Home / Azure

AzureRunbookAdvanced

Transformation: move from AD FS federation to Entra ID cloud authentication

Retire AD FS by moving Microsoft 365 and Azure sign-in to password hash sync or pass-through authentication. Migrate relying-party apps, test with staged rollout, convert the domain and decommission farm servers safely.

Deepak Bhardwaj3 min read

Applies toMicrosoft Entra ID, Microsoft Entra Connect Sync / Cloud Sync, AD FS 2016+

Why move

AD FS farms need servers, certificates, WAP proxies and patching, and an AD FS outage blocks every cloud sign-in. Cloud authentication gives you Entra ID protections (Conditional Access, risk-based sign-in, passwordless) with less infrastructure.

1. Choose the method

Method Notes
Password hash sync (PHS) Simplest, most resilient; enables leaked credential detection. Recommended default
Pass-through authentication (PTA) Validates against on-prem AD via agents; needs agents to be healthy

Many teams enable PHS even with PTA as a backup sign-in method.

2. Inventory what AD FS does today

Get-AdfsRelyingPartyTrust | Select-Object Name, Enabled, Identifier | Sort-Object Name
Get-AdfsRelyingPartyTrust -Name "Microsoft Office 365 Identity Platform" | Select-Object -ExpandProperty IssuanceTransformRules
  • Relying parties other than Microsoft 365: move each to an Entra ID enterprise app (SAML or OIDC). The AD FS application activity report in Entra ID helps assess them.
  • Claim rules that MFA or Conditional Access depend on: recreate as Conditional Access policies.
  • Device registration / hybrid join flows that use AD FS: confirm they work with managed domains.

3. Enable sync and staged rollout

# On the Entra Connect server: confirm PHS is on and syncing
Get-ADSyncAADPasswordSyncConfiguration -SourceConnector "contoso.com"

Enable staged rollout for PHS (or PTA) and add a pilot security group. Members of the group use cloud authentication even though the domain is still federated.

Test with the pilot: sign-in to Microsoft 365, Azure portal, MFA, Conditional Access, Outlook and Teams desktop, mobile apps, and seamless SSO from domain-joined PCs.

4. Convert the domain

Plan a change window and communicate. Then convert with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All"
Get-MgDomain -DomainId contoso.com | Select-Object Id, AuthenticationType
Update-MgDomain -DomainId contoso.com -AuthenticationType "Managed"

Warning

Conversion can take time to propagate and users may be prompted to sign in again. Run it at a quiet time, keep AD FS running and untouched for at least a few weeks for rollback.

5. Validate

  • Entra sign-in logs: authentication method now cloud, no federated sign-ins for the domain.
  • AD FS logs: traffic for Microsoft 365 drops to zero.
  • Helpdesk: track password and MFA calls for a week.

6. Decommission

  1. Remove remaining relying parties once their apps use Entra ID.
  2. Remove the Microsoft 365 relying party trust.
  3. Remove WAP servers from the DMZ and DNS records (sts.contoso.com).
  4. Shut down, then delete AD FS servers; revoke and delete their certificates.

Checklist

  • All relying parties inventoried with an owner and target
  • PHS enabled and healthy
  • Staged rollout pilot passed for every client type
  • Domain converted with rollback plan
  • AD FS and WAP decommissioned after soak

Related fixes