

+|passiveSignInUri|String|URI that web-based clients are directed to when signing into Azure AD services. Inherited from [samlOrWsFedProvider](../resources/samlorwsfedprovider.md).|

+|preferredAuthenticationProtocol|authenticationProtocol|Preferred authentication protocol. The possible values are: `wsFed`, `saml`, `unknownFutureValue`. Inherited from [samlOrWsFedProvider](../resources/samlorwsfedprovider.md).|

+|promptLoginBehavior|promptLoginBehavior|Sets the preferred behavior for the sign-in prompt. The possible values are: `translateToFreshPasswordAuthentication`, `nativeSupport`, `disabled`, `unknownFutureValue`.|

+|signingCertificate|String|Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. <br>This property is used in the following scenarios: <li> If a rollover is required outside of the autorollover update <li> A new federation service is being set up <li> If the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.<br>Azure AD updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Azure AD monitors the metadata daily and will update the federation settings for the domain when a new certificate is available. Inherited from [samlOrWsFedProvider](../resources/samlorwsfedprovider.md).|

+|signingCertificateUpdateStatus|[signingCertificateUpdateStatus](../resources/signingcertificateupdatestatus.md)|Provides status and timestamp of the last update of the signing certificate.|

+|signOutUri|String|URI that clients are redirected to when they sign out of Azure AD services. Corresponds to the **LogOffUri** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).|

+### federatedIdpMfaBehavior values

+| Member | Description |

+| : | : |

+| acceptIfMfaDoneByFederatedIdp | Azure AD accepts MFA that's performed by the federated identity provider. If the federated identity provider didn't perform MFA, Azure AD performs the MFA. |

+| enforceMfaByFederatedIdp | Azure AD accepts MFA that's performed by federated identity provider. If the federated identity provider didn't perform MFA, it redirects the request to federated identity provider to perform MFA. |

+| rejectMfaByFederatedIdp | Azure AD always performs MFA and rejects MFA that's performed by the federated identity provider. |

+>[!NOTE]

+>**federatedIdpMfaBehavior** is an evolved version of the **SupportsMfa** property of the [Set-MsolDomainFederationSettings MSOnline v1 PowerShell cmdlet](/powershell/module/msonline/set-msoldomainfederationsettings).

+>+ Switching between **federatedIdpMfaBehavior** and **SupportsMfa** is not supported.

+>+ When **federatedIdpMfaBehavior** property is set, Azure AD ignores the **SupportsMfa** setting.

+>+ If the **federatedIdpMfaBehavior** property is never set, Azure AD will continue to honor the **SupportsMfa** setting.

+>+ If neither **federatedIdpMfaBehavior** nor **SupportsMfa** is set, Azure AD will default to `acceptIfMfaDoneByFederatedIdp` behavior.

+## Relationships

+None.

+## JSON representation

+The following is a JSON representation of the resource.

+<!-- {

+ "blockType": "resource",

+ "keyProperty": "id",

+ "@odata.type": "microsoft.graph.internalDomainFederation",

+ "baseType": "microsoft.graph.samlOrWsFedProvider",

+ "openType": false

+}

+-->

+``` json

+{

+ "@odata.type": "#microsoft.graph.internalDomainFederation",

+ "id": "String (identifier)",

+ "displayName": "String",

+ "issuerUri": "String",

+ "metadataExchangeUri": "String",

+ "signingCertificate": "String",

+ "passiveSignInUri": "String",

+ "preferredAuthenticationProtocol": "String",

+ "activeSignInUri": "String",

+ "signOutUri": "String",

+ "promptLoginBehavior": "String",

+ "isSignedAuthenticationRequestRequired": "Boolean",

+ "nextSigningCertificate": "String",

+ "signingCertificateUpdateStatus": {

+ "certificateUpdateResult": "String",

+ "@odata.type": "microsoft.graph.signingCertificateUpdateStatus"

+ },

+ "federatedIdpMfaBehavior": "String"

+}

+```

+ Title: "signingCertificateUpdateStatus resource type"

+description: "Provides status of the last update of the signing certificate."

+ms.localizationpriority: medium

+# signingCertificateUpdateStatus resource type

+Namespace: microsoft.graph

+Provides status and timestamp of the last update of the signing certificate.

+## Properties

+|Property|Type|Description|

+|:|:|:|

+|certificateUpdateResult|String|Status of the last certificate update. Read-only. For a list of statuses, see [certificateUpdateResult status](#certificateupdateresult-status).|

+|lastRunDateTime|DateTimeOffset|Date and time in ISO 8601 format and in UTC time when the certificate was last updated. Read-only. |

+### certificateUpdateResult status

+| Value | Description |

+| : | : |

+|success|The attempt was successful.|

+|unknownError|Do not know the reason for failure.|

+|internalServerError|Something went wrong on our side.|

+|noValidExistingCertFound|No valid existing signing certificate was found.|

+|noStsAuthUrlFound|No STS Auth Url was found.|

+|noFederationProtocolFound|No federation protocol was found.|

+|noNewCertificateFound|No new certificate was found.|

+|couldNotAccessRemoteHost|Could not reach the provider to get the new certificates.|

+|connectionError|There was a connection error|

+|xmlParsingError|Failed to parse the XML|

+|badRequest|Received BadRequest error from the fed metadata request.|

+|unauthorized|Received Unauthorized error from the fed metadata request.|

+|forbidden|Received Forbidden error from the fed metadata request.|

+|notFound|Received NotFound error from the fed metadata request.|

+|providerError|Received InternalServerError from the provider.|

+## Relationships

+None.

+## JSON representation

+The following is a JSON representation of the resource.

+<!-- {

+ "blockType": "resource",

+ "@odata.type": "microsoft.graph.signingCertificateUpdateStatus"

+}

+-->

+``` json

+{

+ "@odata.type": "#microsoft.graph.signingCertificateUpdateStatus",

+ "certificateUpdateResult": "String",

+ "lastRunDateTime": "String (timestamp)"

+}

+```

+ - name: Federation with Azure AD

+ items:

+ - name: Federated domain configuration

+ href: resources/internaldomainfederation.md

+ - name: Get

+ href: api/internaldomainfederation-get.md

+ - name: Create

+ href: api/domain-post-federationconfiguration.md

+ - name: Update

+ href: api/internaldomainfederation-update.md

+ - name: Delete

+ href: api/internaldomainfederation-delete.md