Microsoft 365 Certified: Administrator ExpertDeploy and manage a Microsoft 365 tenantHard
A Microsoft 365 administrator is experiencing issues with user authentication. Users are reporting that they are intermittently unable to sign in to Microsoft 365 services, and some are receiving 'Access Denied' messages even with correct credentials. The administrator suspects a problem with the federation service. Which PowerShell cmdlet should the administrator use to diagnose the health of the federation service in their Microsoft 365 tenant?
- ATest-FederationTrust
- BGet-MsolUser
- CTest-OrganizationRelationship
- DGet-MsolDirSyncFeatures
Show answer & explanationAnswer & explanation
Correct answer: A. Test-FederationTrust
The `Test-FederationTrust` cmdlet is specifically used to verify the health and proper functioning of the federation trust between an on-premises Active Directory Federation Services (AD FS) server and the Azure AD/Microsoft 365 federation service. This directly helps diagnose authentication issues related to federation.
Why the other options are wrong
- B. `Get-MsolUser` retrieves user information, not diagnostic information for federation services.
- C. `Test-OrganizationRelationship` checks the health of organization relationships between Exchange organizations, not federation trusts.
- D. `Get-MsolDirSyncFeatures` retrieves the status of directory synchronization features, not federation health.
Test-FederationTrust Cmdlet
A PowerShell cmdlet used in Exchange Online or Azure AD PowerShell to verify the health and configuration of the federation trust with an on-premises Active Directory Federation Services (AD FS) environment.
- Diagnoses issues with federated authentication.
- Checks connectivity and certificate validity.
- Helps troubleshoot intermittent sign-in problems.
- Requires Exchange Online PowerShell or Azure AD PowerShell.
Memory trick: Test-FederationTrust is your federation's health check, ensuring the trust bridge isn't broken.