A company is using Office 365 with ADFS authentication; AD Connect is used for directory synchronization, ADFS is the Windows server 2012 R2 version.
The company has multiple Active Directory domains:
parent1.com child1.parent1.com child2.parent1.com child3.parent1.com parent2.com ... ...
The root domains are configured as federated domains in Office 365 (the public domain names and the AD domain names are identical); this works fine, users can login to Office 365 using their UPN, such as
firstname.lastname@example.org, and their AD password.
I need to add support for child domains; thus I added
child1.parent1.com to Office 365 by running the following command (after connecting to Office 365 with an admin account using
New-MsolFederatedDomain -DomainName child1.parent1.com -SupportMultipleDomain
(N.B. If I didn't use the
SupportMultipleDomain parameter, PowerShell would give an error stating it was required).
Then I proceeded to add all required DNS records, both in the private and public DNS; Office 365 validation of DNS records reported everything was ok.
The child domain was then added to AD Connect, and synchronization was performed; users from the child domain thus appeared in Office 365, with usernames such as
email@example.com. I assigned appropriate licenses to them and tried to login to the Office 365 portal.
However, users for the child domain are unable to login; they receive an "invalid request" error, with the following additional details:
Correlation ID: b1e47d45-b21c-42e9-9758-265804db7171 Timestamp: 2016-08-10 20:27:48Z AADSTS50107: Requested federation realm object 'http://child1.parent1.com/adfs/services/trust/' does not exist.
There's obviously something wrong on the ADFS side, but I'm not an expert on it and I also wasn't the one who set it up; how can I fix this so that users in child domains can successfully login to Office 365?