Sign up for Office 365
Learn more about Office 365
Currently, Microsoft Office 365 customers who utilize single sign-on (SSO) through AD FS 2.0 and have multiple top level domains for users' user principal name (UPN) suffixes within their organization (for example, @contoso.com or @fabrikam.com) are required to deploy a separate instance of AD FS 2.0 Federation Service for each suffix. There is now a rollup for AD FS 2.0 (http://support.microsoft.com/kb/2607496) that works in conjunction with the “SupportMultipleDomain” switch to enable the AD FS server to support this scenario without requiring additional AD FS 2.0 servers.
It is important to note that the “SupportMultipleDomain” switch is not required when you have a single top level domain and multiple sub domains. For example if the domains used for upn suffixes are @sales.contoso.com, @marketing.contoso.com and @contoso.com and the top level domain (contoso.com in this case) was added first and federated then you don’t need to use the “SupportMultipleDomain” switch. This is because these sub domains are effectively managed within the scope of the parent and a single AD FS server can be utilized to handle this already.
If however, you have multiple top level domains (@contoso.com and @fabrikam.com) and these domains also have sub domains (@sales.contoso.com and @sales.fabrikam.com) the “SupportMultipleDomain” switch will not work for the sub domains and these users will not be able to login. We are working on a solution for this problem and will post this as soon as it is ready until then we can't support this solution.
If you currently have an AD FS 2.0 server that is configured to support a single domain or you have multiple AD FS 2.0 servers, one for each federated top level and want to move to a single server or add more domains to an existing server the following procedure will help you with that process.
NOTE: During this process customers will be unable to authenticate for a few minutes while the trust is being recreated.
If you have more top level domains on other servers then run Update-MsolFederatedDomain -DomainName <domain> -SupportMulitpleDomain on the server above, once you have confirmed the update you can decommission the other servers. If you are simply adding more top level domains then use the standard procedures to add a new domain or convert an existing domain, remembering to use the -SupportMulitpleDomain as you add or convert the domains.
There are mulitple typos in the parameter "SupportMulitpleDomain", should obviously be "SupportMultipleDomain" :)