Although you deploy it first to support SSA and decrease administrative overhead, you might need to
perform management tasks periodically after you're deployed first.
This lesson describes two of the most common tasks.
The first task is managing and managing the certificate lifecycle to prevent issues that are caused
by certificate expiration.
The self signed self generated certificate that either first generates support or automatic rollover,
which are in use at first certificates once a year.
Without manual intervention.
Automatic certificate rollover is the first process that.
Generate two new tokens signing certificates every year.
If Office 365 is not updated with a new token sign and certificate, no user can sign in and use Office
3625.
Because this certificate signs all assertions from the Federation server.
If an internal API is used to issue the token sign and certificate, it first does not provide automatic
certificate rollover and you must therefore manually renew the certificates and update them in your
office.
365 Data.
You can use the ADF management console to view certificate expiration dates for the service communications
token decrypting and token sign and certificates.
In the console.
Three Expand service and then click certificates.
You also can use the Azure Added Module for Windows PowerShell to view certificate details.
When you use the Windows PowerShell coming, let get a defense certificate.
If you prefer to use other automatic certificate rollover for managing their lifecycle of your certificates,
you need to enable the feature in the first.
And then install the awful 36254 duration metadata update automation installation tool to enable this
feature in a first by using the third aided first properties Windows PowerShell command let.
After installing the tool, you can use the update MSO for duration domain Windows PowerShell Command
Glad to update the Office 365 service automatically when the first token sign and certificate renews
annually.
You should run this tool as a daily scheduled task on the ADF server.
If you do not do this, you must monitor token Simon's certificate renewal manually on the ADF server.
You should draw the update tools group schedule task only on the ADF server and if a duration server
for.
Another task is changing the primary and secondary and first federation servers.
If you use WIOD as a defense data store, you can change the primary and secondary federation servers
if you use that as a module for Windows PowerShell.
This method allows you to change the database for all certain for the.
At first server and then change the roll.
For example, if you want to change the Primary Federation server at first server one to a secondary
federation server, the first server to use the following procedure.
First, identify the secondary federation server in the first server to that will become the Primary
Federation server.
Second, on the Secondary Federation server, a different server to the Microsoft is or a module for
a Windows PowerShell prompt to have the following command to learn presenter you have to type the at
first sync properties distro primary computer.
And the third step on the Primary Federation server, the first server, one of the Microsoft Azure
ad module, Windows PowerShell prompt, you have to type the following set of the first sync properties
distro.
Secondary computer disk.
Primary computer idea first server to.
The Primary Federation server becomes a secondary federation server as a read on the W database, and
the Secondary Federation server becomes the Primary Federation server with a re derived WIOD database
from which all the secondary federation servers retrieve their database corpus.
Please know that switching to first aid first saw federation serve a rule does not apply you.
If you use SQL Server as the first configuration data base store.
This is because only the first Federation servers have a read write access to the sequel server database.