Error message after you run the MOSDAL Support Toolkit: "There was no response from the federation server when the tool attempted to retrieve a Metadata Exchange (MEX) document"

Article translations Article translations
Article ID: 2707336 - View products that this article applies to.
Expand all | Collapse all

PROBLEM

After you run the Microsoft Online Services Diagnostics and Logging (MOSDAL) Support Toolkit, the Active Directory Federation Services (AD FS) diagnostics log contains the following error message:

There was no response from the federation server when the tool attempted to retrieve a Metadata Exchange (MEX) document.

Note The AD FS diagnostics log is located at \Admin_Applications\SSO_Diagnostic_Tests\ADFSDiagnostic.txt.

Additionally, you may notice one of the following symptoms when you sign in to your Microsoft cloud service such as Office 365, Microsoft Azure, or Windows Intune by using a federated account:
  • "Page not found" error when you connect to AD FS
  • Certificate warning when you connect to AD FS

CAUSE

This issue may occur if one of the following conditions is true:
  • Service problems with AD FS limit access
  • Problems exposing AD FS to the Internet through reverse proxy limits access.
  • AD FS MEX address changes not made to the Azure Active Directory (Azure AD) authentication system
  • Secure Sockets Layer (SSL) certificate problems with the AD FS service
  • Faulty DNS configuration that causes incorrect name resolution of AD FS endpoints

SOLUTION

To resolve this issue, use one of the following methods, as appropriate for your situation.

Method 1: Troubleshoot AD FS connectivity

Troubleshoot AD FS service problems that might limit connectivity by using the following Microsoft Knowledge Base article:
2419389 Internet browser can't display the AD FS webpage when a federated user tries to sign in to Office 365, Azure, or Windows Intune  

Method 2: Troubleshoot AD FS Proxy server functionality

If the sign-in problems that are described earlier only occur when you are connected to AD FS from outside the on-premises network, use the following Microsoft Knowledge Base article to troubleshoot AD FS Proxy service problems that might limit connectivity:
2712961 How to troubleshoot AD FS endpoint connection issues when users sign in to Office 365, Windows Intune, or Azure  

Method 3: Update the AD FS service metadata to Azure AD

If the sign-in problems that are described earlier begin to occur after the service name of the AD FS Federation service farm is changed, the new MEX endpoint address must be updated in Azure AD. To do this, use the "How to update the configuration of the Office 365 federated domain" of the following Microsoft Knowledge Base article:  
2647048 How to update or repair the settings of a federated domain in Office 365, Azure, or Windows Intune   

Method 4: Troubleshoot AD FS SSL certificate problems

If a sign-in attempt to the cloud service results in a certificate warning from the AD FS server, use the following Microsoft Knowledge Base article to troubleshoot SSL certificate problems:
2523494  You receive a certificate warning from AD FS when you try to sign in to Office 365, Azure, or Windows Intune

Method 5: Troubleshoot split-brain DNS problems for AD FS service name resolution

To troubleshoot split-brain DNS configuration problems with the on-premises network, use the following Microsoft Knowledge Base article:
2715326 Split-brain DNS misconfiguration prevents seamless SSO sign-in experience

MORE INFORMATION

Still need help? Go to the Office 365 Community website or the Azure Active Directory Forums website.

Properties

Article ID: 2707336 - Last Review: July 9, 2014 - Revision: 19.0
Applies to
  • Microsoft Azure
  • Microsoft Office 365
  • Windows Intune
  • CRM Online via Office 365 E Plans
  • Microsoft Azure Recovery Services
  • Office 365 Identity Management
Keywords: 
o365 o365a mosdal4.5 o365m o365e o365022013 KB2707336

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com