Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

3.4.3. AD FS Migration and Connect Health

💡 First Principle: Federation servers are standing infrastructure whose only job modern Entra features can now do natively — every month they remain is patching, certificates, and attack surface for zero feature gain. Migration is therefore a decommissioning project: move authentication to cloud methods, move apps to Entra, then turn the farm off.

The migration sequence stems test: inventory what AD FS actually does (workforce sign-in? app relying parties? device claims?); move user authentication to PHS or PTA + Seamless SSO using staged rollout (pilot groups authenticate via cloud while the domain stays federated, then cut the domain over from federated to managed); move relying-party apps to Entra ID directly (SAML/OIDC app registrations / enterprise apps — Phase 4 mechanics); handle the stragglers (apps needing claims AD FS uniquely provided often map to Entra claims policies; true blockers like third-party on-prem MFA may justify remaining scoped federation); decommission and celebrate the removed certificates.

Entra Connect Health is the watchtower during and after: agents for Connect Sync (sync error taxonomy — duplicate attribute, data mismatch, large attribute; alerting on stalled sync), AD FS (sign-in volumes, bad-password attempts / lockout patterns against the farm, certificate expiry warnings), and AD DS (DC health). It requires P1 and surfaces in the portal with email alerting. Exam tells: "monitor sync errors centrally" or "get alerted before the AD FS certificate expires" → Connect Health with the matching agent.

⚠️ Exam Trap: Staged rollout is per-group and reversible while the domain remains federated — the domain-level cutover (Set-MsolDomainAuthentication lineage / modern Graph equivalent) is the separate, final step. Stems that skip piloting or flip the whole domain first are describing the risky path, not the recommended one.

Reflection Question: During staged rollout, a pilot user's sign-in stops honoring the third-party MFA that AD FS enforced. Explain why, and where that MFA requirement must be re-implemented before broad cutover.

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications