Skip to content

Commit f2b58a1

Browse files
committed
Updated domains-verify-custom-subdomain file with MgGraph cmdlets
1 parent 60a49cc commit f2b58a1

File tree

1 file changed

+9
-4
lines changed

1 file changed

+9
-4
lines changed

articles/active-directory/enterprise-users/domains-verify-custom-subdomain.md

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ ms.collection: M365-identity-device-management
2222

2323
After a root domain is added to Azure Active Directory (Azure AD), part of Microsoft Entra, all subsequent subdomains added to that root in your Azure AD organization automatically inherit the authentication setting from the root domain. However, if you want to manage domain authentication settings independently from the root domain settings, you can now with the Microsoft Graph API. For example, if you have a federated root domain such as contoso.com, this article can help you verify a subdomain such as child.contoso.com as managed instead of federated.
2424

25-
In the Azure portal, when the parent domain is federated and the admin tries to verify a managed subdomain on the **Custom domain names** page, you'll get a 'Failed to add domain' error with the reason "One or more properties contains invalid values." If you try to add this subdomain from the Microsoft 365 admin center, you will receive a similar error. For more information about the error, see [A child domain doesn't inherit parent domain changes in Office 365, Azure, or Intune](/office365/troubleshoot/administration/child-domain-fails-inherit-parent-domain-changes).
25+
In the Azure portal, when the parent domain is federated and the admin tries to verify a managed subdomain on the **Custom domain names** page, you'll get a 'Failed to add domain' error with the reason "One or more properties contains invalid values." If you try to add this subdomain from the Microsoft 365 admin center, you'll receive a similar error. For more information about the error, see [A child domain doesn't inherit parent domain changes in Office 365, Azure, or Intune](/office365/troubleshoot/administration/child-domain-fails-inherit-parent-domain-changes).
2626

2727
Because subdomains inherit the authentication type of the root domain by default, you must promote the subdomain to a root domain in Azure AD using the Microsoft Graph so you can set the authentication type to your desired type.
2828

@@ -31,6 +31,11 @@ Because subdomains inherit the authentication type of the root domain by default
3131
1. Use PowerShell to add the new subdomain, which has its root domain's default authentication type. The Azure AD and Microsoft 365 admin centers don't yet support this operation.
3232

3333
```powershell
34+
Connect-MgGraph -Scopes "Domain.ReadWrite.All"
35+
$param = @{
36+
id="test.contoso.com"
37+
AuthenticationType="Federated"
38+
}
3439
New-MsolDomain -Name "child.mydomain.com" -Authentication Federated
3540
```
3641

@@ -73,16 +78,16 @@ POST https://graph.microsoft.com/v1.0/{tenant-id}/domains/foo.contoso.com/promot
7378

7479
Scenario | Method | Code | Message
7580
-------- | ------ | ---- | -------
76-
Invoking API with a subdomain whose parent domain is unverified | POST | 400 | Unverified domains cannot be promoted. Please verify the domain before promotion.
77-
Invoking API with a federated verified subdomain with user references | POST | 400 | Promoting a subdomain with user references is not allowed. Please migrate the users to the current root domain before promotion of the subdomain.
81+
Invoking API with a subdomain whose parent domain is unverified | POST | 400 | Unverified domains can't be promoted. Please verify the domain before promotion.
82+
Invoking API with a federated verified subdomain with user references | POST | 400 | Promoting a subdomain with user references isn't allowed. Please migrate the users to the current root domain before promotion of the subdomain.
7883

7984

8085
### Change the subdomain authentication type
8186

8287
1. Use the following command to change the subdomain authentication type:
8388

8489
```powershell
85-
Set-MsolDomainAuthentication -DomainName child.mydomain.com -Authentication Managed
90+
Update-MgDomain -DomainId "test.contoso.com" -BodyParameter @{AuthenticationType="Managed"}
8691
```
8792

8893
1. Verify via GET in Microsoft Graph API that subdomain authentication type is now managed:

0 commit comments

Comments
 (0)