Problem
Microsoft 365 SSO through the UCS portal fails for some users with:
AADSTS5000820: Sign-in blocked by Federated Token Validation policy. Contact your administrator for details.
This can affect Microsoft Entra tenants where the root domain of the federation used for authentication differs from the root domain of the user’s Entra UPN.
Investigation
Check whether the affected user’s UPN root domain differs from the root domain associated with the federation used for the login.
Microsoft documents AADSTS5000820 as the expected error when its Federated Token Validation policy blocks such a cross-domain federated login:
Root Cause
Microsoft Entra introduced stricter federated token validation. When enabled, Entra compares the root domain associated with the incoming federated token with the root domain of the mapped user’s UPN.
If these root domains differ, the login is rejected.
The UCS Microsoft 365 integration currently does not automatically configure separate federation settings for all custom UPN root domains used in such a setup.
Solution
As a workaround, Microsoft allows the additional root-domain validation to be disabled by setting rootDomains to none in the tenant’s federatedTokenValidationPolicy.
The policy is currently available through the Microsoft Graph /beta API and must be updated using PUT, not PATCH:
PUT https://graph.microsoft.com/beta/policies/federatedTokenValidationPolicy
Content-Type: application/json
{
"@odata.type": "#microsoft.graph.federatedTokenValidationPolicy",
"validatingDomains": {
"@odata.type": "#microsoft.graph.allDomains",
"rootDomains": "none"
}
}
Microsoft documents the API here:
After applying the policy, retry the affected Microsoft 365 SSO login.
This is a workaround rather than a permanent solution. Setting rootDomains to none disables the additional domain-consistency security check introduced by Microsoft. Microsoft therefore recommends using less restrictive validation only when the cross-domain authentication scenario is intentionally required and appropriate compensating security controls are in place.
A product-side solution that supports multiple custom UPN root domains without disabling this additional validation is being investigated.