Skip to content

Clarify preferredTokenSigningKeyThumbprint property #10020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jsoveral wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Clarify preferredTokenSigningKeyThumbprint property #10020

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion api-reference/beta/api/serviceprincipal-update.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ In the request body, supply the values for relevant fields that should be update
|publishedPermissionScopes|[permissionScope](../resources/permissionScope.md) collection|The OAuth 2.0 permissions exposed by the associated application. For more information, see the **oauth2PermissionScopes** property definition on the [application](../resources/application.md) resource. Not nullable. |
|preferredSingleSignOnMode|string|Specifies the single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Microsoft Entra My Apps. The supported values are password, saml, external, and oidc.|
|preferredTokenSigningKeyEndDateTime|DateTimeOffset|Specifies the expiration date of the keyCredential used for token signing, marked by **preferredTokenSigningKeyThumbprint**.|
|preferredTokenSigningKeyThumbprint|String|Reserved for internal use only. Don't write or otherwise rely on this property. May be removed in future versions. |
|preferredTokenSigningKeyThumbprint|String|Thumbprint of the keyCredentials certificate used to sign SAML tokens for this service principal; set with useCustomTokenSigningKey = true to activate or roll over the SAML SSO signing certificate.|

@JarbasHorst Jarbas Horst (JarbasHorst) Aug 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello jsoveral, for clarity and alignment with the Microsoft Graph docs standards. Please update the description. Suggested revision:

Suggested change
|preferredTokenSigningKeyThumbprint|String|Thumbprint of the keyCredentials certificate used to sign SAML tokens for this service principal; set with useCustomTokenSigningKey = true to activate or roll over the SAML SSO signing certificate.|
|preferredTokenSigningKeyThumbprint|String|The thumbprint of the **keyCredentials** certificate used to sign SAML tokens for this service principal. To activate or roll over the SAML sign-on (SSO) signing certificate, set this property when **useCustomTokenSigningKey** is set to `true`.|

|publisherName|String|The display name of the tenant in which the associated application is specified.|
|replyUrls|String collection|The URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application. Not nullable. |
|samlSingleSignOnSettings|[samlSingleSignOnSettings](../resources/samlsinglesignonsettings.md)|The collection for settings related to saml single sign-on.|
Expand Down