I haven't quite gotten the grasp of relying party token-signing certificate's functionality with ADFS 2.0 / 3.0. Once the automatic self-signed certificate roll-over occurs (by default), there are scenarios where you have to manually deliver the new token-signing certificate to (usually) an external SSO application provider in order for them to place the new certificate on their end so the SSO will keep functioning.
However, this can happen automatically. The best I've found it explained here:
AD FS and self-signed Token-Signing certificates | Kloud Blog
[ADFS] ... can automatically renew self-signed certificates before expiry, and if a relying party trust is configured for automatic federation metadata updates, automatically provide the new public key to the relying party. This automation makes for a resilient, low maintenance federation service in that a key certificate used by the service does not require periodic attention.
The question is; how do I know if a relying party trust is configured for automatic federation metadata updates? Is this plain and simply this setting in the trust (thanks Google image search):
If so, how can I ensure that the update has been successful (besides possibly the 'last checked on' date) and the relying party has automatically gotten the new certificate or its public key?