Deploy ADFS 2022 in Azure and Integrate with Microsoft 365

Introduction

Did you know that ADFS, short for Active Directory Federation Services, has been an IT game-changer for over a decade? As a seasoned professional, I have enjoyed working on several ADFS projects, specifically those related to establishing federation with Office 365 for various clients. There are numerous articles about ADFS on the internet. However, I am excited to share my expertise with the online community through my blogs, which can assist anyone interested in ADFS and federation services.

In this article, I will provide a step-by-step guide on how to deploy ADFS 2022 in Microsoft Azure and enable ADFS for Microsoft 365.

Types of user identity

Before we jump into ADFS, let’s look at the type of identity.

Local user identity: This identity is specific to a particular device and is created and managed locally on that device.

Domain user identity: This identity is created and managed on a domain controller in an Active Directory environment and can be used to access resources across the domain.

Hybrid Identity: This is a synchronized identity from the on-premise Active directory environment to Entra ID. This enables users to seamlessly access on-premise and cloud-based services with synchronized identity from the Active Directory environment to Entra ID.

Cloud Identity: In a cloud identity model, user identities and credentials are stored in a cloud-based directory service rather than on-premises. This allows users to access cloud-based services anywhere and on any device without a VPN or other specialized networking infrastructure.

Federated user identity: This identity is created and managed by an external identity provider, such as ADFS, and can access resources in multiple domains or across different organizations.

Social user identity: This identity is created and managed by a social media platform, such as Facebook or Twitter, and can be used to access third-party applications and services.

Anonymous user identity: This is used when a user does not need to provide identifying information to access a resource, such as when browsing a public website.

What is ADFS?

ADFS stands for Active Directory Federation Services. It is a Microsoft service that allows organizations to provide single sign-on (SSO) access to various applications and services, both on-premises and in the cloud, using a single set of credentials. ADFS is commonly used to enable SSO for Microsoft 365 and other cloud-based services. Additionally, ADFS provides enhanced security features like multi-factor authentication and conditional access policies, making it a reliable choice for organisations seeking secure access to their applications and services.

How does ADFS work?

ADFS facilitates a trust relationship between the identity provider and the service provider. Users are redirected to the organisation’s ADFS login page, where they enter their credentials. ADFS authenticates the user against the organisation’s Active Directory and issues a security token with the user’s identity information. The service provider grants access to the requested service using the token. This process ensures a seamless and secure user experience.

Preparation

I created an Azure network and deployed two domain controllers in an AD forest called forest1.com. I then integrated the on-premise Active Directory with Entra ID by installing two Cloud Sync agents to establish a hybrid identity model.

Please find the details of the Virtual Network, Subnet, and associated Network Security Groups, as shown in the figure below.

Please identify the Network Security Group rules (Inbound and Outbound) created to secure the subnet, as depicted in the figure below.

I have set up four Windows Server 2022 machines for the ADFS Farm and Web Application Proxy servers. Two are for ADFS Farm, and the other is for the Web Application Proxy server, as shown in the figure below.

I domain-joined the ADFS Farm servers, which will be in subnet1 172.16.3.0/25, whereas WAP servers are in Subnet2 ( DMZ), 172.16.4.0/25.

Please find the table below that displays the server information.

The figure below illustrates the current High-Level Architectural diagram.

The figure below illustrates the Desired ADFS architecture.

Implementation Steps

All right, let’s dive into the ADFS deployment. Please find the steps to install ADFS 2022.

Create a GMSA account.

A Group Managed Service Account (GMSA) is necessary for the installation and configuration of Active Directory Federation Services. To create a gMSA account, open a Windows PowerShell and type the cmdlets below.

• Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10) – This is to generate passwords for gMSA accounts.
• New-ADServiceAccount svc_adfs -DNSHostName sts.myforest1.com -ServicePrincipalNames http/sts.myforest1.com

Install a server SSL certificate.

I created an SSL certificate from Zero SSL. You can follow the guide from Zero SSL to create an SSL certificate. The certificate has been installed on all four computers, including the ADFS and WAP systems. In my case, I have made a multidomain certificate. Please find the certificate information shown in the figure below.

Install the ADFS Role

Now it’s time to install the ADFS role on the Windows Server 2022 computer. This computer will become the first federation server in the federation farm. To do that, all you can do is open the Windows PowerShell and then run the following command:

Install-windows feature adfs-federation –IncludeManagementTools.

To install the ADFS role on another server, repeat the same step. In my scenario, the ADFS role has been installed on two computers – for1-af101 and for1-adfs102.

Install the ADFS farm.

In the previous step, we installed ADFS roles on the two servers. Now, we will install the ADFS farm and create the first node in the farm. We will use the WID database in this farm with the group-managed service account we created earlier. You can use an SQL database to store the ADFS configuration.

This farm will utilise an SSL certificate for service communication, while self-signed certificates created by command jobs will be used for token signing and decryption. In order to install the ADFS farm on the server for1-af101, open the Windows PowerShell and then run the following command:

Install-AdfsFarm -CertificateThumbprint 65063b3d2be1a45cecdc12b2f418207b10c46b15 -FederationServiceName sts.myforest1.com -GroupServiceAccountIdentifier myforest1\sa_adfs$

We must add a second node to achieve high availability for our ADFS farm. To do this, on the server for1-af101, open the Windows PowerShell and run the following command.

Add-AdfsFarmNode -PrimaryComputerName “for1-af101.myforest1.com” -PrimaryComputerPort 80 -GroupServiceAccountIdentifier myforest1\sa_adfs$ -CertificateThumbprint “65063b3d2be1a45cecdc12b2f418207b10c46b15”

Verify the ADFS servers.

To verify the ADFS server is operational, open a browser window; in the address bar, type the federation server’s DNS hostname, then append /adfs/fs/federationserverservice.asmx to it for the new federation server. The expected output is a display of XML with the service description document. In our case, the federation hostname address is https://sts.myforest1.com/adfs/fs/federationserverservice.asmx , and the output is shown in the figure below.

Alternatively, you can look for the event ID 100 to confirm that the ADFS is operational.

The following figure represents the version of the ADFS farm.

DNS record for federation service

Create an A record for the Internal Load Balancer. This record is for federation service with the IP address pointing to the IP address of the Internal Load Balancer. In our scenario, the ILB IP address is 172.16.3.21.

However, I will not create this A record now and point it to sts.myforest1.com. Instead, I will be pointing to the primary ADFS server. This approach will help to register all the Web Application Proxy servers to ADFS Farm.

First, we have to enrol web application servers in this ADFS Farm. Once done, we will deploy and configure an Azure internal load balancer for the ADFS farm and an Internet load balancer for WAP servers.

Install the Web Application Proxy role.

It’s necessary to deploy web application proxy servers so that users can reach the AD FS when they aren’t on the company network. To do this, open the Windows PowerShell and run the following command.

Install-WindowsFeature Web-Application-Proxy -IncludeManagementTools.

I have installed this role on the computer for1-wap1 and for1-wap2.

Before registering the WAP servers with ADFS farm, We need to create a record in the host file so that WAP servers can reach ADFS servers. But now, I just made a record to point to the ADFS primary server, as shown in the figure below.

Enroll the web application proxy Servers.

We must register these two web application servers to the ADFS farm. To do that, open the Windows PowerShell with elevated permission and run the following command.

Enable the Idp-initiated sign on page.

On the ADFS primary server, open the Windows PowerShell with elevated permission and run the following command to enable the ADFS sign-in page.

Deploy the internal load balancer.

To ensure high availability, deploy a load balancer for ADFS and WAP services. These solutions distribute incoming traffic across multiple servers, preventing overloading and ensuring uninterrupted access to the service. It will also improve reliability and performance, ensuring that ADFS and WAP systems are always available to users.

This section outlines how to deploy internal load-balancing solutions for ADFS.

In the Azure Portal, look up the load balancer, select the ‘+ Create’ button, and complete the form as illustrated in the figure below. Leave the SKU, Type (Internal), and Tier as default and select Next: Frontend IP Configuration.

Select + Add a frontend IP configuration, then enter or select this information on the Add frontend IP configuration page, as shown in the figure below, and select Add.

Select Next: Backend Pools, then select + Add a backend pool.

Give the Name for the BE pool, select +Add in the IP configuration, add the ADFS servers as shown in the figure below, and click Add.

Click Save and Select Next: Inbound Rules

Select Add a load balancing rule on the Inbound Rules tab, then enter or select the information in the Add load balancing rule page, as shown in the figure below.

Select Review + Create, and if everything looks good, select Create.

Upon deployment, the ILB will appear in the load balancer list.

DNS records for Internal Load Balancer

Now it’s time to create an A record for the Internal Load Balancer. Once created, point the IP address to the federation server hostname. In our case, the IP address 172.16.3.21 points to sts.myforest1.com.

Deploy the Public Load Balancer

In the Azure portal, navigate to Load Balancers and select Create. Enter the necessary information as shown in the basic configuration in the table below.

Enter the frontend IP configuration as shown in the below table.

Enter the Back End Pool Configuration details as shown in the below table.

Finally, Select Review + Create; if everything looks good, select Create.

This will deploy the public Internet Load Balancer (ILB) and become visible in the load balancer list.

Assign a DNS label to the public IP

Locate the Public IP address of the internet Load Balancer and navigate to configuration to create a mapping to the public IP in the Azure-managed DNS, as shown in the figure below.

After that, log in to the public DNS management portal and create a CNAME, as shown in the figure below.

Test the AD FS sign-in

Open a web browser on both the Doman-Joined and Internet machine and enter https://sts.myforest1.com/adfs/ls/idpinitiatedsignon.aspx in the address bar to test ADFS authentication using the Idp-initiated sign-on page. Type your credentials as shown below.

Once your credentials are verified, you will be able to sign in to the ADFS webpage.

Sync On-premise user accounts to Microsoft 365

To set up ADFS integration with Office 365, it is necessary to synchronize the local on-premises user accounts with Microsoft 365. To simplify the installation, I have already installed Entra Cloud Sync agents on the domain controllers. These Sync agents are responsible for synchronizing objects with Entra ID. If you want to learn more about deploying Entra Cloud Sync, please visit my article.

Enable ADFS for Microsoft 365 (SSO)

This section will demonstrate how to convert the Managed domain, myforest1.com, to the Federated domain. ADFS will manage the user authentication request for this domain upon successful completion.

To do that, open the Windows PowerShell with elevated rights on the Primary ADFS server (for1-af101) and follow the instructions below.

• Run the cmdlet Connect-Msolservice to connect to Microsoft 365.
• Once connected, enter the command Set-MsolADFSContext –Computer for1-af101.myforest1.com
• Then run the command “Convert-MsolDomainToFederated –DomainName myforest..com.”

If the commands run successfully, you should see the following:

• A “Microsoft 365 Identify Platform” Relying Party Trust is added to your AD FS server.

You can press “Test URL” to validate the federation metadata.

Type the command “Get-MsolDomainFederationSettings -DomainName myforest1.com” to verify the federation settings at the Entra ID side.

• Users are redirected to the AD FS server when logging in to the Microsoft 365 portal using the custom domain name myforest1.com UPN suffix.

Verify ADFS authentication from the internet.

To authenticate your ADFS from an external network device while accessing Office 365 services, open your browser, go to office.com, enter your userprincipalname on the sign-in page, and click Next.

Upon clicking Next, you will be directed to the ADFS login page.

On the ADFS sign-in page, enter your password.

Please select your preferred method to access Office 365 services.

Configure the client computer for Single Sign-On.

Add the federation service URL to the local intranet zone of your internet options for a seamless sign-in experience.

Adding the Federation server to the Intranet zone supports seamless SSO authentication without login prompts. Another option for Administrators is to implement Group Policy settings that enable a Single Sign-On solution on client computers joined to the domain.

Conclusion

We have successfully implemented Active Directory Federation Services (ADFS) in the Azure environment. During this demonstration, we touched Azure components, such as the Azure Virtual Network, Subnets, Azure VM, internal Load Balancer, Public Load Balancer, Network Security Group, Public IP address, and DNS label.

With ADFS, you can also seamlessly integrate third-party applications by creating a relying-party trust. This trust allows secure communication between the application and ADFS, empowering users to authenticate themselves without providing their credentials multiple times. This not only enhances the user experience but also provides a robust security layer to the organisation’s applications and data, adding significant value to your organization.

Thank you for taking the time to peruse my article. I appreciate your attention to detail and willingness to engage with my content. Your valuable input and feedback are highly regarded and will be used to improve the quality of my future work. Once again, thank you for your time and consideration.