Entra ID domain federation config orphaned — GET returns 404, POST returns 409 Conflict, backend purge needed

Vuyisile 0 Reputation points
2026-03-31T22:47:16.6333333+00:00

We have a domain that was previously federated from Google Workspace into Entra ID. During a federated-to-managed conversion, the federation configuration object appears to have become orphaned.

Current behavior:

  • Get-MgDomainFederationConfiguration returns 404 / does not exist

New-MgDomainFederationConfiguration returns 409 Conflict — Resource Already Exists

The domain itself successfully toggles between federated and managed state via Microsoft Graph

The federation configuration object is not visible or deletable via any Graph API call

User impact:

Users on this domain are completely unable to authenticate. They are presented with a blank "choose a sign-in method" screen with no options. This is blocking access to Power BI and all Microsoft 365 services for the affected domain.

What has been tried:

Converting domain to managed via Microsoft Graph

Attempting to delete federation config via Graph — object not found

Attempting to recreate federation config — 409 conflict every time

MSOnline PowerShell — same result

Assessment:

The federated-to-managed conversion left an orphaned federation configuration object in the directory partition that is invisible to the Graph API but is blocking creation of a new federation config. This appears to require a backend directory partition purge by Microsoft.

Has anyone encountered this and been able to get Microsoft to resolve it? Looking for the fastest path to getting the right backend team engaged.We have a domain that was previously federated from Google Workspace into Entra ID. During a federated-to-managed conversion, the federation configuration object appears to have become orphaned.

Tried to contact Microsoft Azure support by putting in a ticket but have not had a response on the ticket or any acknowledgment for 5 days

Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-03-31T22:47:37.6266667+00:00

    This scenario matches a broken or orphaned federation configuration that cannot be fixed from the tenant side and requires Microsoft backend intervention.

    From the available guidance, similar tenant- or auth-breaking conditions (for example, tenants blocked or inaccessible, or lockout of the only global admin) are resolved only by engaging Microsoft Support and having the appropriate backend team repair or purge directory objects. There is no documented PowerShell or Graph operation that can remove an invisible/orphaned federation configuration when:

    • Get-MgDomainFederationConfiguration returns 404 (object not found), and
    • New-MgDomainFederationConfiguration returns 409 Conflict (resource already exists), and
    • The domain can still be flipped between federated/managed, but users cannot sign in.

    The fastest viable path based on similar cases is:

    1. Open or escalate a Microsoft support ticket from a working tenant
      • If the affected tenant is partially unusable, sign in to another tenant where portal access works (for example, by creating a new tenant as described in the “tenant blocked/inactive” guidance) and open a support ticket from there, clearly referencing the broken tenant ID and domain.
      • In the ticket, explicitly describe:
        • The affected tenant ID and primary domain.
        • Exact Graph calls and responses: 404 on Get-MgDomainFederationConfiguration, 409 on New-MgDomainFederationConfiguration.
        • That users on the domain see a blank “choose a sign-in method” page and cannot access Microsoft 365/Power BI.
        • That the domain’s federated/managed flag can be toggled, but the federation configuration object is not addressable via Graph or MSOnline.
      • Ask for escalation to the Entra ID directory backend / data protection / engineering team to perform a backend purge or repair of the federation configuration for that domain.
    2. Use phone support to accelerate response
      • For critical auth outages, use the published global support phone numbers to reference the existing ticket and request urgent escalation. This is the same pattern used when a tenant is blocked or when the only global admin is locked out and backend intervention is required.
    3. Avoid repeated self-service attempts
      • Do not keep retrying New-MgDomainFederationConfiguration or other write operations; they will not clear an orphaned backend object and can complicate troubleshooting. As with inactive/blocked tenants, guidance is to avoid submitting multiple assistance requests and instead work through the existing case until a decision or fix is provided.
    4. Document current and intended federation state for support
      • Provide support with:
        • Current domain state (managed vs federated) and how it was last changed.
        • The intended final state (for example, federated with Google Workspace again, or permanently managed/cloud-auth).
        • Any prior federation metadata (IdP metadata XML, Issuer URI, etc.) if the goal is to restore federation.
      • This aligns with federation and migration guidance, where current federation settings are documented and used for rollback or repair.

    Given the symptoms and the lack of any documented remediation for an invisible-but-conflicting federation configuration, only Microsoft’s backend directory team can purge or fix the orphaned object. The practical next step is to push escalation on the existing ticket via phone support and, if necessary, open from a secondary tenant while referencing the original case.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.