When the ELMO SSO certificate expires
Azure > enterprise apps > QAL -ELMO > Single Sign-On > SAML Certificates > + new certificate > make active > save
You will need to book a time with ELMO when you do it as they need to refresh the metadata URL once you activate certificate.