Error message when you try to sign in to the Microsoft Online Portal as a federated user

Problem exists for all users

Step 1: Verify firewall settings

If you have a firewall that supports the following features, make sure that these features are disabled.

• Link translation (For more information, see http://technet.microsoft.com/en-us/library/cc995120.aspx.)
• Verify normalization (For more information, see http://technet.microsoft.com/en-us/library/cc995081.aspx.)
• Block high bit characters (For more information, see http://technet.microsoft.com/en-us/library/cc995081.aspx.)

Note This step applies to Forefront Threat Management Gateway (TMG) server. However, be aware that other firewall servers may also support these features.

Step 2: Update federation settings for the federated domain

1. Start the Microsoft Online Services Identity Federation Management tool from the desktop on the computer on which it was installed.
2. At the Windows PowerShell prompt, type the following, and then press Enter:
   
   $cred=Get-Credential
   
3. When you are prompted, type your Office 365 Global Administrator account.
4. At the Windows PowerShell prompt, type the following, and then press ENTER:
   
   Set-MSOLContextCredential -MSOLAdminCredentials $cred
   
5. Run the following Update-MSOLFederatedDomain cmdlet:
   
   Update-MSOLFederatedDomain �DomainName yourdomain.com

Step 3: Repair the Relying Party Trust entity

1. Click Start, click Control Panel, point to Administrative Tools, and then click AD FS 2.0 Management.
2. Locate Trust Relationships, select Relying Party Trusts, and then click Delete to remove the Relying Party Trust entry.
3. Start the Microsoft Online Services Identity Federation Management tool from the desktop on the computer on which it was installed.
4. At the Windows PowerShell prompt, type the following, and then press ENTER:  

$cred=Get-Credential

5. When you are prompted, type your online administrator account.
6. At the Windows PowerShell prompt, type the following, and then press ENTER: 

Set-MSOLContextCredential -MSOLAdminCredentials $cred

7. Run the Add-MSOLFederatedDomain cmdlet to re-create the federation trust.
   Note If your domain is already configured as an online federated domain, you receive an error. However, this Windows PowerShell cmdlet re-creates the required AD FS entries, such as the following:
• Relying Party Trusts = Microsoft Federation Gateway
• Issuance Transform Rules = two rules created
8. Run the Update-MSOLFederatedDomain cmdlet.

Problem exists for one or some users

Step 1: Check whether the user's proxy addresses contains non-ASCII characters

Review the user's on-premises proxy addresses for non-ASCII characters.  If non-ASCII characters are found, update the proxy address for the user to only contain ASCII characters.

For more information about ASCII characters, see the following website: http://www.asciitable.com

Step 2: Resolve a changed user principal name (UPN) or SAM Account name situation for the problem user 

After a user signs in to Office 365, the sign-in information may be cached on the AD FS server. When the user principal name (UPN) or the Security Accounts Manager (SAM) account of the user is changed, problems may occur the next time that the user tries to access Office 365 services.  There are some steps that can be taken to resolve this issue.

1. Verify that the UPN changes are synchronized to Office 365 through directory synchronization.
2. Have the user log off the computer and then log back on.
3. If steps 1 and 2 do not resolve the issue, restart the AD FS server. Or, follow these steps:
1. Open Registry Editor, and then locate the following subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
2. Right-click the LSA subkey folder, select New, and then select DWORD Value.
3. Type LsaLookupCacheMaxSize, and then press Enter.
4. Right-click LsaLookupCacheMaxSize, and then click Modify.
5. In the Value data box, type 0, and then click OK.
6. Exit Registry Editor.

Note LsaLookupCacheMaxSize can affect sign-in performance. Therefore, we recommend that you delete LsaLookupCacheMaxSize when the issue is resolved.