COMMAND EVERYTHING.

Set-AdfsRelyingPartyTrust

Sets the properties of a relying party trust.

Active Directory · Risk: High · Documentation Verified

Last verified: 2026-10-26

Microsoft ADFS reference: Sets the properties of a relying party trust. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Set-AdfsRelyingPartyTrust [-AllowedAuthenticationClassReferences <String[]>] [-Name <String>]
 [-NotBeforeSkew <Int32>] [-EnableJWT <Boolean>] [-Identifier <String[]>]
 [-EncryptionCertificate <X509Certificate2>] [-EncryptionCertificateRevocationCheck <String>]
 [-EncryptClaims <Boolean>] [-MetadataUrl <Uri>] [-IssuanceAuthorizationRules <String>]
 [-IssuanceAuthorizationRulesFile <String>] [-DelegationAuthorizationRules <String>]
 [-DelegationAuthorizationRulesFile <String>] [-ImpersonationAuthorizationRules <String>]
 [-ImpersonationAuthorizationRulesFile <String>] [-IssuanceTransformRules <String>]
 [-IssuanceTransformRulesFile <String>] [-AdditionalAuthenticationRules <String>]
 [-AdditionalAuthenticationRulesFile <String>] [-AccessControlPolicyName <String>]
 [-AccessControlPolicyParameters <Object>] [-AutoUpdateEnabled <Boolean>] [-WSFedEndpoint <Uri>]
 [-AdditionalWSFedEndpoint <String[]>] [-ClaimsProviderName <String[]>] [-MonitoringEnabled <Boolean>]
 [-Notes <String>] [-ClaimAccepted <ClaimDescription[]>] [-SamlEndpoint <SamlEndpoint[]>]
 [-ProtocolProfile <String>] [-RequestSigningCertificate <X509Certificate2[]>]
 [-EncryptedNameIdRequired <Boolean>] [-SignedSamlRequestsRequired <Boolean>] [-SamlResponseSignature <String>]
 [-SignatureAlgorithm <String>] [-SigningCertificateRevocationCheck <String>] [-TokenLifetime <Int32>]
 [-AlwaysRequireAuthentication <Boolean>] [-AllowedClientTypes <AllowedClientTypes>]
 [-IssueOAuthRefreshTokensTo <RefreshTokenIssuanceDeviceTypes>] [-RefreshTokenProtectionEnabled <Boolean>]
 [-RequestMFAFromClaimsProviders <Boolean>] -TargetName <String> [-PassThru] [-WhatIf] [-Confirm]
 [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Set-AdfsRelyingPartyTrust. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / ADFS · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-AccessControlPolicyName: Specifies the name of an access control policy.
-AdditionalAuthenticationRules: Specifies the additional authorization rules to require additional authentication based on user, device and location attributes after the completion of the first step of authentication. Note: These rules must only be configured after there is at least one authentication provider enabled for additional authentication.
-AdditionalAuthenticationRulesFile: Specifies a file that contains the additional authentication rules to require additional authentication when a user is attempting to access this relying party.
-AdditionalWSFedEndpoint: Specifies an array of alternate return addresses for the application. This is typically used when the application wants to indicate to AD FS what the return URL should be on successful token generation. AD FS requires that all acceptable URLs are entered as trusted information by the administrator.
-AllowedClientTypes: Specifies allowed client types. The acceptable values for this parameter are: - None - Public - Confidential
-AlwaysRequireAuthentication: Indicates to always require authentication.
-AutoUpdateEnabled: Indicates whether changes to the federation metadata by the *MetadataURL* parameter apply automatically to the configuration of the trust relationship. If this parameter has a value of $True, partner claims, certificates, and endpoints are updated automatically. Note: When auto-update is enabled, fields that can be overwritten by metadata become read only.
-ClaimAccepted: Specifies an array of claims that this relying party accepts.
-ClaimsProviderName: Specifies an array of claims provider names.
-Confirm: Prompts you for confirmation before running the cmdlet.
-DelegationAuthorizationRules: Specifies the delegation authorization rules for issuing claims to this relying party.
-DelegationAuthorizationRulesFile: Specifies a file that contains the delegation authorization rules for issuing claims to this relying party.
-EnableJWT: Indicates whether the JSON Web Token (JWT) format should be used to issue a token on a WS-Federation request. By default, SAML tokens are issued over WS-Federation.

Prerequisites

Windows with the ADFS module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

Example 1: Set the name and identifier for a relying party trust

Set-AdfsRelyingPartyTrust -TargetName "FabrikamApp" -Identifier "https://FabrikamApp.CentralServerNew.org"

This command sets the name and identifier for the specified relying party trust. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/ADFS/Set-AdfsRelyingPartyTrust.md

https://learn.microsoft.com/powershell/module/adfs/set-adfsrelyingpartytrust?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands

Get-ADComputer

Get-ADGroup

Get-ADGroupMember

Get-ADPrincipalGroupMembership