WINDOWS SERVER 2022 • ACTIVE DIRECTORY • FEDERATION & SSO

Active Directory Federation Services (AD FS) on Windows Server 2022: A Practical Guide

Understand how AD FS enables claims-based authentication and single sign-on, plan a secure deployment, install the role, configure a federation service, and validate the setup on Windows Server 2022.

Author: Khurram Shahzad

Platform: Windows Server 2022

Technology: AD DS / AD FS / SSO

Level: Intermediate

Format: Step-by-step tutorial

Reading Time: 15–20 minutes

Centralize Authentication Across Trusted Applications

AD FS extends Active Directory identities to supported applications and partner services using claims-based identity, federation trust, and single sign-on. This guide covers the architecture and the key planning and configuration steps for Windows Server 2022.

Users & BrowsersInternal or external clients

Web Application ProxyOptional perimeter access layer

AD FS Federation ServiceAuthentication and token issuance

Active Directory DSIdentity store and authentication

Conceptual architecture — adapt to your network and trust requirements.

Featured visual: conceptual AD FS request flow. For the WordPress post, also set a dedicated featured image in the post settings; recommended image alt text: “Active Directory Federation Services architecture on Windows Server 2022”.

What this tutorial coversThis guide explains what AD FS does, when it is appropriate, which components and certificates are required, how to install the role on Windows Server 2022, how to create a federation service, and how to perform basic verification. The example is a lab-oriented starting point, not a complete production design.

Federated Identity

Learn how AD FS issues claims-based security tokens for trusted applications and partner services.

Secure Deployment

Understand service names, DNS, TLS certificates, service accounts, and WAP placement.

Practical Setup

Install the role, configure the federation service, and run checks to confirm the service is available.

Introduction to Active Directory Federation Services

Active Directory Federation Services (AD FS) is a Windows Server role that provides federated identity and claims-based authentication. It allows an organization to use identities held in its own identity system to authenticate users to applications or services that trust the organization’s federation service.

AD FS is commonly associated with single sign-on (SSO), partner federation, and applications that support protocols such as WS-Federation, SAML, or OAuth/OpenID Connect in supported configurations. The exact protocol and claim requirements depend on the application and AD FS version.

Example scenarioAn organization hosts an internal web application but wants employees to sign in using their corporate Active Directory accounts. The application is configured as a relying party, and AD FS issues the claims or tokens the application expects after authentication and policy evaluation.

Planning note: AD FS remains available on Windows Server 2022, but it is not the default answer for every new SSO project. Evaluate whether Microsoft Entra ID or another modern identity platform better fits cloud-first applications and your operational requirements before building new infrastructure.

What Is AD FS?

AD FS acts as a federation service between an identity provider and a relying party. Rather than sharing a user’s password with every application, a trusted application redirects or sends the user through an authentication flow and consumes a security token or claims issued by the federation service.

Component / Term	Purpose	Example
Federation Service	Authenticates users and issues tokens according to configured rules.	`fs.vmorecloud.com`
Active Directory DS	Provides domain identities and related authentication services.	Domain users and groups
Relying Party Trust	Represents an application or service that trusts AD FS.	Internal claims-aware web app
Claims Provider Trust	Represents an identity provider from which AD FS accepts claims.	Partner identity provider
Web Application Proxy	Publishes selected services externally and can provide AD FS preauthentication.	Perimeter/DMZ WAP server
Token-signing certificate	Cryptographically signs tokens issued by AD FS.	Certificate managed by AD FS

How AD FS Works

The following is a simplified request flow. Real deployments vary depending on whether the user is internal or external, the relying-party protocol, authentication policy, and whether WAP is deployed.

1. User opens an applicationThe application redirects the browser to the federation service when authentication is required.

2. AD FS authenticatesAD FS uses configured authentication methods and identity sources.

3. AD FS issues a tokenClaims and token format follow the relying-party configuration.

4. Application validates tokenThe relying party validates the token and applies its authorization rules.

Authentication is not the same as authorizationAD FS can authenticate a user and issue claims, but the relying-party application must correctly validate the token and enforce its own access-control rules. Do not assume that successful federation automatically grants the right level of access.

Prerequisites and Planning

A supported and fully patched Windows Server 2022 installation.
An Active Directory Domain Services environment with working DNS, time synchronization, and domain connectivity.
A planned federation service name, for example fs.vmorecloud.com.
A TLS/server-authentication certificate for the federation service name, including its private key.
Permissions to install Windows Server roles and configure the federation service.
A service account or supported group Managed Service Account (gMSA) selected according to Microsoft’s deployment guidance and your chosen farm configuration.
A relying-party application or lab application with documented federation requirements.
For external access, a separately planned Web Application Proxy deployment and firewall rules.

Do not expose a federation server directly to the internetMicrosoft recommends placing AD FS federation servers behind a firewall. Where external access is required, use a properly configured Web Application Proxy or another supported, reviewed architecture. Treat federation servers as high-value identity infrastructure.

Certificate and DNS Planning

Certificates and names are among the most common sources of AD FS deployment problems. Decide on the federation service name before running the configuration wizard.

Item	Planning guidance
Federation service name	Choose a stable DNS name such as `fs.vmorecloud.com`. It is not necessarily the Windows server’s computer name.
TLS/service communications certificate	Use a certificate trusted by the clients that connect to the service. Ensure the federation service name matches the certificate subject/SAN and the private key is available.
Token-signing certificate	AD FS uses this certificate to sign issued tokens. Protect private keys and plan certificate rollover.
Token-decrypting certificate	Used in relevant token-decryption scenarios. Keep certificate lifecycle and backup procedures documented.
DNS	Internal clients must resolve the federation service name to the intended endpoint. External resolution should point to the approved external access layer if WAP is used.

Certificate warningDo not use an untrusted self-signed TLS certificate for a production federation service that must be reached by unmanaged clients. Confirm certificate trust, expiry, revocation reachability, private-key availability, and name matching before troubleshooting the application.

Step 1: Install the AD FS Server Role

Sign in to the Windows Server 2022 computer that will host the federation service. Join it to the intended Active Directory domain before configuration, and verify that domain DNS and time synchronization are working.

Open Server Manager

From the Start menu, open Server Manager. Select Manage → Add Roles and Features.

Select the role-based installation

Choose Role-based or feature-based installation, select the local server, and continue to the Server Roles page.

Choose Active Directory Federation Services

Select Active Directory Federation Services. Accept any required features when prompted, continue through the wizard, and click Install.

Open the post-deployment configuration wizard

When installation finishes, select the Server Manager notification flag and click Configure the federation service on this server. Installing the role alone does not complete AD FS configuration.

PowerShell alternativeThe following command installs the role and management tools. It does not create or configure the federation service.

Install-WindowsFeature ADFS-Federation -IncludeManagementTools

Run the command in an elevated Windows PowerShell session. If you use PowerShell remoting or a remote management workstation, ensure you are targeting the intended server.

Step 2: Configure the Federation Service

Use the AD FS Federation Server Configuration Wizard to create a new federation service or join an existing farm. The exact wizard screens depend on the selected topology, database, service account, and certificate setup.

Choose the deployment option

For a new lab, choose Create the first federation server in a federation server farm. In production, decide in advance whether you need a farm, which database configuration you will use, and how high availability will be delivered.

Connect to Active Directory Domain Services

Provide the authorized domain account requested by the wizard. Use an account with only the permissions required for the deployment task and follow your organization’s privileged-access procedures.

Specify service properties

Select the prepared TLS certificate, enter the federation service display name, and provide the planned Federation Service name. For example, a lab might use fs.vmorecloud.com if that name is available in its DNS namespace and matches the certificate.

Configure the service account and database

Choose the supported service-account option and configuration database according to your design. Windows Internal Database (WID) may fit some smaller deployments; SQL Server and farm requirements should be assessed against Microsoft’s current topology guidance.

Review prerequisites and complete configuration

Review the prerequisite checks and warnings before selecting Configure. Resolve any certificate, permissions, database, DNS, or service-account errors before moving on.

Expected resultThe configuration wizard completes and the server becomes the first federation server for the configured federation service. Record the service name, certificate expiry date, service account, database choice, and recovery/backup procedure in your operational documentation.

Step 3: Configure DNS and Validate Connectivity

DNS must resolve the federation service name to the correct endpoint for each client network. In a simple internal lab, configure the internal DNS record according to your topology. In an external-access design, public DNS normally points to the approved WAP endpoint rather than directly to the federation server.

Check the server’s domain and DNS configuration

ipconfig /all
nslookup fs.vmorecloud.com

Replace fs.vmorecloud.com with your actual federation service name. The DNS response should match the design for the machine and network from which you run the query.

Check the local certificate store

Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter, Thumbprint, HasPrivateKey

Confirm that the intended certificate is installed in the Local Computer personal store, has a private key, is valid, and contains the required federation service name. Certificate requirements may differ when enabling optional services such as Device Registration Service.

Do not copy example DNS records blindlySplit-brain DNS, load balancers, multiple federation servers, and WAP can change the correct record targets. Use your network design and Microsoft’s deployment requirements to define the records.

Step 4: Plan External Access with Web Application Proxy

Web Application Proxy (WAP) is a Windows Server Remote Access role service that can publish selected internal web applications and integrate with AD FS for preauthentication. In an AD FS extranet topology, WAP is the perimeter-facing component; federation servers should remain protected on the internal network.

Internet clientConnects to the published service name over HTTPS.

WAP in perimeter networkReceives approved external traffic and proxies it to AD FS.

Internal AD FS farmProcesses authentication requests and issues tokens.

Relying-party applicationValidates tokens and enforces application permissions.

Use a separate WAP server or supported WAP farm topology; do not install WAP and AD FS federation server roles on the same computer.
Use the required trusted TLS certificate on WAP and ensure certificate names and trust chains are correct.
Allow only the required network paths and ports between clients, WAP, federation servers, and published applications.
Protect the WAP server, patch it, monitor it, and avoid placing federation-server private keys on the proxy.
Follow Microsoft’s current WAP-to-AD FS trust and registration procedure for the Windows Server versions you deploy.

External publishing is a separate deployment taskInstalling AD FS does not automatically make it safe or reachable from the internet. Do not open inbound internet access directly to the federation server as a shortcut.

Step 5: Verify the Deployment

After configuration, confirm that the AD FS service is running, the service properties match your intended federation name, and the endpoints respond from an authorized client. Use the following read-only PowerShell checks on the federation server.

Check the AD FS Windows service

Get-Service adfssrv

Review the federation service properties

Get-AdfsProperties | Select-Object HostName, Identifier, FederationPassiveAddress

Property names and output can vary by version and configuration. If a property is not available in your environment, use the AD FS Management console and current PowerShell reference to inspect the equivalent setting.

Inspect AD FS endpoints

Get-AdfsEndpoint | Select-Object Protocol, Address, Enabled

Check that required endpoints are enabled for the relying-party scenario. Do not enable every endpoint indiscriminately; enable only what the application and security design require.

Test from a client

Open the federation service metadata or sign-in endpoint specified by your application and AD FS configuration.
Confirm the TLS certificate is trusted and the URL matches the federation service name.
Complete a controlled test sign-in using an approved test account.
Validate that the relying-party application accepts the token and maps claims as expected.
Review AD FS Admin event logs if authentication fails.

Verification is not complete until the relying party worksA running AD FS service only confirms that the service process is available. Validate the full authentication path, token audience, issuer, claim rules, certificate trust, and application authorization.

Security Best Practices for AD FS

Keep federation servers behind internal firewalls and do not expose them directly to the internet.
Use trusted TLS certificates with correct subject/SAN names and secure private-key handling.
Limit administrative access and use dedicated privileged accounts according to your organization’s security model.
Patch Windows Server, AD FS, WAP, and dependent components promptly.
Monitor AD FS Admin events, sign-in activity, certificate expiration, and unusual authentication patterns.
Review relying-party trusts, claim rules, endpoint exposure, and authentication policies regularly.
Document token-signing and token-decrypting certificate rollover procedures; test rollover and recovery before an emergency.
Back up the AD FS configuration and required certificates/keys using an approved, protected process.
Use WAP or another supported, security-reviewed access layer for extranet scenarios.
Review whether Microsoft Entra ID can reduce the need for new on-premises federation infrastructure.

AD FS is high-value identity infrastructureA compromised federation server may issue tokens trusted by connected applications. Apply a hardened server baseline, minimize installed software, restrict management paths, and treat the system with protections appropriate to its role in identity security.

Troubleshooting Common AD FS Issues

Certificate name mismatch

Check that the TLS certificate subject/SAN includes the federation service name, the private key is present, and clients trust the issuing chain.

Federation service name does not resolve

Run nslookup from the affected network and verify internal/external DNS records against the intended topology.

Role installed, but configuration is incomplete

Return to Server Manager and complete the federation service configuration wizard. Installing the role does not create a working farm by itself.

Users can authenticate but the app rejects the token

Inspect relying-party trust settings, issuer and audience values, endpoint/protocol compatibility, claim rules, token-signing certificate trust, and the application’s logs.

External users cannot sign in

Verify WAP registration/trust, perimeter firewall rules, public DNS, TLS certificate consistency, and connectivity from WAP to the federation service.

Authentication fails unexpectedly

Review AD FS Admin event logs and relevant client/application logs. Check time synchronization, account status, authentication policy, and certificate validity.

Useful read-only diagnostic commands

Get-Service adfssrv
Get-AdfsProperties
Get-AdfsEndpoint | Select-Object Protocol, Address, Enabled
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter, HasPrivateKey

Run commands in an elevated PowerShell session where required. Avoid changing endpoints, trust settings, or certificates during initial diagnosis until you have captured the current configuration and identified the cause.

AD FS vs. Microsoft Entra ID

AD FS and Microsoft Entra ID both participate in identity and access scenarios, but they have different deployment models and operational responsibilities. Choose based on application requirements, identity architecture, compliance, and long-term operating costs.

Consideration	AD FS on Windows Server 2022	Microsoft Entra ID
Hosting	Customer-managed Windows Server infrastructure.	Cloud identity service, with hybrid integration options.
Operations	Requires management of servers, certificates, patching, availability, monitoring, and recovery.	Microsoft operates the core service; tenant configuration and identity governance remain customer responsibilities.
Application fit	Useful for supported legacy, on-premises, and federation scenarios that require AD FS.	Often a better fit for modern cloud applications and SaaS access.
External access	Typically needs WAP or another supported access layer for extranet scenarios.	Cloud endpoints and supported application proxy/hybrid capabilities can reduce the need to publish federation servers.
Decision	Use when a documented requirement justifies the on-premises federation service.	Evaluate first for new cloud-first SSO projects where application and policy requirements are met.

RecommendationFor a new deployment, document the requirement that makes AD FS necessary instead of assuming it is required for all Active Directory or Microsoft 365 environments. Use Microsoft’s current migration and identity guidance when assessing a move to Microsoft Entra ID.

Frequently Asked Questions

What is Active Directory Federation Services?

AD FS is a Windows Server role that provides federation and claims-based authentication so trusted applications can use identities from an organization or partner identity provider.

Is AD FS supported on Windows Server 2022?

Yes. Microsoft’s current AD FS documentation lists Windows Server 2022 among the applicable versions for the deployment and certificate guidance referenced in this article. Always check the support lifecycle and current product documentation for your exact scenario.

Does installing the AD FS role finish the deployment?

No. You must configure the federation service, certificates, service account, database/topology, DNS, and relying-party trust as applicable.

Do I need a public TLS certificate?

For production services accessed by unmanaged or internet clients, use a certificate trusted by those clients, typically from a public certification authority. Internal-only lab designs may use a different trust model, but every client must trust the certificate chain.

What is the difference between AD FS and WAP?

AD FS performs federation and issues tokens. Web Application Proxy is a perimeter-facing reverse proxy that can publish applications and provide AD FS preauthentication; it does not replace the federation service.

Can I put AD FS directly on the internet?

Do not expose federation servers directly to the internet. Use a supported external-access design, commonly involving WAP, and follow Microsoft’s network and security recommendations.

Does AD FS automatically provide single sign-on to every application?

No. The application must support a compatible federation protocol and be configured as a relying party or otherwise integrated. Claim mapping and application authorization must also be configured correctly.

Should I use AD FS or Microsoft Entra ID for a new project?

Evaluate Microsoft Entra ID first for cloud-first application access when it meets your requirements. Use AD FS when specific application, federation, or operational requirements justify maintaining on-premises federation infrastructure.

Conclusion

Active Directory Federation Services on Windows Server 2022 can provide claims-based authentication and federation for applications that require it. A successful deployment depends on careful planning of the federation service name, DNS, certificates, service account, configuration database, relying-party trust, and security boundaries.

For external access, keep federation servers protected behind the firewall and plan a supported WAP architecture. After setup, validate not only that the AD FS service is running, but that the full sign-in and relying-party token-validation process works as intended.

Final deployment checklistConfirm business need → plan topology and service name → prepare DNS and trusted certificates → install AD FS role → configure federation service → configure WAP if required → validate endpoints and relying-party trust → review logs and security controls → document backup and certificate rollover.

Continue Learning Windows Server and Identity

Explore more practical Windows Server, Active Directory, Microsoft 365, Azure, virtualization, and cybersecurity tutorials on VMoreCloud.

Windows Server • Active Directory • Identity Security • Azure • VMware • Linux

Sources & Further Reading

Khurram Shahzad

Hybrid Cloud & Virtualization Engineer

Hybrid Cloud & Virtualization Engineer specializing in VMware, Azure, AWS, Windows Server, Microsoft 365, Linux, networking, backup & disaster recovery. I share practical guides, technical projects and insights into modern IT infrastructure through VMoreCloud.

Technical note: This article provides a general lab-oriented overview. AD FS deployment steps, supported authentication methods, certificate requirements, and topology choices depend on the exact Windows Server build, application, and organization design. Review current Microsoft documentation and test in a non-production environment before implementation.