Description
The signing certificate from Entra ID is only valid for a set period of time; three years by default. Jamf Pro will warn you when the certificate is close to expiring and you need to get a new certificate from Entra ID and upload the metadata URL or file to Jamf Pro.
In Jamf Pro you might see something similar to the notification below:
⚠️ Before making any changes to your SAML settings - be sure you know your failover URL and a set of local Jamf Pro credentials with admin rights if your organization uses SAML SSO for administrators logging in to Jamf Pro.
Renew Certificate in Entra ID
Jamf Pro has the option to use the metadata file or metadata URL. This article provides steps with the metadata URL.
Navigate to entra.microsoft.com and log in with an administrator account.
In the left menu navigate to Applications → Enterprise Applications. Select your Jamf Pro application.
Select Single Sign-On within the application view.
In section 3 "SAML Certificates," select the Edit button in the upper right corner.
Click + New Certificate.
Keep the Expiration Date, Signing Option, and Signing Algorithm to the default values.
Click Save.
On the new certificate, select the ellipses (…) on the right column and select Make certificate active.
Click Yes on the "activating your certificate" prompt.
(Optional) Select the ellipses (…) on the expiring certificate and select the option to Delete Certificate. Click Yes on the "You are about to delete a certificate" prompt.
If you do not remove the old certificate from Entra ID, the old certificate will continue to be presented until it expires and the notification will not clear.
Click the X in the upper-right corner to close the SAML Signing Certificate pane.
Return to Section 3 "SAML Certificates" and copy the "App Federation Metadata URL" with the icon at the right end of the URL.
Renew Metadata URL in Jamf Pro
In Jamf Pro, navigate to Settings > System > Single Sign-On.
Select Edit on the single sign-on settings page in the lower-right corner.
Scroll to the section titled "Identity Provider Metadata Source." If set to Metadata File switch to Metadata URL.
Paste the value of the 'App Federation Metadata URL' from Entra into this field.
Click Save.
Note: The updated certificate may be delayed in becoming active. It should update the Entra servers within 3-5 minutes of making changes.