switching between PHS and ADFS

Question

I am testing switching between ADFS and PHS in my test environment. The authentication was original setup as ADFS and I was able to switch to PHS by using ADconnect alone (without need to use set-msoldomainauthentication cmdlet). I then rollback to ADFS by using convert-msoldomaintofederated and that is also working. Get-msoldomain showed the domain is federated and I was redirected to the ADFS page to sign-in. However, when I try to switch from ADFS to PHS the 2nd time, the user sign-in options is already set to PHS in ADconnect. I can't change from ADFS to PHS which the options in the ADconnect wizard. Can someone explain what did I miss during these changes?

Thanks

Answer 1

Thanks for sharing more context.

This is an expected behavior when using the "Azure AD connect wizard" as well as "PowerShell Msol" cmdlets in combined way (such as convert-msoldomaintofederated/Set-MsolDomainAuthentication ) for switching between PHS and ADFS because if we use PowerShell cmdlets then Azure AD connect wizard stop managing federation for you.

Let's say ADFS was initially configured and federated via Azure AD Connect, then later switched to PHS (Password Hash Synchronization) from federation via Azure AD Connect, so there is no discrepancy until now, but if you use PowerShell cmdlets like "convert-msoldomaintofederated" to revert back to ADFS federation rather than using sync wizard, then Azure AD Connect unaware of these changes and will continue to use PHS as a backup along with federation.

Screenshot from my environment, you can see that Domain was federated using convert-msoldomaintofederated but Azure AD connect continue to use PHS as backup because earlier it was managed via Azure AD connect.

However, at this stage primary authentication for user sign-in would be ADFS federation but PHS continue to be a backup. You can always Run the customize synchronization options to remove this optional PHS feature as shown below:

So to avoid such instances, try using Azure AD connect wizard to switch between PHS and ADFS not PowerShell in combined way. Here are detailed steps to switch back to federation by using wizard.

To learn more, refer following articles. Hope this was helpful.

Migrate from federation to cloud authentication: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/migrate-from-federation-to-cloud-authentication
Setting up PHS as backup for AD FS in Azure AD Connect: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/tutorial-phs-backup

-----
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Thanks,

I don't think this is cache issue. I rebooted the ADconnect server and it is still seeing PHS as the sign-in option. I actually selected "Do not configure" option and choose PHS again and the Next button became available. I continued the wizard and it completed successfully. At the end, it stated that the sign on method is set to Password Hash Synchronization. However, when checking with get-msoldomin, the domain is still showing as federated and I am still being redirected to the ADFS sign-in page.

Answer 3

I assumed I still can use the set-msoldomainauthentication cmdlet to perform the switching. I just want to understand the details before doing this on the production env..

Answer 4

Thanks for the details explanation.

I did read the ADFS to PHS documentation and it was abit confusing. My ADFS was not setup by ADconnect originally. Rather I setup the ADFS\WAP servers manually and then run the convert-mosldomaintofederated for federation authentication. I only used ADconnect for the account synchronization.

With my first ADFS to PHS move, I only needed to use the ADconnect wizard for the change (without needing to run any PS cmdlet). This part actually confused me as I was expecting that I need to run the PS cmdlet due to the original setup. But it didn't need to and the conversion was fine.

I then tried the rollback by using the convert-msoldomaintofederated and it was good too.

When I tried to do my 2nd ads-phs conversion, then I started experiencing the problem I mentioned and that was why I posted the question here. I did ended up using the set-msoldomainauthentication to managed to change to cloud authentication.

Anyway, my question now is can I just rely on using PS cmdlet to switch from ADFS to PHS and vice versa and only use ADconnect for other configuration such as password writeback and etc. It seems to be it is easier to manage authentication using Powershell.

Thanks again for your help.