Rolling a SAML signing certificate without an outage

Every SAML Enterprise Application in Entra signs its tokens with a certificate. When that certificate expires, sign-ins stop. The good news is that Entra lets you stage a new certificate before you switch to it, so the whole thing can be done with zero downtime if the vendor cooperates.

Before the change

• Check who receives expiry notifications under SAML Certificates → Notification email. Add a shared mailbox, not just one person.
• Find out whether the vendor's side supports more than one trusted certificate at a time. This decides the whole plan.
• Book a short window with the vendor contact if they don't.

The rollover

1. In the app's Single sign-on blade, open SAML Certificates and choose Edit → New Certificate. Save it but leave it inactive.
2. Download the new certificate (Base64) or the federation metadata XML and send it to the vendor.
3. If the vendor supports two certificates: they add the new one alongside the old. You make the new one active whenever you like, then they remove the old one.
4. If they support only one: agree a time, make the new certificate active in Entra, and have them swap theirs at the same moment. Test immediately.
5. Test with a pilot user in a private browser window, then confirm a clean entry in the sign-in logs.

Quick inventory with Graph

To see what's coming up across the tenant, this lists service principals with SAML signing keys and their expiry dates:

Connect-MgGraph -Scopes "Application.Read.All"

Get-MgServicePrincipal -All -Property DisplayName,KeyCredentials,PreferredSingleSignOnMode |
  Where-Object PreferredSingleSignOnMode -eq "saml" |
  ForEach-Object {
    foreach ($k in $_.KeyCredentials | Where-Object Usage -eq "Verify") {
      [pscustomobject]@{
        App     = $_.DisplayName
        Expires = $k.EndDateTime
        DaysLeft = [int]($k.EndDateTime - (Get-Date)).TotalDays
      }
    }
  } | Sort-Object DaysLeft | Format-Table

What breaks if you miss it

When the active signing certificate expires, every SAML sign-in to that app fails. The vendor's error usually mentions an invalid signature, and users see a vendor error page rather than a Microsoft one, which can send troubleshooting down the wrong path. If an app suddenly fails for everyone, check the certificate first.

Make expiry boring

• Add a shared mailbox as the certificate notification address on every SAML app
• Keep a list of SAML apps, their vendor contacts and whether they support two certificates
• Run the inventory script monthly, or schedule it in Azure Automation
• Note each app's expiry date in your team calendar