(Updated) Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings

🚨 The Signal: Microsoft Entra will now, by default, block federated sign-ins where the internal federation domain doesn't match the user's UPN. This enhances security by preventing unintended cross-domain access from misconfigured federation trusts, reducing the risk of unauthorized access.

The Impact

Organizations using federated authentication with misconfigured domains face sign-in blocks, increasing security posture by preventing unauthorized access.

• Federated users: May experience sign-in failures if UPNs don't match federated domain.
• Security teams: Reduced risk of unauthorized cross-domain access.
• Identity admins: Potential need to reconfigure federated domains.
• Compliance officers: Improved adherence to access control policies.

The Action

1. Identify all federated domains configured before December 2025 using Get-MsolDomainFederationSettings.
2. Review internalDomainFederation object settings for identified domains.
3. Verify that user UPNs align with the internalDomainFederation setting for each federated domain.
4. If UPNs do not align, update federation configuration to ensure consistency or explicitly configure federatedTokenValidationPolicy to allow specific exceptions (not recommended).

Domain: Entra · Impact: high · Workload: Entra ID · Essential Eight: Multi-Factor Authentication · ISM: ISM-0109, ISM-0123, ISM-0140, ISM-0974, ISM-1173, ISM-1228, ISM-1401, ISM-1504, ISM-1505, ISM-1679, ISM-1680, ISM-1681, ISM-1682, ISM-1683, ISM-1815, ISM-1819, ISM-1872, ISM-1873, ISM-1874, ISM-1892, ISM-1893, ISM-1894, ISM-1906, ISM-1907