Migrating From ADFS to Azure AD With Active Authentication
Last Updated:
Overview
This article clarifies whether it is possible to migrate a user base from the Active Directory Federation Services (ADFS) enterprise connector to the Azure Active Directory (Azure AD) enterprise connector while maintaining active authentication.
Applies To
- Active Directory Federation Services (ADFS) Enterprise Connector
- Azure Active Directory (Azure AD) Enterprise Connector
- Active Authentication
Solution
- Active Directory Federation Services (ADFS) connections can be directed to Azure Active Directory (Azure AD) instances by modifying the metadata set on the ADFS connection. Azure uses the following URL for the metadata:
https://login.microsoftonline.com/<tenant-id>/federationmetadata/2007-06/federationmetadata.xml?appid=<application-id>- Ensure that the name identifier returned from Azure AD matches the identifier returned by ADFS to maintain a smooth transition.
NOTE: If active authentication is required (passing the username and password directly to Auth0 to log the user into Azure AD via /oauth/token), this configuration does not function with an ADFS connection. ADFS connections rely on the following endpoint, which Azure AD does not support:
https://${adfs_server_url.host}/adfs/services/trust/13/usernamemixedTo migrate while using active authentication, follow these steps:
-
Use an Azure AD connection with the resource owner flow configuration to enable active authentication. Refer to the Connect Your Native App to Microsoft Azure Active Directory Using Resource Owner Flow documentation.
-
If the ADFS connection user profiles must be retained, link them to the relevant Azure AD connection user after the user logs in at least once to create their Azure-based account.
-
Set the ADFS identity as the primary identity. The user can log in through the Azure AD connection, but the profile that Auth0 returns is that of the ADFS connection user. Refer to the User Account Linking documentation.
