AD FS Azure MFA — "Exception calling SAS" — Production Outage

Environment: AD FS Farm Behavior Level 4 (Server 2016), Federated to M365/Entra ID

Problem

All M365 browser sign-ins fail after primary auth with:

Exception calling SAS

AD FS successfully authenticates the user (password), then fails when invoking the AzureMfaAuthentication adapter to call Azure MFA.

What we've ruled out

• Not browser/cookie related (tested InPrivate, multiple browsers)
• Not device auth (disabled via Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $false)
• Adapter shows as enabled, Get-AdfsAzureMfaConfigured = True
• Token signing cert is valid and not expired
• Persists regardless of Authentication Methods migration state ("Complete" or "In Progress")

Notable finding: Get-AdfsAzureMfaTenantCertificate throws CommandNotFoundException — suspected token signing cert trust model, not legacy tenant cert model.

Suspected cause

Token signing cert rolled over but Entra still has the old thumbprint registered, causing SAS to reject the request. Alternatively, federation metadata is out of sync with Entra.

Question

Has anyone resolved Exception calling SAS on AD FS 2016, and is Update-MgDomainFederationConfiguration the right fix to resync federation metadata?