Troubleshooting

Windows MDM setup issue with custom domain

Windows MDM setup issue with custom domain

What

When configuring FileWave Windows MDM with Microsoft Entra ID, the Microsoft On-premises MDM application may fail when you add the FileWave server URL in Expose an API as the Application ID URI.

Error: Failed to update Application ID URI application property. Error detail: The Application ID URI must be from a verified domain within your organization’s directory.

This usually happens when the FileWave server URL uses a hostname that is not under a domain verified in the customer’s Microsoft Entra tenant, such as a FileWave-owned hosted hostname.

Why this happens

Microsoft changed Application ID URI validation for single-tenant applications effective October 15, 2021. When a new Application ID URI is added, or an existing one is updated, Microsoft Entra validates that the host name in an HTTPS URI belongs to the tenant’s initial onmicrosoft.com domain or to a verified custom domain in that tenant.

The general Microsoft rule also allows supported api:// Application ID URI formats. That exception does not solve this FileWave Windows MDM case because the Microsoft On-premises MDM app setup expects the FileWave server URL to be used in the configuration.

Configurations created before Microsoft enforced this rule can continue to work as long as the existing Application ID URI is not changed. New configurations, or edits to the URI on an existing app, are validated against the current rule.

What this means for FileWave Windows MDM

Customer-owned domain: If the FileWave server is available at a hostname under a domain the customer controls, such as filewave.example.org, verify that domain in Microsoft Entra and use that hostname for the Windows MDM configuration.
FileWave-hosted server on a FileWave-owned hostname: A hostname such as a filewave.net address is owned by FileWave, not by the customer’s Microsoft Entra tenant. The customer cannot verify FileWave’s domain in their tenant, so that hostname cannot be used as the Application ID URI for a new Windows MDM setup.
Grandfathered setup: If Windows MDM was configured before the October 2021 Microsoft change and is still working, avoid changing the Application ID URI until you are ready to move the FileWave server URL to a verified customer-owned domain.

How to fix it

Choose a FileWave server hostname under a domain the customer owns or can verify in Microsoft Entra, for example filewave.example.org.
Add and verify the domain in Microsoft Entra: Add your custom domain name to your tenant.
If the server is FileWave-hosted, work with FileWave Support to configure the hosted server for the customer-owned custom hostname and SSL certificate handling. See SSL Certificate Management for Custom Domains (FileWave-Hosted Servers).
Use the verified custom-domain hostname when configuring the Microsoft On-premises MDM application for FileWave Windows MDM.
After the Microsoft Entra app configuration is saved, continue with the FileWave Windows MDM setup and verify enrollment with a test user/device before rolling it out broadly.