When an enterprise SAP SAML token signing certificate reaches its expiration date, entire lines of business freeze instantly: finance, logistics, and supply chain users are locked out of SAP GUI for HTML, Fiori Launchpad, and NetWeaver portals with error "SAML 2.0 Authentication Failed (Invalid Signature)".
The Critical Trap: Hard Cutover vs Overlapping Certificates
In Microsoft Entra ID Enterprise Applications, never replace an active SAML signing certificate during peak business hours with a hard cutover. Entra ID supports maintaining a secondary active certificate in parallel, allowing SAP Basis administrators to import the new public key into transaction
STRUST prior to activating it.
PowerShell Automated SAML Signing Certificate Expiry Monitor
# ==============================================================================
# Entra ID Enterprise App SAML Certificate Expiry Scanner
# ==============================================================================
Connect-MgGraph -Scopes "Application.Read.All" -NoWelcome
$apps = Get-MgServicePrincipal -All -Filter "tags/any(c:c eq 'WindowsAzureActiveDirectoryGalleryApplicationNonConsented')"
foreach ($app in $apps) {
foreach ($cert in $app.KeyCredentials) {
$expiry = $cert.EndDateTime
$daysLeft = ($expiry - (Get-Date)).Days
if ($daysLeft -lt 30) {
Write-Warning "URGENT: SAP/Enterprise App [$($app.DisplayName)] SAML Certificate expires in $daysLeft days ($($expiry.ToString('yyyy-MM-dd')))"
}
}
}
