Graph gives server error 500 - need help switching domain to federated IdP

Describe the bug
I have a domain safetynet.social I'd like to switch to federated SAML IdP service
I cannot use MsoL powershell anymore (deprecated) so turned to advised Graph method

Logged into Graph with Global Administrator account for the tenant.

Run this query:

PATCH https://graph.microsoft.com/beta/domains/domainname.me

Headers:
Content-Type | application/json

As payload (cert is online string)
{
"authenticationType": "Federated",
"federationConfiguration": [
{
"issuerUri": "https://login.safetynet.social/saml/idp",
"passiveSignInUri": "https://login.safetynet.social/saml/sso",
"signOutUri": "https://login.safetynet.social/saml/logout",
"signingCertificate": "MIIDKTCCAhGgAwIBAgIUQHuBaG58Y28VwfxmAFfEYWUd2NMwDQYJKoZIhvcNAQELBQAwJDEiMCAGA1UEAwwZc2FtbC1pZHAuc2FmZXR5bmV0LnNvY2lhbDAeFw0yNTEyMzExMTAxNTJaFw0yNzEyMzExMTAxNTJaMCQxIjAgBgNVBAMMGXNhbWwtaWRwLnNhZmV0eW5ldC5zb2NpYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDYpBmv5bivyp5yWKiXyXgZKWgc0oaUOy7wqooj28YK68nxteAPezZqy3H4bt11tFJdtWECJhcppF2BkHea+dZRnvIQCTKjt+7a3h/AXfM0oZ0noK5IYahaKf9hpZEfGnG4Mcl9HoSyLl6oNbV4s9RohovJ0bxW35yRGVhBzlqqdFnyHSMlZHfReb7Gf2kfAgQ5rWHD5dJ8zXINGanPW0GgfucX4i9aUSYkEWo2gVL46gon6KEeXkZl75ID8Lp6oJxejq0i/tie87mXoZc5zQTO2812PnDkn2bXiNDHJpQhjensNWr96RgfauemnormoIxdZJBkAH10MVjvfyOLfvyZAgMBAAGjUzBRMB0GA1UdDgQWBBQ99Go4kPyehZz1anKJ+ml6v7iflTAfBgNVHSMEGDAWgBQ99Go4kPyehZz1anKJ+ml6v7iflTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCQzWJuas9zwIl0qs6At/SDUxZFU4CWeuD1qdGNJX21tvoECrGNmXdxNEhBAzDFEiNlgnfztjhiQQDBa3w4gjIvV7du7v5r2KUqC1eIT88LnGB+YIZToAA8CS/S8nEg3b2nxc5WkUbXz8ABt4cnuEh9h9HAKlL3JoxZJX0UG+Hc8cdLiNV+8dVTA7iBcYaicpJT/D1rrlFa2soqSKTYIffBMmtwMHJqFbyEVdfha/FA7M0t+J0VQhNnA7gYPkqYewcRPALKcia6K/7EZjgX3GdbOONU5vobnPSVMM0mbTeH/LAq8ZyTGZQUtcEf5uCqzl3ldQfqItwQr9U7COW1iWvr",
"preferredAuthenticationProtocol": "saml"
}
]
}

Results in:
{
"error": {
"code": "Service_InternalServerError",
"message": "Encountered an internal server error.",
"innerError": {
"date": "2026-01-05T09:49:02",
"request-id": "0d68fa86-d916-4b7f-b51c-da8a56e48f70",
"client-request-id": "3f59a3c1-8eef-a3d6-e942-94d0967a7566"
}
}
}

To Reproduce

Expected behavior
Set domain to federated using the configured details

Any help achieving the desired goal is appreciated

Start with the reported PATCH /beta/domains/domainname.me request, its federationConfiguration payload, and the request and client IDs from the error. Reproduce the response in Graph Explorer, then determine whether the failure is handled by this explorer or by the Microsoft Graph service; done means a confirmed cause and actionable guidance or a clearly scoped fix.