Need Help converting Federated ADFS Domain back to Managed

Because no working non-federated administrator can access the tenant, contact Microsoft Support to recover tenant administration or temporarily reverse federation before attempting the domain conversion.

1. Recover administrative access

The credentials originally used to configure AD FS are not specifically required. What is required is access to a sufficiently privileged Microsoft Entra administrator account that does not depend on the unavailable federated domain.

1. Check whether another administrator can sign in with a cloud-only account using the tenant’s *.onmicrosoft.com domain.
2. If such an administrator exists, have that administrator reset or create the account needed to perform the conversion.
3. If no administrator can sign in:
   • Try work-or-school self-service password reset if it was previously enabled.
   • If recovery is unavailable or fails, contact Microsoft Support and state:

     The tenant is locked out because its only administrator accounts use a federated domain, and the AD FS infrastructure has been permanently decommissioned. Please temporarily reverse the domain federation or restore access to a cloud-only administrator.

Microsoft specifically documents support escalation when the last administrator depends on the failed federated domain.^1^ If the only administrator password is unknown, self-service recovery or Microsoft Support is the documented recovery path.^2^

Microsoft’s public business-support options are listed here.^3^ Be prepared to establish ownership of the organization and domain; support cannot simply disclose or change account details without validation.

2. Remove the federation configuration

After access is restored through a cloud-only administrator, use Microsoft Graph PowerShell rather than the deprecated MSOnline module.

The removal changes authentication for the whole domain. Schedule a maintenance window and ensure users have a usable cloud authentication method; domain conversion can take up to 60 minutes.^4^

Run:

Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "Domain.ReadWrite.All"

$domain = "contoso.com"
$config = Get-MgDomainFederationConfiguration -DomainId $domain

$config | Format-List Id,IssuerUri,PassiveSignInUri

Remove-MgDomainFederationConfiguration `
    -DomainId $domain `
    -InternalDomainFederationId $config.Id

Get-MgDomainFederationConfiguration -DomainId $domain
Disconnect-MgGraph

Replace contoso.com with the federated domain. Approve the requested Graph permission using an account authorized to grant and exercise Domain.ReadWrite.All.

The removal cmdlet deletes the domain’s internalDomainFederation object.^5^ The expected final result is that the last Get-MgDomainFederationConfiguration call returns no federation configuration for that domain.

Do not use Convert-MsolDomainToStandard from a random workstation as the primary method. Microsoft documents that it can fail when the computer running it is not the AD FS server, and MSOnline is deprecated.^6^

3. After conversion

• Test sign-in with a non-administrator account before ending the maintenance window.
• Review password-hash synchronization, pass-through authentication, or cloud-password readiness as applicable. Removing federation does not by itself establish that every user knows or has a usable cloud password.
• Review MFA and Conditional Access because policies formerly enforced by AD FS might need Microsoft Entra equivalents.^4^
• Create at least two cloud-only emergency Global Administrator accounts under *.onmicrosoft.com, independent of federation, and validate them regularly.^7^

If Graph reports that the federation object cannot be removed even with the required authorization, reopen or update the Microsoft Support case and request removal of the stale federation metadata.

References

1. Users can no longer sign in after you run the Convert-MSOLDomaintoFederated command to convert an existing domain
2. Forgot password to sign in to Microsoft 365, Intune, or Azure
3. Contact Microsoft customer support
4. Migrate from federation to cloud authentication
5. Removes the federation settings of a specified federated domain using the Remove-MgDomainFederationConfiguration PowerShell cmdlet.
6. Error when you run the Convert-MsolDomainToStandard cmdlet: Failed to connect to Active Directory Federation Services 2.0 on the local machine
7. Manage emergency access accounts in Microsoft Entra ID