Cannot connect ADFS 2019 to Azure AD Domain Controller

Joe 26

I have setup a new Azure AD Domain Services and an Azure VM running ADFS. I now want to connect ADFS to the Azure AD Domain Services.

I run the Active Directory Federation Services Configuration Wizard and the first step is to specify an account with domain administrator permissions to configure ADFS. When I enter an account that is a global administrator and a member of AAD DC Administrators, it gives me the following error:

The credentials provided is not a domain administrator. Provide a credential that is a member of the Domain Admins group and try again.

I cannot find the Domain Admins group in Azure and when I try and this group using the AD Remote Admin tools, it gives me the following error:

You do not have permission to modify the group myadfs.onmicrosoft.com/Users/Domain Admins.

How to I create an account that is part of the Domain Admins group so that I can use it to configure ADFS?

Note that this is a new Azure cloud-only setup with no existing AD services or users.

Manu Philip 16,966 Reputation points MVP

2020-05-23T19:19:30.68+00:00

Hi,
In your on-premises server, open a command prompt and type whoami. See the name shown there. It should be domainname\username. If you see that as servername\username, you logged in as local administrator. So login as domainname\administrator and try again to setup the Federation service.

Thanks,
Manu

Accepted answer

Jai Verma 461 Reputation points

2020-05-24T04:01:25.9+00:00
this will work 100%, for many years, this is how we are setting up our lab

A VM in Azure with DC+ ADFS + ADConnect Server installed on the same box

You will need one more VM for proxy as exposing an ADFS with DC role is not consider secure not even for a lab scenario
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

3 additional answers

Joe 26 Reputation points

2020-05-23T19:26:57.45+00:00

Thanks for your response. We don't have an on-premises server, we want an Azure cloud-user only environment.
Please sign in to rate this answer.
Manu Philip 16,966 Reputation points MVP

2020-05-23T19:35:09.517+00:00

Hello @Joe ,

Could you please try the steps I mentioned in the Azure VM and see how it shows. Here, your on-premises server is Azure VM itself

Regards,
Manu

Joe 26 Reputation points

2020-05-23T20:01:13.46+00:00

Ah, I see. OK, I'm logging into the Azure VM with remote desktop and I have tried the following as usernames:

username@myadfs.onmicrosoft.com
myadfs.onmicrosoft.com\username
username

When I run whoami for each of these, I always get myadfs\username so I assume I am logged in as the local admin.

How to I login as domainname\administrator when using remote desktop?

Manu Philip 16,966 Reputation points MVP

2020-05-23T21:00:52.867+00:00

Hello @Joe ,

You have to create an AAD DS in azure portal and join your vm to the domain. As you don't have domain associated in on-premises or Azure, you need to join the VM to a domain. Then you can follow the procedure as I mentioned

Regards,
manu

Joe 26 Reputation points

2020-05-23T21:35:45.94+00:00

AAD DS has been created and I have a domain in the format myadfs.onmicrosoft.com. I have joined the ADFS VM to this domain and am able to login with remote desktop using accounts created in Azure AD. If I run whoami, the response is in the following format:

myadfs\admin

Does this mean I am logged in as a local administration? As far as I can tell, I seem to be logged in with a domain account.

However, even though this account is global administrator in Azure and a member of AAD DC Administrators, I still get this error when I try and use to connect ADFS to AD DS:

The credentials provided is not a domain administrator. Provide a credential that is a member of the Domain Admins group and try again.

There seems to be no way to make this account a member of Domain Admins (like you can with on-premise AD).

Any other ideas?

Thierry DEMAN-BARCELO 491 Reputation points MVP

2020-05-23T22:45:26.91+00:00

Hi

Azure AD has no domain controllers that you can see or manage, and no "Domain admins" group !
So I have never seen the use of ADFS servers in that way.

And Azure AD can be configured to propose "claims/SAML 2.0" tokens without the need of ADFS Servers.

ADFS servers can only be used installed on Windows Servers integrated in a "true" forest/domain managed by usual Windows servers.
ADFS servers can be configured automatically for Office 365/Azure AD when you have ADConnect synchronizing from AD Forest/domain to Azure AD.

Where/why /for which application do you think that you need ADFS Servers?

You can find here a sample use of adfs with Azure. Servers can be hosted on Azure, but not connected directly with AzureAD.

Regards,

Joe 26 Reputation points

2020-05-23T23:04:17.343+00:00

Thanks very much for you explanation, it makes much more sense now!

We want to use a specific authentication plugin for ADFS so can't use the SSO capability of Azure AD.

I now understand that it is not possible to connect ADFS directly to Azure AD but it should be possible to do what we want if we take a different approach.

Baring in mind that this is a brand new service with no pre-existing users that we want to be cloud-only, is there any reason why this wont work?

Install ADDC on the existing ADFS Azure VM

Configure a new forest on the Azure VM

Connect ADFS to connect to the local domain controller

Setup AD Connect to synchronise the existing Azure AD

Are there any errors in this logic? I understand that there is no resilience and normally ADFS and ADDC would be on different servers but for a dev setup, would this work?

Manu Philip 16,966 Reputation points MVP

2020-05-24T08:33:31.467+00:00

Hi,
As I understood the purpose, you need a VM in azure as domain controller and sync to Azure using ADFS. In that case, you need to create a domain controller in the VM you have allocated in Azure and use Azure AD connect tool to sync to Azure AD

Thanks,
Manu
Sign in to comment
Matt Cowen 1 Reputation point

2020-05-24T09:24:52.987+00:00

@Joe , Azure Ad Domain Services does not support ADFS. See the following for an explanation

35347627-ability-to-deploy-adfs-with-azure-ad-domain-servic

You need to create your own domain controllers in Azure. You can use the Azure Quickstart template to do this quickly and easily.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-05-25T17:46:31.38+00:00

Hi there, a but of a side question... But why would you implement ADFS in this context? Azure AD can play the role of the IDP for SAML/WS-Fed and OAuth/OIDC flow. What is the scenario that make you want install ADFS and connect it to an Azure AD DS domain controller?
Please sign in to rate this answer.
Joe 26 Reputation points

2020-05-25T18:14:39.703+00:00

We have a specific ADFS Authentication plugin we want to use. As far as I can see, it is not possible to add custom authentication methods to Azure AD (please correct me if I am wrong).

Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-05-25T19:51:24.5+00:00

Well, it depends, what do you call plug-in in your context?

Joe 26 Reputation points

2020-05-25T20:04:36.173+00:00

The authentication plugin is based on this:

https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method

The requirement for the authentication integration are as follows:

Make an API call from the backend before displaying the challenge to the user

Display some custom HTML and/or JavaScript to allow the user to supply response

Make a final backend API call to validate the response data before authenticating the user

From my research, it seems that only ADFS provides the ability to do this. If it is possible to do this with just Azure AD without ADFS, that would be fantastic! I would be very happy if you could point me to something that shows that this is possible.

Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-05-25T20:10:31.703+00:00

Nope. Azure AD does support OTP and various MFA options, and CAP also allows a bunch of other things (such as ToU or session control). Which might be good enough depending on what you are trying to achieve (not from a technical standpoint but from a functionality perspective). But if you are tied with that technical specs, Azure AD does not provide that level of customization.

Joe 26 Reputation points

2020-05-25T20:12:07.887+00:00

OK, thanks for the confirmation.

Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-05-25T20:24:04.163+00:00

So, tell me more :) I am curious! What is the API call doing before and after? We are talking MFA right? What does the custom JS interaction look like?

Joe 26 Reputation points

2020-05-25T20:47:39.877+00:00

OK :) This is the iProov biometric web solution that we want to offer as an MFA option (as we do currently using ADFS). It uses the camera on the device to create a unique one-time biometric by illuminating the face with a unique sequence of colour while streaming a short video for analysis.

The backend integration requires an API call upfront to create a session for a user and then again at the end to validate the result provided by the client. The frontend integration requires including the JavaScript Web SDK and then rendering or injecting a Web Component.

We would absolutely love to have an Azure AD only solution as this has been requested by a customer. Making use of ADFS in this case is far from ideal as there is no user writeback functionality in AD Connect so all user registration would need to be into the "on-prem" AD to keep everything in sync.

Joe 26 Reputation points

2020-05-25T21:35:38.207+00:00

OK :) This is the iProov biometric web solution that we want to offer as an MFA option (as we do currently using ADFS). It uses the camera on the device to create a unique one-time biometric by illuminating the face with a unique sequence of colour while streaming a short video for analysis.

The backend integration requires an API call upfront to create a session for a user and then again at the end to validate the result provided by the client. The frontend integration requires including the JavaScript Web SDK and then rendering or injecting a Web Component.

Joe 26 Reputation points

2020-05-25T21:37:33.557+00:00

We would absolutely love to have an Azure AD only solution as this has been requested by a customer. Making use of ADFS in this case is far from ideal as there is no user writeback functionality in AD Connect so all user registration would need to be into the "on-prem" AD to keep everything in sync.

Any ideas for better approaches would be very welcome.

Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-05-26T01:54:04.807+00:00

That is very interesting! Thanks for sharing!
Sign in to comment