I have upgraded our Active Directory from Win2008 R2 to Win2012 R2 in preparation for an integration with Azure Active Directory. I know the integration can be done with Win2008 R2, but I figured there will be less problems if we use the latest version of Active Directory. Right now we only have a single on-premises domain controller, so it has the FSMO-roles, and the functional level of both the forest and the domain are upgraded to Win2012 R2.
I looked at what else is needed on-premises, and according to the prerequisites here, I'll need the Active Directory Federation Services: http://technet.microsoft.com/en-US/library/jj151786
"Install the AD FS role service on a Windows Server 2012 or Windows Server 2012 R2 server."
My question is; Can I install and use Federation Services on the domain controller, or do I need to have a separate domain member server and run the AD FS there instead?