I'm been reading the support documents over and over but they are very ambiguous and Microsoft loves to gloss over what could help you achieve anything without installing their malware.

Azure's website itself is the most convoluted interface I've used and I keep getting lost very easily. Federating with AWS and other smaller (than AWS) services was quick though, I'm confident I can do I just need the correct documentation--if possible.



Definitely - as per Connecting ADFS and Azure Active Directory via the custom SAML connection.

AAD Connect can do it but then you tend to go down the federated tenant, SSO, O365 route when sometimes all you want is simple federation.

  • That seems a very back to front way of doing things. Unless I miss-understood, the question relates to how to federate an existing IdP with AAD. Ultimately AAD Connect is the tool from MS to integrate AAD and ADFS or AD directly. It has nothing to do with Office 365 per se - it's just that Office 365 uses AAD as its IdP and so you typically want to federate AAD as a result. There is no aspect of AD Connect that requires Office 365 at all. – Alex Moore Sep 2 '18 at 19:39
  • This is what I need. I don't see why should I need to install agents if federation is supposed to be the fix for that. Thanks! @AlexMoore Yes, I get that's the tool from Microsoft but there should be no tool as ADFS is supposed to F the F out of Azure or any other relying party by itself. :) – Vita Sep 2 '18 at 20:49
  • But with the approach linked you are using AAD as the IdP, so you are federating your AAD identity with ADFS - not the other way round, which is how your question reads. Ultimately though, whatever gets the job done right? :-) – Alex Moore Sep 2 '18 at 21:03
  • In the end I used AAD connector for federation, had a lot of issues on the Azure side, tech support is inept I would talk to over a dozen/incident no matter how insignificant. Nobody was solved a thing but referred me over and over. I loopholed my way through things to fix issues. When things settled own I realized you can just kill (disable) the ADD on the Windows Services console and Azure will still redirect to ADFS for login. :) Now I'm debating hybrid, it'd be nice to have an extra DC for recovery but I'm unsure if I have to renounce to fed to go hybrid AD. :/ Thanks for your help! – Vita Oct 12 '18 at 1:17

The reason for the lack of documentation is that AD Connect is the best and easiest way to configure integration between ADFS and Azure AD - so all documentation assumes you are going that route.

However Azure AD does support using a SAML 2.0 IdP for single sign on, you may want to try to manually configure your Azure AD tenant to use your ADFS instance as an IdP. Some instructions on doing this here:

Use a SAML 2.0 Identity Provider (IdP) for Single Sign On

Though I highly recommend flowing the supported route of AD Connect.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.