Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings Beta
Data as of 2 hours ago (9 September 2026)
Description
The federatedTokenValidationPolicy is a resource type in Microsoft Graph (beta) that governs the validation of federated authentication tokens and allows customers to configure a rule to block logins where internalDomainFederation does not match UPN domain. The feature by default requires manual configuration in the tenant to prohibit cross-domain logins. To strengthen security with cross-domain sign-in we will change the default rule for federatedTokenValidationPolicy to block logins where internalDomainFederation does not match UPN domain. This internalDomainFederation object is typically created automatically during federation setup with AD federation server or other IdPs.
Change history
Added to the roadmap 1 July 2026. Tracked here since 1 September 2026. Earliest target we recorded: August 2026 (since tracked — Microsoft may have moved it before we started watching).
- 2 September 2026 Description description updated