Error AADSTS50107 when trying ADFS Logon via SubDomain.

Hello

Thank you for your question and reaching out. I can understand you are having query\issues related to ADFS error.

This issue occurs for one of the following reasons:

The Issuance Transform rule is required to change the issuer from the default Active Directory Federation Service (AD FS) instance host name to the issuer set if the domain that's federated is missing.

The Issuance Transform rule is not updated after you add child domains.

SOLUTION

1. Go to Azure AD RPT Claim Rules, and then click Next. https://adfshelp.microsoft.com/AadTrustClaims/GenerateClaims
2. Specify the value for Immutable ID (sourceAnchor) -> User Sign In (for example, UPN or mail). If multiple top-level domains are federated, select Yes when you are prompted to respond to "Does the Azure AD trust with AD FS support multiple domains?"
3. Connect to the Microsoft 365 PowerShell, and then export the list of domains to a .csv file (for example, output.csv). To do this, run the following cmdlets:

Import-Module MSOnline

Connect-MsolService

Get-MsolDomain | Select-Object Name, RootDomain, Authentication | ConvertTo-Csv -NoTypeInformation | % {$_.Replace('"','')} | Out-File output.csv

4. Click Generate Claims, and then copy the PowerShell cmdlets from the Claim Rules section.
5. Save the cmdlets as a PowerShell script (for example, updatelclaimrules.ps1), and then run the following command to run the script on the primary AD FS server:

.\Updateclaims.ps1

6. The script makes a Backup of the existing Issuance Transform rules as a .txt file in the current working directory.

Reference :

https://free.blessedness.top/en-us/microsoft-365/troubleshoot/authentication/cant-sign-in-office-365-multiple-domain-federation

--If the reply is helpful, please Upvote and Accept as answer--

Check the AD UC user account properties if the account is not configured for AES 256 it will throw this error. Enable AES 256, rest password this will resolve this error.

Robert