> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Updating Entra ID Federation with TruU

Over time you may need to update the federation configuration between your Entra ID domain and TruU — most commonly because the signing certificate on the existing adapter is nearing expiration and needs to be rotated. This guide walks through generating a fresh configuration and applying it to your existing federated domain.

Updating federation does not require you to re-register your custom domain in Entra ID or repeat the initial onboarding steps. It only requires creating a new Entra ID adapter in the TruU Admin Console and re-running the federation script with the updated configuration.

## Prerequisites

* Global administrator role in the Entra ID tenant
* Access to the TruU Admin Console for the environment being updated
* The domain must already be federated with TruU (see [Federating Entra ID Domain to TruU for Authentication](https://docs.truu.ai/federating-entra-id-domain-to-tru-u-for-authentication))
* PowerShell 64-bit, run as administrator, on a Windows machine with network access to Entra ID
* The Microsoft Graph PowerShell module installed, with an active `Connect-MgGraph` session authenticated as an account with permission to manage domain federation settings (`Domain.ReadWrite.All`)

## Creating a New Entra ID Adapter Using TruU Admin Console

1. Navigate to **Integrations** and click on the **(+)** in the top right corner
2. Add a new Single Sign On adapter by clicking the **(+)** in the upper right corner
3. Select **Entra ID** type and click **Create**
4. Enter a distinct **Adapter Name** and the **Entra ID Domain** (this should match the domain that is currently federated). The **ID Server URL** is pre-populated and does not need to be changed. Select a **certificate validity period** and a **FIDO Origin** (default, in most cases). Set the **Default View** to match the setting on your existing Entra ID adapter
5. Click **Apply**. This will download a PowerShell script containing the updated configuration needed to re-establish federation in Entra ID

> **Note:** Creating a new adapter does not remove or disable the existing one. Once the new adapter's configuration has been applied via the federation script (below), the old adapter's certificate is no longer used for federated authentication and can be retired from the TruU Admin Console.

> **Important:** Save a copy of the downloaded PowerShell script somewhere secure. The TruU Admin Console does not provide a way to re-download the script or certificate for an adapter after it has been created, so if federation ever needs to be re-applied with this same certificate, the saved script will be required.

## Applying the Updated Configuration Using the PowerShell Script

The script downloaded from the TruU Admin Console only sets the values for the new adapter (domain, display name, sign-in and sign-out URIs, signing certificate, and protocol settings) and calls `New-MgDomainFederationConfiguration` directly. For an update, use the full PowerShell script published in [Federating Entra ID Domain to TruU for Authentication](https://docs.truu.ai/federating-entra-id-domain-to-tru-u-for-authentication#setting-up-entra-id-to-truu-federation-using-a-powershell-script) instead of running the downloaded script on its own — the full script also verifies the Microsoft Graph module and required scopes (`Domain.ReadWrite.All` and `Directory.ReadWrite.All`), and, because the domain is already federated, safely converts it to **Managed** authentication and waits before re-federating, rather than attempting to federate an already-federated domain directly.

1. Run PowerShell 64 app on Windows as administrator
2. Copy and paste the full PowerShell script from [Federating Entra ID Domain to TruU for Authentication](https://docs.truu.ai/federating-entra-id-domain-to-tru-u-for-authentication#setting-up-entra-id-to-truu-federation-using-a-powershell-script) into your PowerShell session
3. Open the script downloaded from the TruU Admin Console in the previous step, and copy the variable assignments (domain, display name, URIs, signing certificate, protocol, and MFA behavior) into *Step 3* of the pasted script, replacing the placeholder values
4. Run the script

The script will verify that the required Microsoft Graph scopes are granted, convert the domain from **Federated** to **Managed** authentication if it is currently federated, then apply the updated configuration by running `New-MgDomainFederationConfiguration` with the new adapter's settings, and finally confirm that the domain's authentication type is now **Federated**. Once the script completes, authentication will use the new certificate and settings going forward.

## Testing Federated Authentication

After the script completes, confirm that federated sign-in is still working as expected:

1. Sign out of any active sessions
2. Navigate to a sign-in page for the federated domain
3. Enter the email address for a user in the federated domain on the Microsoft sign-in screen and confirm that authentication is redirected to TruU
4. Complete authentication with TruU and confirm the user is signed in successfully

If authentication fails, verify that the certificate validity period selected in the TruU Admin Console has not already expired, and that the domain entered when creating the adapter exactly matches the currently federated domain.

## Related Documentation

* [Federating Entra ID Domain to TruU for Authentication](https://docs.truu.ai/federating-entra-id-domain-to-tru-u-for-authentication)