Advice on moving from AD Connect with Password Sync to ADFS

[Chris Yue]

Environment
AD Connect with Single Sign On and Password sync and Hybrid Exchange enabled.

I am using one server LAN based running AD Connect. If I move to ADFS, I understand that I will need the following:-
Domain joined server with ADFS services and a SSL cert installed.
Another server on the DMZ (not Domain joined) with Web Application Proxy services installed.

Q/
Can I using my existing AD Connect server and install ADFS services and a SSL Cert instead of building a new server with ADFS installed? Or do I need to keep the AD Connect server as it is and build 2 more servers?

Q/
Can I build the new infrastructure servers on Server 2016?

Q/
For backup, I understand it is possible to add Password sync to ADFS as an option.
In the event of a building loss where my ADFS environment is not available, how can I change from a Federated to a Managed Identity? Once I restore connectivity, how do I revert back?

Q/
Is it possible using Access Control Policy Templates to prevent users from accessing Office 365 services outside of the trusted IP whitelist?

Q/
Can I granulise the above to allow ActiveSync is always work irerespective?

The main driving force behind the change is to negate the need to purchase AD Premium licences which are required to use Conditonal Access to prevent a subset of users from accessing O365 outside the Intranet.

With ADFS is feature is built in.

Any advice would be grateful.

[#2 · Accepted solution]

You can reuse the existing server, that's not a problem. Having a single AD FS server (or WAP one) is a recipe for disaster however, you should have at minimum 2+2 to ensure HA.

You can use Server 2016. You can use the AD FS server to restrict logins based on criteria such as IP or protocol used, but the implementation depends on several factors (such as the use of Modern authentication), and in some cases Conditional access might be a better solution. I dont have enough time to write a proper answer now, but this has been discussed numerous time already, do a search on the internet to find the relevant articles.

You can find the instructions about switching between federated and managed ids with password sync here: https://social.technet.microsoft.com/wiki/contents/articles/17857.dirsync-how-to-switch-from-single-...

[#3]

Thanks Vasil.

[#4]

Hi Chris,

Absolutley agree with Vasil, one ADFS server is a recipe for disaster, even though a single ADFS server can handle thousands of logons, I always spec a minimum of 2 using hardware load balancing where possible and the same for the WAP in the DMZ, 2 with hardware load balancing.

Keep your AADConnect server seperate to your ADFS is my preferred practice as it ensures that the ADFS servers stay identicial which makes management easier in the future and keeps the roles sperate. (AADC may also self update depending on your configuration, so less risk if it's seperate.)

For the backup option, you can leave password sync in place, however the fail back in the event of you losing both of your ADFS servers (You did split them between virtual hosts/data centres hopefully..) then you need to force the Federated domain back to managed. This is a simple powershell command, BUT it takes about 30-45 minutes to fully take effect because of the number of logon servers in the office 365 arena.

Convert-MSOLDomainToStandard and ConvertMSOLDomainToFederated

Failing back is a case of changing the domain back to federated again, but again this takes time to take effect, so you can see why having a fully HA ADFS farm is a better option and leave this for when the stuff has really hit the fan!

You can configure Client Access Policy (now called Access Control Policy) templates to allow only people coming from trusted IP ranges however be warned if you're not using RFC1918 addresses internally (e.g. 10.0.0.0 etc) then your RegEx setup for the policies is going to be nasty! You can also allow a single group to ignore the ACP and get in. This technet article covers some of the common scenarios, including allowing ActiveSync for ADFS 2.0 (Limit access to Office 365 services based on location), (there was a later version but my links all seem to redirect to this now. Manage risk with conditional access control - Technet)

Good luck.

Paul.

[#5]

Agree with previous comments.  But be careful when it comes to switching from federated to managed identity when ADFS is unavailable. The Convert-MsolDomainToStandard command requires ADFS to be available.

If ADFS is not available, use 

Set-MsolDomainAuthentication -DomainName mydomain.com –Authentication Managed

More info here 

[#6]

That's good to know Shane, I've not had to recover authentication from ADFS in the event of a farm failure so never hit that!

Paul.