Domain-InternalFederation.ReadWrite.All

Allows the app to create, read, update and delete internal federation configuration for a domain.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the Domain-InternalFederation.ReadWrite.All permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	64d40371-8d58-4270-bc8a-b4a66de36b9a	857bd3ea-490e-4284-88a7-a7de1893b6ee
DisplayText	Create, read, update and delete internal federation configuration for a domain.	Create, read, update and delete internal federation configuration for a domain.
Description	Allows the app to create, read, update and delete internal federation configuration for a domain.	Allows the app to create, read, update and delete internal federation configuration for a domain.
AdminConsentRequired	Yes	Yes

Graph Methods

• API [v1.0]
• API [beta]
• PowerShell [v1.0]
• PowerShell [beta]

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	DELETE /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}
	GET /domains/{domainsId}/federationConfiguration
	GET /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}
	PATCH /domains/{domainsId}/federationConfiguration/{internalDomainFederationId}
	POST /domains/{domainsId}/federationConfiguration

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

• internalDomainFederation
• samlOrWsFedProvider
• signingCertificateUpdateStatus

Graph reference: internalDomainFederation

Property	Type	Description
activeSignInUri	String	URL of the endpoint used by active clients when authenticating with federated domains set up for single sign-on in Microsoft Entra ID. Corresponds to the ActiveLogOnUri property of the Set-EntraDomainFederationSettings PowerShell cmdlet.
displayName	String	The display name of the federated identity Provider (IdP). Inherited from identityProviderBase.
federatedIdpMfaBehavior	federatedIdpMfaBehavior	Determines whether Microsoft Entra ID accepts the MFA performed by the federated IdP when a federated user accesses an application that is governed by a conditional access policy that requires MFA. The possible values are: acceptIfMfaDoneByFederatedIdp, enforceMfaByFederatedIdp, rejectMfaByFederatedIdp, unknownFutureValue. For more information, see federatedIdpMfaBehavior values.
id	String	The identifier of the federated identity provider. Inherited from entity.
isSignedAuthenticationRequestRequired	Boolean	If true, when SAML authentication requests are sent to the federated SAML IdP, Microsoft Entra ID will sign those requests using the OrgID signing key. If false (default), the SAML authentication requests sent to the federated IdP aren't signed.
issuerUri	String	Issuer URI of the federation server. Inherited from samlOrWsFedProvider.
metadataExchangeUri	String	URI of the metadata exchange endpoint used for authentication from rich client applications. Inherited from samlOrWsFedProvider.
nextSigningCertificate	String	Fallback token signing certificate that can also be used to sign tokens, for example when the primary signing certificate expires. Formatted as Base64 encoded strings of the public portion of the federated IdP's token signing certificate. Needs to be compatible with the X509Certificate2 class. Much like the signingCertificate, the nextSigningCertificate property is used if a rollover is required outside of the auto-rollover update, a new federation service is being set up, or if the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated.
passiveSignInUri	String	URI that web-based clients are directed to when signing into Microsoft Entra services. Inherited from samlOrWsFedProvider.
preferredAuthenticationProtocol	authenticationProtocol	Preferred authentication protocol. This parameter must be configured explicitly for the federation passive authentication flow to work. The possible values are: wsFed, saml, unknownFutureValue. Inherited from samlOrWsFedProvider.
promptLoginBehavior	promptLoginBehavior	Sets the preferred behavior for the sign-in prompt. The possible values are: translateToFreshPasswordAuthentication, nativeSupport, disabled, unknownFutureValue.
signingCertificate	String	Current certificate used to sign tokens passed to the Microsoft identity platform. The certificate is formatted as a Base64 encoded string of the public portion of the federated IdP's token signing certificate and must be compatible with the X509Certificate2 class. This property is used in the following scenarios: If a rollover is required outside of the autorollover update A new federation service is being set up If the new token signing certificate isn't present in the federation properties after the federation service certificate has been updated. Microsoft Entra ID updates certificates via an autorollover process in which it attempts to retrieve a new certificate from the federation service metadata, 30 days before expiry of the current certificate. If a new certificate isn't available, Microsoft Entra ID monitors the metadata daily and will update the federation settings for the domain when a new certificate is available. Inherited from samlOrWsFedProvider.
signingCertificateUpdateStatus	signingCertificateUpdateStatus	Provides status and timestamp of the last update of the signing certificate.
signOutUri	String	URI that clients are redirected to when they sign out of Microsoft Entra services. Corresponds to the **L