"80041317" or "80043431" error when federated users sign in to Part 365, Azure, or Intune

  • Article
  • three minutes to read
  • Applies to:
    Deject Services (Web roles/Worker roles), Azure Active Directory, Microsoft Intune, Azure Backup, Part 365 Identity Management

Trouble

When a federated user tries to sign in to a Microsoft cloud service such equally Office 365, Microsoft Azure, or Microsoft Intune from a sign-in webpage whose URL starts with "https://login.microsoftonline.com/login," authentication for that user fails. Additionally, the user receives the following mistake message:

              Sorry, but we're having trouble signing yous in   Please endeavour once more in a few minutes. If this doesn't work, you might desire to contact your admin and written report the following error: 80041317 or 80043431

Cause

This event occurs when the configuration settings of the federated domain for the on-bounds Active Directory Federation Services (AD FS) service and for the Azure Active Directory (Azure AD) authentication system are mismatched. This causes the merits that the AD FS service supplies to be malformed and therefore rejected past the Azure AD authentication system.

Note

This can occur later the token-signing document is renewed on-premises without updating federation trust data.

To verify that this is the cause of the upshot that you're experiencing, follow these steps on a domain-joined estimator:

  1. Verify the mismatched aspect between the Advertising FS service and the Microsoft deject service. To do this, follow these steps:

    1. Click Starting time, click All Programs, click Microsoft Azure Active Directory, and then click Microsoft Azure Active Directory Module for Windows PowerShell.

    2. At the control prompt, type the post-obit commands. Brand certain that you printing Enter later y'all type each command:

                            $cred = become-credential

      Note

      When you're prompted, enter your deject service admin credentials.

                            Connect-MSOLService –credential:$cred                                          
                            Prepare-MSOLADFSContext –Estimator:<Advertizing FS ii.0 Server Proper noun>

      Note

      In this command, the placeholder <AD FS ii.0 Server Name> represents the Windows host name of the principal Ad FS server.

                            Get-MsolFederationProperty -domainname: <Federated Domain Proper name>

      Note

      In this command, the <Federated Domain Name> placeholder represents the name of the domain that'south already federated with the cloud service for single sign-on (SSO).

      Note

      The command output is divided into the post-obit two sections:

      • The first line of the first section reads "Source: AD FS Server" and represents the configuration that's stored in the local Advertizing FS service.
      • The start line of the second section reads "Source: <Microsoft cloud service>" and represents the configuration that's stored in the identity service.

      The output resembles the post-obit:

      Screenshot of output result after typing the commands.

  2. Compare the values of each aspect in the two sections to determine whether the values are mismatched. If the values are mismatched, the federated domain configuration has to exist updated.

Solution

To resolve this outcome, apply i of the following methods:

Method ane: Update the configuration of the federated domain

For more than data most how to do this, see the "How to update the configuration of the Office 365 federated domain" section in How to update or repair the settings of a federated domain in Office 365, Azure, or Intune.

Method ii: Repair the configuration of the federated domain

If method one doesn't resolve the issue, endeavour to repair the federated trust. For more information almost how to practice this, come across the "How to repair the configuration of the Office 365 federated domain" section in How to update or to repair the configuration of the Office 365 federated domain .

Method 3: Manually update the attributes by using the Azure Active Directory Module for Windows PowerShell

If methods 1 and ii don't resolve the event, try to manually update the mismatched attributes. In the Windows PowerShell connectedness that you used to diagnose the issue, run the advisable cmdlet from the following table:

Mismatched attributes Error code Command to update attribute Notes
FederationServiceIdentifier 80043431 Prepare-MSOLDomainFederationSettings -domain name <Domain.suffix> -issueruri <newURI> The placeholder <Domain.suffix> represents the federated domain proper name. The placeholder <newURI> represents the URI value of the on-premises FederationServiceIdentifierattribute (listed first in the output of the Go-MsolFederationProperty cmdlet).

Notwithstanding need aid? Go to Microsoft Community or the Azure Agile Directory Forums website.