Renewing Google Certificate in SAML Connections Where Google Is the IdP

In a connection where Microsoft authenticates users in Google as the central identity provider, you may be required to update the certificate since it has an expiration time.

To do this, follow these steps:

1. Access the Microsoft 365 app at https://admin.google.com/ac/apps/unified > Service provider details > Manage certificates
2. Delete the expired certificate if applicable, generate a new certificate, and download or copy it
3. Remove line breaks, as well as the lines -----BEGIN CERTIFICATE-----, -----END CERTIFICATE-----
4. In PowerShell, check if you have the updated Microsoft Graph module using:
   1. Install-Module Microsoft.Graph -Scope CurrentUser
   2. Update-Module Microsoft.Graph -Scope CurrentUser
5. Connect using:
   1. Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All"

6. Run the following lines in sequence; you can paste them all at once in PowerShell:

   $domain = "example.com"
   $rawCert = "PASTE_CLEANED_CERTIFICATE_HERE"
   $cleanCert = $rawCert.Replace("`n","").Replace("`r","").Replace(" ","")
   
   Get-MgDomainFederationConfiguration -DomainId $domain | ForEach-Object { Update-MgDomainFederationConfiguration -DomainId $domain -InternalDomainFederationId $_.Id -SigningCertificate $cleanCert }

7. Verify if the new certificate has been applied using:
   1. Get-MgDomainFederationConfiguration -DomainId "yourdomain.com" | Select-Object -ExpandProperty SigningCertificate
8. Returning to the Microsoft 365 app at https://admin.google.com/ac/apps/unified > Service provider details, make sure the new certificate is selected and saved
9. Access the Microsoft 365 app at https://admin.google.com/ac/apps/unified > Autoprovisioning, and perform the authorization or reauthorization process in App authorization
10. Test the integration using the TEST SAML LOGIN button