Key takeaway
Assess whether each application still needs AD FS. If it remains, secure the infrastructure; for migration, inventory applications, test them and prepare rollback steps.
What AD FS does
Active Directory Federation Services (AD FS) is Microsoft’s federated authentication service. It establishes trust between an organization’s Active Directory Domain Services directory and a separate application or partner. The user authenticates with the organization’s identity provider, and the application receives a token for its access decision, avoiding a separate password for each application. This can connect on-premises systems, partner portals and compatible cloud applications to one sign-in model.
Claims and token flow
AD FS issues a token, while the application makes its own authorization decision. The user’s password is not sent to the relying party.
Application directs sign-in
The relying-party application directs the user’s sign-in request to AD FS.
Claims provider authenticates
The configured claims provider authenticates the user and supplies claims; the default AD DS provider obtains domain-account attributes and authentication results.
Claims rules run in order
Acceptance-transform rules accept claims; issuance-authorization rules determine whether a token may be issued for that relying party; issuance-transform rules shape outgoing claims. AD FS signs the token.
Application validates token and access
The relying party validates the signature with a trusted key, issuer, audience and expiry, then enforces its own authorization policy.
Claims, certificates and application configuration
Claims rules can pass a username, group or other approved attributes to an application. Release only attributes needed for the application’s decision, review rule changes and test claim names and formats against application expectations. Token-signing certificates sign outgoing tokens; token-decryption certificates decrypt incoming encrypted tokens. Track expiry and renewal, and coordinate rollover with the relevant federation partners. Manage TLS/service communication certificates separately. Support for SAML, WS-Federation and OpenID Connect depends on the AD FS version and application integration.
When to retain AD FS or consider another option
AD FS may still be needed for on-premises identity control, a legacy application or a specific federation requirement. The organization then operates its servers, proxy tier, high availability, certificates, network boundaries and updates. A cloud identity service such as Microsoft Entra ID can reduce server operations in some federation scenarios, but application compatibility, hybrid dependencies, connectivity, licensing and recovery still need review. Decide whether to migrate or retain AD FS for each application and risk.
Plan a safe migration
Use Microsoft’s application-migration guidance to inventory AD FS relying parties, recent sign-ins, protocols, claims, provisioning and business owners. Group applications by compatibility and impact, and configure each in a test tenant. Check sign-in and sign-out, MFA/Conditional Access, user provisioning, certificates, mobile and remote access, and service flows. Record the starting configuration, pilot with users, assign owners for issues and move to production only after a tested rollback path is ready.