![\"office365securefederation01\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2017\/02\/office365securefederation01.jpg\" "\\"office365securefederation01\\"")
<\/p>\n<\/p>\n
In Office 365 environment, AD FS signs its tokens to\u00a0Microsoft Azure Active Directory to\u00a0protect the tokens\u00a0from being tampered with<\/strong>.<\/p>\n This signature can be based on SHA-1 or SHA-256 and since\u00a0Azure Active Directory now supports<\/strong>\u00a0tokens signed with SHA-256 algorithm, the change to the new algorithm it is strongly recommended to ensure the highest level of security<\/strong>.<\/p>\n If your configuration is still using the SHA-1 algorithm, in\u00a0the\u00a0Office 365 Admin center<\/strong> under\u00a0Message center<\/strong>\u00a0you can find a warning to secure the token-signing algorithm to SHA-256<\/strong>.<\/p>\n There are two ways to change the algorithm type in AD FS:<\/p>\n <\/p>\n Access the AD FS management console on the primary AD FS server<\/strong> and after expanding the AD FS node click Relying Party Trusts<\/strong>. Right click Microsoft Office 365 Identity Platform<\/strong> and select Properties<\/strong> option.<\/p>\n Select Advanced<\/strong> tab and set Secure hash algorithm<\/strong> field with SHA-256<\/strong> value.<\/p>\n Click OK<\/strong> to confirm the change.<\/p>\n <\/p>\n Same change can be done via PowerShell<\/strong> using the following command:<\/p>\n No extra configuration is required and this change doesn't impact Office 365 or other Azure AD applications accessibility<\/strong>.<\/p>\n In Office 365 environment, AD FS signs its tokens to\u00a0Microsoft Azure Active Directory to\u00a0protect the tokens\u00a0from being tampered with. This signature can be based on SHA-1 or SHA-256 and since\u00a0Azure Active Directory now supports\u00a0tokens signed with SHA-256 algorithm, the change to the new algorithm it is strongly recommended to ensure the highest level of security. If your configuration is still using the SHA-1 algorithm, in\u00a0the\u00a0Office 365 Admin center under\u00a0Message center\u00a0you can find a warning to secure the token-signing algorithm to SHA-256.<\/p>\n","protected":false},"author":3,"featured_media":20045,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1065,1721],"tags":[1760,1566,1571,1759],"class_list":["post-20044","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-en","category-office365-en","tag-algorithm","tag-office-365","tag-office-365-en","tag-token","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/20044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=20044"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/20044\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/20045"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=20044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=20044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=20044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"office365securefederation02\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2017\/02\/office365securefederation02-600x215.jpg\" "\\"office365securefederation02\\"")
<\/p>\n\n
Change the algorithm via AD FS console<\/h2>\n
![\"office365securefederation03\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2017\/02\/office365securefederation03-600x238.jpg\" "\\"office365securefederation03\\"")
<\/p>\n![\"office365securefederation04\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2017\/02\/office365securefederation04.jpg\" "\\"office365securefederation04\\"")
<\/p>\n![\"office365securefederation05\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2017\/02\/office365securefederation05.jpg\" "\\"office365securefederation05\\"")
<\/p>\nChange the algorithm using AD FS PowerShell cmdlets<\/h2>\n
Set-AdfsRelyingPartyTrust -TargetName 'Microsoft Office 365 Identity Platform' -SignatureAlgorithm 'http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256'<\/pre>\n
![\"office365securefederation06\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2017\/02\/office365securefederation06-600x304.jpg\" "\\"office365securefederation06\\"")
<\/p>\n![\"signature\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" "\\"signature\\"")
<\/p>\n","protected":false},"excerpt":{"rendered":"