We have an on-prem Active Directory environment that is only accessed from our corporate network. We want to extend this environment to an Azure subscription via ExpressRoute. We intended to have IaaS and PaaS services in the subscription but these services will only be accessed from the corporate network (via ExpressRoute)...no external/Internet access. We are considering sync'ing our on-prem Active Directory with Azure AD using AD Connect and installing DCs and ADFS VMs in a VNet in the subscription. ADFS would be used for seamless authentication when we access PaaS based applications that are developed for the cloud.

My question is, in this scenario...do we need to create a DMZ (in the cloud) and deploy WAP servers into? We are thinking we do not need this since there will not be any access external to our corporate network.


This question touches on many different aspects of Azure that would need deeper exploration before being able to give definitive advice.

However, if you don't have ADFS deployed today and are considering it purely for PaaS based SSO authentication services, then my general advice is to not deploy it at all.

Instead, as you suggest, I would configure Azure AD Connect - something you will likely do anyway, and then rely on Azure AD itself to be an identity provider. It has a broad range of integration and security features and is far simpler to manage than ADFS. And you can still extend traditional AD into Azure for IaaS services.

More details can be found here : What is application access and single sign-on with Azure Active Directory?

If you are concerned about passwords being stored in Azure, there is also no longer a requirement to use ADFS, instead look to Pass Through Authentication, more details here: User sign-in with Azure Active Directory Pass-through Authentication

Of course, if there is a firm requirement to deploy ADFS, then you can deploy that in Azure, with all the same principles you would have in an on premises deployment, including making use of a 'dmz' model through use of separate subnets and network security groups - as if you are using it for PaaS or even SaaS services, you may well eventually need some external access, better to build for that eventuality, even if it's locked down initially, than have to rearchitect later. You can find a link to the Microsoft guide on ADFS deployment in Azure here: Deploying Active Directory Federation Services in Azure

But again, my advice would be to explore further the capabilities of Azure AD itself first, it is built for the use case you describe.

  • thanks for the reply. The thought about using ADFS was to allow users to seamless authenticate to cloud based and on-prem resources that are in the authentication domain. Just using AD Connect copies the username/password to the new cloud accounts but they are 2 separate accounts. This environment will never be user accessible from the outside the organization based on it's purpose. Additionally, we are not currently able to use Pass-Thru auth because that feature is currently not in Azure Government – phydeauxman Aug 23 '18 at 14:59
  • So again, many approaches you can take - tough to answer without a session together and a whiteboard :-) It was just to say that AAD is perfectly good as an IdP itself for both cloud and on premises resources - anything that can support SAML/Oauth2.0, but it does depend on your requirements, particularly around security. And given you are referencing Azure Government - an important detail - then I suspect you may well have more constraints than most. – Alex Moore Aug 24 '18 at 14:51
  • In any case my last paragraph above I think would still stand, I would architect to have a separate subnet/NSG environment for ADFS WAP in a DMZ style - simply because while they may not ever be exposed, at least then they are in the right place should you have need to - even if its just to integrating 3rd parties. I have updated the answer with a link to the Microsoft guide for ADFS on Azure which shows a similar topology. – Alex Moore Aug 24 '18 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.