3

Environment: an Active Directory forest with multiple domains, several of which are federated with the same Office 365 tenant; directory synchronization is in place, ADFS too. There is a single ADFS server (WS2012R2) and a single Web Application Proxy server (WS2012R2, too).

ADFS is becoming increasingly critical as we move users to Office 365, thus we need to move ADFS to a new, properly fault tolerant implementation, using two ADFS servers in a farm setup and two load balanced WAP servers. We'll use the same DNS name and certificate for ADFS. The new servers will be hosted on Azure, using Azure's own load balancing as required.

I know how to setup ADFS and WAP, but I also kow there is a bidirectional link between ADFS and Office 365, thus I'm guessing that moving the federation services to the new environment will not be as simple as redirecting a DNS record.

How to move ADFS from the current servers to the new ones (with minimal disruption of user access, of course)?

5
  • Massimo - not to derail your question, but I'm curious why you need ADFS at this point for O365? I'll delete this comment and you can delete yours if you are willing to share. We got rid of ours and moved SSO to our Okta instance and using AD Connect for the DirSync piece, so I'm just curious if I'm missing a reason for ADFS to exist at this point.
    – TheCleaner
    Sep 13, 2016 at 15:12
  • I don't know, I wasn't the one who implemented it; AD Connect can handle directory (and password) synchronization just fine, and ADFS becomes a liability if your AD (or ADFS itself) is down while Office 365 isn't. But as I said, it's already there... and it isn't going anywhere, so the best I can do is to at least make it more reliable.
    – Massimo
    Sep 13, 2016 at 18:42
  • In this case, wouldn't reverting back to ADConnect and removing ADFS be more easier? from O365 side it's just a Powershell command and boof! ADFS is removed. From your network side, just rerun the ADConnect setup or so I remember and tell it you no longer wish to use ADFS. Sep 13, 2016 at 21:32
  • Unfortunately, I'm not in the position to discuss the overall design choices of this company... they probably don't even know why the Highly Paid Consultants implemented ADFS, they just take for granted that it's a vital part of Office 365 integration and so they are concerned it might fail.
    – Massimo
    Sep 13, 2016 at 21:47
  • (Well, they actually weren't concerned at all with two lonely servers being critical single point of failures, possibly not even understanding what they are actually doing; but since they insist on using ADFS, I at least managed to bring up the issue, and was allowed to add some very much needed fault tolerance...)
    – Massimo
    Sep 13, 2016 at 21:50

1 Answer 1

3

If I recall correctly, ADFS on 2012R2 can only be installed in a farm, even with just 1 node (as opposed to a standalone mode available in previous versions). If thats the case, you can expand your farm by adding additional nodes. If using WID as your datastore, it will replicate automatically. If you wish, you can set a different node to be the primary datastore. You could also use this process to "move" to another server by decomming the old server after making another node primary.

Keep in mind that WID-based farms can have a max of 5 federation server nodes (excluding proxies).

Or, if you want to rebuild and migrate, Microsoft already has an article for it Migrating the AD FS Federation Server

4
  • I actually thought about adding the new servers as nodes to the existing farm just a few seconds before reading your answer... I'll try that, it looks like a really good way to avoid downtime and also having to migrate/reconfigure everything. The issue here is, I can't load balance the servers, because they are in different places... but I think I can perform a DNS switchover as soon as the new servers are in the farm, and then remove the original one.
    – Massimo
    Sep 13, 2016 at 18:58
  • WAP should be much easier to migrate, as it's just basically a reverse proxy; just bring up the new servers, load balance them and re-point the external DNS.
    – Massimo
    Sep 13, 2016 at 18:58
  • 1
    For the ADFS part, it worked perfectly by adding the new ADFS servers to the farm, changing the primary server, switching the DNS and uninstalling the ADFS role from the old server.
    – Massimo
    Sep 14, 2016 at 13:44
  • 1
    For the WAP part, I just installed and configured ADFS proxy on the new servers, switched the DNS to their public load-balanced IP address and then removed the old server.
    – Massimo
    Sep 14, 2016 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .