Is it possible to update SAML token signing certificate via PowerShell in Azure AD?

%3CLINGO-SUB%20id%3D%22lingo-sub-1384139%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1384139%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F642916%22%20target%3D%22_blank%22%3E%40Gerald_Glen%3C%2FA%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F176487%22%20target%3D%22_blank%22%3E%40David%20Gregory%3C%2FA%3E%26nbsp%3Bmight%20know%20if%20this%20is%20coming%2C%20but%20until%20then%20you%20can%20add%20your%20vote%20to%20this%20User%20Voice%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ffeedback.azure.com%2Fforums%2F169401-azure-active-directory%2Fsuggestions%2F37970713-powershell-saml-app-automation%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Ffeedback.azure.com%2Fforums%2F169401-azure-active-directory%2Fsuggestions%2F37970713-powershell-saml-app-automation%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1387164%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1387164%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F642916%22%20target%3D%22_blank%22%3E%40Gerald_Glen%3C%2FA%3E%26nbsp%3Bthis%20is%20something%20we're%20actively%20working%20on%20now.%20We%20hope%20to%20have%20good%20news%20for%20you%20by%20the%20end%20of%20June.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1393122%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1393122%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F5941%22%20target%3D%22_blank%22%3E%40Joe%20Stocker%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1393129%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1393129%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F156946%22%20target%3D%22_blank%22%3E%40Luis%20Leon%20Plata%3C%2FA%3E%26nbsp%3B%2C%20looking%20forward%20to%20hear%20it%20soon...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1393131%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1393131%22%20slang%3D%22en-US%22%3EThanks%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F156946%22%20target%3D%22_blank%22%3E%40Luis%20Leon%20Plata%3C%2FA%3E%20%2C%20looking%20forward%20to%20hear%20it%20soon...%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1393385%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1393385%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F642916%22%20target%3D%22_blank%22%3E%40Gerald_Glen%3C%2FA%3E%3C%2FP%3E%3CP%3EA%20dumb%20question%20but%20is%20this%20in%20a%20BYOK%20scenario%20for%20in%20the%20tenant%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1443796%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1443796%22%20slang%3D%22en-US%22%3E%3CP%3EHey%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F642916%22%20target%3D%22_blank%22%3E%40Gerald_Glen%3C%2FA%3E%26nbsp%3B-%20We%20have%20you%20can%20manage%20your%20key%20credentials%20now%20using%20APIs.%20I%20think%20it%20also%20works%20for%20PowerShell%20but%20I%20haven't%20tried%20personally.%20Here%20is%20a%20doc%20on%20how%20to%20use%20the%20APIs%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Faka.ms%2Faadgallery-sso-api%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Faka.ms%2Faadgallery-sso-api%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI'm%20planning%20to%20do%20something%20similar%20but%20using%20PowerShell.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3ELuis%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1352685%22%20slang%3D%22en-US%22%3EIs%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1352685%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe've%20200%2B%20SAML%20based%20apps%20federated%20with%20our%20Azure%20AD%20tenant.%20We%20are%20using%20a%20common%20cert%20for%20SAML%20token%20signing%20for%20all%20these%20apps.%20Cert%20is%20due%20for%20renewal%20by%20end%20of%20this%20year.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDoes%20someone%20know%20if%20there's%20any%20way%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20instead%20of%20doing%20it%20on%20the%20portal%20which%20is%20a%20tedious%20task%3F%20I%20did%20google%20but%20couldn't%20find%20anything%20helpful.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1352685%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1595030%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1595030%22%20slang%3D%22en-US%22%3E%3CP%3Eany%20new%20traction%20here%3F%26nbsp%3B%3C%2FP%3E%3CP%3Eupdating%20via%20powershell%20would%20be%20great.%20i'm%20actually%20more%20interested%20in%20reporting%20on%20the%20signing%20certificate%20and%20expiration%20dates%20so%20we%20can%20plan%20rotation%20with%20our%203%20party%20vendors.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ealso%20to%20audit%20and%20make%20sure%20the%20notification%20address%20is%20our%20distro%20group.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1599498%22%20slang%3D%22en-US%22%3ERe%3A%20Is%20it%20possible%20to%20update%20SAML%20token%20signing%20certificate%20via%20PowerShell%20in%20Azure%20AD%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1599498%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F355862%22%20target%3D%22_blank%22%3E%40gd-29%3C%2FA%3E%3C%2FP%3E%3CP%3EI%20was%20able%20to%20accomplish%20this%20with%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-markup%22%3E%3CCODE%3E(Get-AzureADServicePrincipal%20-Filter%20%22displayName%20eq%20'%24app_name'%22).keyCredentials%20%7C%20Where-Object%20%7B%24_.Usage%20-eq%20%22Sign%22%7D%20%7Cselect%20EndDate%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhere%20%24app_name%20is%20the%20name%20of%20your%20AAD%20app.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi,

 

We've 200+ SAML based apps federated with our Azure AD tenant. We are using a common cert for SAML token signing for all these apps. Cert is due for renewal by end of this year.

 

Does someone know if there's any way to update SAML token signing certificate via PowerShell instead of doing it on the portal which is a tedious task? I did google but couldn't find anything helpful.

 

Thanks.

 

 

8 Replies
Highlighted
Highlighted

@Gerald_Glen this is something we're actively working on now. We hope to have good news for you by the end of June.

Highlighted

Thanks @Luis Leon Plata , looking forward to hear it soon...

Highlighted

@Gerald_Glen

A dumb question but is this in a BYOK scenario for in the tenant? 

Highlighted

Hey @Gerald_Glen - We have you can manage your key credentials now using APIs. I think it also works for PowerShell but I haven't tried personally. Here is a doc on how to use the APIs: https://aka.ms/aadgallery-sso-api

 

I'm planning to do something similar but using PowerShell.

 

Thanks,

Luis

Highlighted

any new traction here? 

updating via powershell would be great. i'm actually more interested in reporting on the signing certificate and expiration dates so we can plan rotation with our 3 party vendors.

 

also to audit and make sure the notification address is our distro group.

Highlighted

@gd-29

I was able to accomplish this with the following:

 

 

(Get-AzureADServicePrincipal -Filter "displayName eq '$app_name'").keyCredentials | Where-Object {$_.Usage -eq "Sign"} |select EndDate

 

 

Where $app_name is the name of your AAD app.