Not able to log in via SAML using Azure AD SSO

Available Languages

Updated:September 30, 2026

Document ID:SPLK050369

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud , Splunk Enterprise

Description

Out the sudden the "Azure AD SSO" does not allow to sign in and get the error message:
"Verification of SAML assertion using the IDP's certificate provided failed. Error: failed to verify signature with cert":

Investigation

It is needed to review that the configuration as per:
Azure AD SSO integration with Azure AD SSO for Splunk Enterprise and Splunk Cloud

Due access to Splunk cloud is needed to review the settings,
Users can access with a local account by bypassing the authentication with this URL:
https://<your_stack>.splunkcloud.com/en-US/account/login?loginType=splunk

To review the certificates expiration:
Splunk Enterprise Users, can used the following search via CLI:

 openssl x509 -subject -issuer -noout -startdate -enddate -in /opt/splunk/etc/auth/idpCerts/idpCert.pem

Splunk Cloud users, will need to create a ticket for the internal team to review, due lack of access to the Splunk Cloud back end.

Output example:

openssl x509 -subject -issuer -noout -startdate -enddate -in /opt/splunk/etc/auth/idpCerts/idpCert.pem
subject=CN = Microsoft Azure Federated SSO Certificate
issuer=CN = Microsoft Azure Federated SSO Certificate
notBefore=Mar 13 13:28:37 2020 GMT
notAfter=Mar 13 13:28:37 2023 GMT

Resolution

As the Certificates are already expired the Azure AD admin will need to create new valid certificates, once done, download the Federation Metadata XML

Upload the new file to Splunk Settings > Authentication Methods > SAML settings > Configure SAML
The option to upload will be “Metadata XML File”, click apply and then save the changes.