SAML signing certificate expiry: find it, renew it, avoid outages

When the certificate that signs SAML assertions expires, the service provider can stop trusting sign-ins and single sign-on can fail for everyone using that application. The renewal itself is quick; the outage comes from the service provider not yet trusting the new certificate.

Find the date in Microsoft Entra

Go to Enterprise applications → your app → Single sign-on and open the SAML certificates section (use the edit icon). The token signing certificate shows its status and expiration date.

Entra emails notification addresses 60, 30 and 7 days before expiry. By default only the admin who added the app is notified. You can add up to five addresses, and a distribution list works. If you configured notifications by script, open the SAML settings page once to confirm they are registered.

Other identity providers

Other identity providers also show the signing certificate on the application or federation settings page; check your vendor's documentation. Note the date in your tracker with the application name so a person other than the original admin can find it.

Rotate without an outage

1. Create the new certificate but do not make it active yet.
2. Give the new certificate (or refreshed metadata) to the service provider and confirm they have installed it.
3. Make the new certificate active.
4. Test a real sign-in, then remove the old certificate.

Microsoft warns that if an expired certificate and a valid inactive one both exist, Entra signs with the valid one, which itself causes an outage if the service provider has not installed it. Some service providers can hold only one certificate at a time and need a scheduled change window, so ask which kind yours is before you start.

Questions

How long does an Entra-generated SAML signing certificate last?

By default, three years, which is long enough that the person who set it up has often left by the time it expires.

Do I need to renew if the app uses metadata URL auto-refresh?

Only if the service provider actually re-reads the metadata. Many do not, so confirm rather than assume.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.