Active Directory · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft ADFS reference: Registers an OAuth 2.0 client with AD FS. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Add-AdfsClient. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / ADFS · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-ADUserPrincipalName
Specifies an Active Directory user principal name.
-ClientId (required)
Specifies the cliend ID.
-ClientType
Specifies the client type. The acceptable values for this parameter are: - Public - Confidential
-Confirm
Prompts you for confirmation before running the cmdlet.
-Description
Specifies a description.
-GenerateClientSecret
Indicates whether to generate a client secret.
-JWTSigningCertificateRevocationCheck
The acceptable values for this parameter are: - None - CheckEndCert - CheckEndCertCacheOnly - CheckChain - CheckChainCacheOnly - CheckChainExcludeRoot - CheckChainExcludeRootCacheOnly
-LogoutUri
Specifies the logout URI for the OAuth 2.0 client to register with the AD FS. When AD FS initiates a logout it redirects the client's user-agent to this URI by rendering this URI in an iframe. The value of this parameter must be an absolute URI, may include a query component, and must not include a fragment component. This parameter is available with the Windows Update KB4038801 installed.
-Name (required)
Specifies a name.
-PassThru
Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
-RedirectUri
Specifies one or more redirection URIs. The cmdlet modifies the OAuth 2.0 client registration information with the redirection URIs that you specify. The OAuth 2.0 client uses the redirection URI when the client requests authorization to access a resource secured by AD FS. You may register multiple redirection URIs for a single client identifier. The redirection URI must be a valid URI. The redirection URI specified by the client must already be registered with AD FS and must correspond to the client identifier for that OAuth 2.0 client, in order for the client to be authorized to access the resource. If the client ID and redirection URI correspond to a pre-registered OAuth 2.0 client and the resource owner authorized access by providing their credentials, AD FS will deliver the authorization code or access token by redirecting the client's user-agent back to this redirection URI. Ensure that the value of the RedirectUri parameter matches exactly the redirection URI that will be specified by the OAuth 2.0 client when requesting authorization, including trailing slashes (/), if required. Use more secure schemes, such as https, when you specify a redirection URI. [!NOTE] > Starting with the October 2026 update, AD FS requires an exact match for the OAuth redirect_uri parameter, in accordance with RFC 6749, section 3.1.2.3. > Redirection URIs containing wildcard characters, such as https://*.hostname/path, are accepted during registration without an error but will not match OAuth redirect_uri validation at runtime. > Wildcard entries that previously matched through prefix matching will now be silently skipped, resulting in error MSIS9224 (Event ID 364) when no other registered URI exactly matches the requested redirection URI. > Register a separate redirection URI for each specific hostname instead of using a wildcard. For Windows Store applications that authenticate usi
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Prerequisites
Windows with the ADFS module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
This command registers an OAuth 2.0 client with AD FS by using a client identifier, redirection URI, name, and description. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.