Fix: CRM Dynamics 365 Claims Relying Party Error

You may receive an error after attempting single sign-on using Active Directory Federation Services (ADFS) to your Microsoft Dynamics 365 CRM application. The error is displayed below.

 

 

These are possible reasons for the error above.

1. Check to see if your certificate was listed as revoked by your Certificate Authority (CA). At times certificates in use by a party are compromised. Once this is communicated to the certification authority, they will declare this certificate as "revoked". The certification authority such as GoDaddy, cannot go to each and every client who uses this certificate to communicate to servers or verify digital signatures. Therefore, the CA will update a central CRL - certificate revocation list published via the internet.

Run the following command in Powershell to disable revocation checks for your encryption certificate.

 

Set-AdfsRelyingPartyTrust –TARGETNAME “<displaynameOfCRMRelyingParty>” –EncryptionCertificateRevocationCheck “None”

 

 

2. Verify your ADFS claim rules in ADFS -> Relying Party Trust -> Edit Rules. In addition, check your authentication policies in ADFS -> Authentication policies if form authentication is enabled or not.

You can also check if a certificate for CRM has expired. This link walks you through how to delete an old Microsoft CRM certificate.