Active Directory Federation Services (AD FS) is a Microsoft identity federation service that issues security tokens to provide SSO across application trust boundaries.
Simple definition
Active Directory Federation Services (AD FS) is a Microsoft identity federation service that issues security tokens to provide SSO across application trust boundaries. It belongs to the Active Directory vocabulary and is useful when reading architecture diagrams, product documentation, logs, or administration procedures.
What is it used for?
Its main purpose is to authenticate AD users to applications using federation protocols such as SAML or WS-Federation. The practical value depends on the surrounding architecture, security model, and operational requirements.
How does it work?
AD FS validates identity against Active Directory and then issues a claims-based token to a relying party. Proxies/WAP can publish the service externally.
Key points
- Scope: A Microsoft identity federation service that issues security tokens to provide SSO across application trust boundaries.
- Operational goal: Authenticate AD users to applications using federation protocols such as SAML or WS-Federation.
- Implementation: AD FS validates identity against Active Directory and then issues a claims-based token to a relying party. Proxies/WAP can publish the service externally.
Points to watch
For compatible applications, Microsoft generally recommends assessing migration to Microsoft Entra ID to reduce on-premises federation infrastructure.
In short
Active Directory Federation Services (AD FS) = a Microsoft identity federation service that issues security tokens to provide SSO across application trust boundaries. Use it when you need to authenticate AD users to applications using federation protocols such as SAML or WS-Federation.