Azure ADFS to Pass through aunthentication

bizcntradmin 191 Reputation points
2021-06-09T08:34:29.627+00:00

Hi We are currently using ADFS but we are looking to change it to pass Through Authentication. How to perform this migration and would there be a dowtime and risk on doing this.

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,190 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,473 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,306 Reputation points
    2021-06-09T09:26:41.487+00:00

    Hi @bizcntradmin · Thank you for reaching out.

    For this purpose, you need to run Azure AD Connect wizard and select Pass-through authentication (PTA) under User Sign-in as highlighted below. A PTA agent will be installed on the AD Connect server, you may install another agent on any domain joined machine for fault tolerance.

    103813-image.png

    How to perform this migration?

    1. Enable pass-through authentication. Please refer to https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start
    2. Disable Federation with ADFS by using Convert-MsolDomainToStandard cmdlet.
    3. (Optional) Enable Password Hash Synchronization (PHS) as backup option for Pass-through Authentication (PTA). Refer to https://learn.microsoft.com/en-us/answers/questions/10981/azure-active-directory-sign-in-disaster-recovery.html

    Would there be a downtime and risk on doing this?
    Although there won't be a downtime and not much risk involved, I would still recommend you to schedule a downtime window for this activity. Just in case, if anything goes wrong (due to network/firewall/other restrictions), you can revert the changes.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.