3.4.3. AD FS Migration and Connect Health
💡 First Principle: Federation servers are standing infrastructure whose only job modern Entra features can now do natively — every month they remain is patching, certificates, and attack surface for zero feature gain. Migration is therefore a decommissioning project: move authentication to cloud methods, move apps to Entra, then turn the farm off.
The migration sequence stems test: inventory what AD FS actually does (workforce sign-in? app relying parties? device claims?); move user authentication to PHS or PTA + Seamless SSO using staged rollout (pilot groups authenticate via cloud while the domain stays federated, then cut the domain over from federated to managed); move relying-party apps to Entra ID directly (SAML/OIDC app registrations / enterprise apps — Phase 4 mechanics); handle the stragglers (apps needing claims AD FS uniquely provided often map to Entra claims policies; true blockers like third-party on-prem MFA may justify remaining scoped federation); decommission and celebrate the removed certificates.
Entra Connect Health is the watchtower during and after: agents for Connect Sync (sync error taxonomy — duplicate attribute, data mismatch, large attribute; alerting on stalled sync), AD FS (sign-in volumes, bad-password attempts / lockout patterns against the farm, certificate expiry warnings), and AD DS (DC health). It requires P1 and surfaces in the portal with email alerting. Exam tells: "monitor sync errors centrally" or "get alerted before the AD FS certificate expires" → Connect Health with the matching agent.
⚠️ Exam Trap: Staged rollout is per-group and reversible while the domain remains federated — the domain-level cutover (Set-MsolDomainAuthentication lineage / modern Graph equivalent) is the separate, final step. Stems that skip piloting or flip the whole domain first are describing the risky path, not the recommended one.
Reflection Question: During staged rollout, a pilot user's sign-in stops honoring the third-party MFA that AD FS enforced. Explain why, and where that MFA requirement must be re-implemented before broad cutover.