Set-AdfsProperties -EnableIdPInitiatedSignonPage $true This can be enabled by running the following: In Windows 2016 ADFS, the IDPInitiatedsignon page is disabled by default. The install can be verified in the same ways.

Installing a second ADFS server is similar to the first point at the federation service name and go. I do not always trust load balancers! So, if there are issues, amend the host file of the machine you are trying to connect to the URL from so that the URL is pointing directly at that server.if this displays an XML page it is working as it should. Also, the ADFS server should be serving an XML page through its federation name: e.g.The install can be verified by looking for event ID 100 in the AD FS event log.Install one “Primary” ADFS server first and when it is working, install the second.

The steps for this are readily available by asking your favourite search engine, but some top tips: This meant we were ready to install the test ADFS and WAP servers.

Ports 443 (SSL) and 49443 (certificate auth) open between Clients and WAP servers.

Ports 443 (SSL) and 49443 (certificate auth) open between ADFS and WAP servers.

Make sure the ADFS and WAP servers can see the 3 rd party and Internal CA CRLs.

A 3 rd party SSL certificate is required containing the name of the Federation service, this should be installed on the ADFS and WAP servers.

The Internal Root and Intermediate Certificates from the relevant CAs should reside the appropriate stores on the ADFS and WAP servers.

, and appropriate records added to internal and external DNS.

A decision on a Federation services name e.g.

Setting of Service Principal name on the ADFS service account.

Creation and configuration of an internal and an external load balancer.

New test Web Application proxy servers residing on the DMZ.

New test ADFS servers residing on the corporate network.

The following pre-requisites were needed:

Configuring certificate authentication on the test ADFS environment.

Configuring and deploying test Certs for Authentication.

Federating the test O365 tenant to use the test ADFS.

Configuring test user and a test O365 tenant.

This blog details the setting up of the test environment and it involved 5 main steps: Testing this on their live tenant was more risk that than they were prepared to accept, so the decision was made to stand up a new ADFS test environment and use a spare domain and Office 365 tenant to prove the concept.

The customer used existing Active Directory Federation Services (ADFS) to authenticate to their live Office 365. In summary they did not want anyone to be able to log in to Office 365 from an extranet connection on a device that did not have a certificate issued by their internal PKI. To give and extra layer of security for Office 365, a customer wanted to enforce Certificate Authentication.

Office 365 adfs install new certificate