Disable Microsoft 365 / Entra ID Federation with PowerShell

Before you set up Single Sign On (SSO) with JumpCloud, you’ll want to verify that Federated SignOn is disabled in your organization for the domain you’re planning to federate with JumpCloud SSO. This ensures that any previous SSO configurations are disabled and allows the syncing of users to be done before activating the Microsoft 365 SSO application in the JumpCloud Admin Portal.

These steps are also applicable if you want to disable JumpCloud SSO for Microsoft 365 (M365) / Entra ID

To read more on updating Federation of Domains, see Microsoft's Update or repair the settings of a federated domain in Microsoft 365, Azure, or Intune.

To set domain from federated to managed

1. Install the Microsoft Graph PowerShell.
2. Set the Execution Policy to Remote Signed by running Set-ExecutionPolicy RemoteSigned
3. Connect to your Microsoft 365 / Entra ID tenant:
   • Connect-MgGraph -TenantId “YOUR_TENTANT_ID” -Scopes “Directory.Read.All, Domain.Read.All, Domain.ReadWrite.All”
   • For more information, see Find your Microsoft 365 tenant ID.
4. Enter your Office 365 Global Administrator Credentials.
5. Consent and Accept the requested scopes.
6. Verify the domain is federated:
   • Get-MgDomain -DomainId “<YourO365Domain.com>”
7. Change Federation Authentication from federated to managed:
   • Update-MgDomain –DomainId “<YourO365Domain.com>” -AuthenticationType Managed
8. To check Federation status:
   • Get-MgDomain -DomainId “<YourO365Domain.com>”

Authentication Status is now listed as managed.