[Access Control] Procedure for Upgrading a PowerShell Federated Domain (Key Rollover)

Overview

This article explains the procedure for upgrading a federated domain (key rollover) for customers who have configured federation between Microsoft 365 and Access Control using PowerShell (legacy procedure).

For environments where federation was previously configured using PowerShell (legacy procedure), we recommend switching the certificate key used for authentication.
By performing this procedure, you can obtain the following benefits.

• Enhanced security
  The certificate is updated to a new certificate with a larger key length (key size), improving security.

• Improved user convenience (MFA skip feature)
  If multi-factor authentication that meets Microsoft's requirements has been completed on the HENNGE side, duplicate MFA requests on the Entra ID side can be skipped.
  *For details and conditions, please refer to the following article.
  🔗Release Information: [Access Control] Added a feature to skip Microsoft 365 multi-factor authentication when specific authentication is performed in Access Control in the 3rd week of February 2026

Contents

Preparation (Adding a Service)

1. Log in to the Access Control administration screen and navigate to ［System］－［Service Provider Settings］.

   

2. Check whether the following settings are present on the screen.

   • Display name: Microsoft

   • Type: Microsoft

   If the settings are present, perform Procedure 7 and subsequent procedures.

   

3. If the settings are not present, click ［Add Service］ in the upper-right corner of the screen.

   

4. On the “Add New Service” screen, click ［Add Service］.

   

5. Select ［Use Preset］－［Microsoft］.

   

6. Under “Access Policy Groups That Allow This Service Provider,” enable ［Allow］ for the groups permitted to access Microsoft 365, then click ［Apply Changes］.

   When connecting with PowerShell, access was allowed for “all access policy groups.” Therefore, allowing all access policy groups will generally enable you to safely maintain the previous configuration.

   

7. From ［Service Provider Settings］, open the Microsoft settings you saved earlier, then click ［Federated Domains］－［Manage Domains］.

   

8. When the “Requested Permissions” screen appears, select the checkbox for ［Consent on behalf of your organization］, and then select ［Accept］.
   *If you proceed to the next screen without this screen appearing, authentication has already been completed. Proceed as is.

9. When the “Domain Management” screen appears, click ［Upgrade］ for the Target domain whose “Status” is ［Federated (Legacy Procedure)］.
   

10. Confirm that the “Status” of the Target domain is ［Federated］ (with the legacy procedure label removed), then click ［Close］ to complete the process.

    

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.