
### What is ADFS? {#what-is-adfs}

**Active Directory Federation Service (ADFS)** is a software component developed by Microsoft to provide Single Sign-On (SSO) authorization service to users on Windows Server Operating Systems. ADFS allows users across organizational boundaries to access applications on Windows Server Operating Systems using a single set of login credentials.

ADFS makes use of the claims-based Access Control Authorization model to ensure security across applications using the federated identity. Claims-based authentication is a process in which a user is identified by a set of claims related to their identity. The claims are packaged into a secure token by the identity provider.

### How does ADFS work? {#how-does-adfs-work}

The authentication process using the Active Directory Federation Service (ADFS), takes place in the following steps:

- The user navigates to a service, for example, a partner-company website (http://example.com) to obtain pricing or product details.
- The website requests an authentication token.
- User requests token from the ADFS server.
- ADFS server issues token containing user’s set of claims.
- User forwards token to the partner-company website.
- The website grants authorization access to the user.

### What are the components of ADFS? {#what-are-the-components-of-adfs}

- **Active Directory**: The Identity Information which is to be used by ADFS is stored on the Active Directory.
- **Federation Server**: It contains the tools needed to manage federated trusts between business partners. It processes authentication requests coming in from external users and hosts a security token service that issues tokens for claims based on verification of credentials from AD.
- **Federation Server Proxy**: The Proxy is deployed on the extranet of the organization, to which external clients connect when requesting a security token. It forwards these requests to the Federation Server. The Federation server is not exposed directly to the internet to prevent security risks.
- **ADFS Web Server**: It hosts the ADFS Web Agent which manages the security tokens and authentication cookies sent to it for authentication purposes.

### Why ADFS is used by organizations? {#Why-adfs-is-used-by-organizations}

Using Active Directory (AD) in the connected online world creates authentication challenges. AD cannot authenticate users who try to access integrated applications externally. In the modern workplace, users often need to access applications that are not owned or managed by their organization’s AD. ADFS is able to resolve and simplify these third-party authentication challenges.

ADFS allows users from one organization to access applications of partner organizations using the standard credentials of their organization’s Active Directory (AD). ADFS also lets users access AD-integrated applications while working remotely using their standard organizational AD credentials via a web interface. When establishing a partnership to use another organization’s web applications, ADFS provides a central place to manage and audit the employee identity information that is shared with their organization’s partners.

Over 90% of organizations use Active Directory, which means many use ADFS as well.

**ADFS can be used in the below scenarios**

- **Single Sign-On (SSO)**: ADFS can be used to provide Single Sign-On (SSO) authorization to users who want to access applications located in different networks or organizations. It provides seamless Single Sign-On (SSO) access to Internet-facing applications or services.
- **Identity Federation (Identity Management)**: Federated Identity is a concept where a user’s identity is centralized. This makes Identity Management easier. Identity Management is done to maintain security while keeping the costs associated with managing user identities, low.

**ADFS Office 365 example**

- Office 365 uses an Active Directory environment wherein a dedicated domain is created on the cloud for each user’s Office 365 subscription.
- ADFS is used here by setting up directory synchronization (DirSyc tool) that creates accounts in Microsoft’s domain matching the accounts within the user’s domain.
- A user can select accounts that should be synchronized in the AD.

### What are the limitations of ADFS? {#what-are-the-limitations-of-adfs}

- **Maintenance Costs**: ADFS generates a high cost of maintenance which consists of infrastructure maintenance, management of multiple federations, SSL certificate costs.
- **ADFS Complexity**: Adding an application or system to an ADFS service is complex and time-consuming. It doesn’t have a user-friendly management dashboard for managing users, groups, and authentication policies.
- **ADFS Security issue**: ADFS runs on Windows Server, that have more security issues like vulnerability to malware and other security related errors.
- ADFS does not allow file-sharing or printing using print servers.
- ADFS cannot access Active Directory resources.
- ADFS does not support Remote Desktop connections.

### ADFS Vs miniOrange IDP {#adfs-vs-miniorange}

| Features                           | ADFS                                                | miniOrange IDP                                        |
|------------------------------------|-----------------------------------------------------|-------------------------------------------------------|
| Multi-Protocol support              | Supports limited protocol (SAML 2.0, WS-Federation & OAuth 2.0) | Fully Supports all protocols for Authentication      |
| MFA (Multi-factor Authentication)   | It supports limited MFA methods                     | It supports 15+ MFA methods                           |
| Single Sign-On into Mobile Apps     | Doesn’t support                                      | It supports SSO into Mobile Apps                     |
| Adaptive Authentication             | Doesn’t support                                      | It supports                                          |
| JWT                                | Doesn’t support                                      | It supports                                          |


### Related Articles of ADFS Integration {#related-articles-of-adfs-integration}

- [ADFS As IDP](https://www.miniorange.com/iam/login-with-external-idp/configure-adfs-sso)
- [WordPress ADFS Login](https://wordpress.org/plugins/miniorange-adfs-login/)
- [What is Single Sign-On SSO?](https://blog.miniorange.com/what-is-single-sign-on-sso/)
- [ADFS SSO with Joomla](https://plugins.miniorange.com/guide-joomla-single-sign-sso-using-adfs-idp)


What is ADFS ? Active Directory Federation Service (ADFS) is a software component created by Microsoft to provide Windows Server operating systems Single Sign-On to users..It is a feature that allows sharing of identity information outside a company’s network. Know more about ADFS components and why it is used.

What is ADFS?


### What is Azure Active Directory? {#what-is-azure-active-directory}

Azure Active Directory (Azure AD) is Microsoft’s cloud service that provides identity and access management (IAM). It is part of the Office 365 system, it is compatible with an on-premise active directory, and is useful to provide authentication to multiple cloud-based services via various cloud protocols such as SAML, OAuth2, and WS Security. It provides the ability to manage user identities and access rights. Azure AD combines core directory services, access management, and identity protection into a single solution.

Azure AD allows your users to sign in and access the resources which are in external resources such as Office 365 and thousands of other Software as a service (SaaS) applications. It also allows your users to gain access to internal resources such as applications on your company network and intranet. Azure AD uses Representational State Transfer (REST) APIs to connect with other web-based applications. In this directory, the admin has the capability to create groups and add accounts to those groups. Group access to resources can then be assigned to them. Mobile devices and Windows desktops can connect to Azure AD using Microsoft Intune.

### How does Azure Active Directory work? {#how-does-azure-active-directory-work}

The Azure Active Directory Authentication takes place in the following steps:

- The user navigates to the application and requests access.
- An authentication request is sent to the miniOrange Broker Service.
miniOrange Broker identifies the Azure AD and sends authentication requests to Azure AD.
- Azure Active Directory authenticates the user and generates the SAML token, LDAP authentication Response is sent to the broker.
- miniOrange broker posts the SAML response to the Service provider (Application) via the user’s browser.
- The service provider (Application) verifies the SAML response and access is granted to the user.

![Azure Active Directory Authentication Flow](/blog/assets/2023/azure-active-directory-authentication-flow.webp)

### Windows Active Directory vs Azure Active Directory {#windows-active-directory-vs-azure-active-directory}

Windows Active Directory, launched by Microsoft in 2000, is the predecessor to the Azure Active Directory, which has become the standard for enterprise identity management since its launch. Unlike Azure Active Directory, the Windows Active Directory uses Lightweight Directory Access Protocol (LDAP) to connect with other web-based applications. It also does not manage mobile devices. Group Policies (GPOs) are usually used to govern desktops and servers connected to Windows Active Directory. Finally, Kerberos and NTLM protocols are used to validate user credentials.

Because of the limitations of Windows Active Directory in cloud contexts, Microsoft created Azure Active Directory. Users may use Azure AD to manage all of their cloud apps and servers, including Office 365, SharePoint Online, and Exchange Online.

The key distinction between the two platforms is that Azure AD uses Representational State Transfer (REST) API interfaces to provide web-based applications. As previously indicated, it accomplishes this through the use of unique protocols and code bases. You will instantly become an Azure AD Tenant after you register with one of Microsoft’s cloud apps. This means you can manage all users, permissions, passwords, and more from a single location.

### Benefits of azure active directory {#benefits-of-azure-active-directory}

**Simple Integration:**
Because Azure AD supports a wide range of identity providers, users may log in using their Microsoft, Google, Facebook, or GitHub accounts. Azure AD may also be integrated with a variety of apps, including Salesforce, Office 365, and others.

**Strong Azure AD Security:**
Microsoft, as you might assume, takes security very seriously. Multi-factor authentication, conditional access, and Privileged Identity Management (PIM) are just a few of the security features available in Azure AD.

**High Availability:**
Microsoft promises a 99.9% availability guarantee. Azure AD is highly available thanks to a distributed architecture that spans 28 data centers throughout the globe. All data is written to the Active Primary partition first, then duplicated to the Passive Primary, and finally read from the Secondary Replica partitions.

**Collaboration:**
By granting access to the internal project site or material, Azure AD aids collaboration outside the business, such as with partners. Azure AD B2B (business-to-business) and Azure AD B2C (business-to-consumer) are the two major external collaboration functions. You may invite business colleagues to your application or service using the B2B functionality, and they can sign in using their current Azure identity. The B2C functionality is similar, except your clients may sign in to your app or service using their preferred identity provider (Facebook, Google, GitHub, etc.). MFA and Conditional Access rules can be used to control access to resources in both circumstances.

**Single sign-on:**
This allows onboarding new workers, terminating access for outgoing employees, and implementing access to new cloud services easier and faster, allowing users to get up and running faster. Single sign-on also promotes commitment to security and identification rules.

**Multi-Factor Authentication:**
This adds an extra degree of protection to accounts by requiring another form of verification. Microsoft Authenticator app, OATH Hardware token, OATH Software token, SMS, Voice call, and other MFA verification methods are available in Azure AD.

### Limitations of Azure Active Directory Authentication {#limitations-of-azure-active-directory-authentication}

- **Limited MFA methods**: Azure Active Directory Authentication supports limited Multi-Factor Authentication (MFA) methods.
- **No Group policy**:  It has few policy tools like conditional access, but it is more focused on granting access.
- **No support for NTLM or Kerberos**: Azure AD Authentication supports only modern authentication protocols like OAuth, SAML & OpenID Connect.
- **Limited OAuth support**: It does not have support for all OAuth grants.
- No support to extend or customize existing protocols with custom apps.
- Limited support for Device, location, and time-based access policies.

###  Azure Active Directory Authentication Components {#azure-active-directory-authentication-components}

- **Service Provider** - Service providers are responsible for communications between the user, an identity provider that maintains a user directory. In this case, Azure Active Directory is an identity provider and the application could be a Service provider.
- **Identity Provider** - Here Azure AD is an identity provider. So  As an Identity Provider, it authenticates the user and provides an authentication token (that is, information that verifies the authenticity of the user) to the service provider.

Click [here](https://www.microsoft.com/en-in/security/business/identity-access/microsoft-entra-id) to learn more about Azure Active Directory.

### Azure Active Directory VS miniOrange IdP {#azure-active-directory-vs-miniorange-idp}

| Features                  | Azure Active Directory                                    | miniOrange IdP                                      |
|---------------------------|---------------------------------------------------------|-----------------------------------------------------|
| Multi-Protocol support    | Supports only a few modern authentication protocols (OAuth, SAML & OpenID Connect) | Fully supports all protocols for Authentication.  |
| Multi-Factor Authentication | Supports limited Multi-Factor Authentication methods.  | Supports 15+ Multi-Factor Authentication methods.  |
| Pricing Plans             | A fixed annual subscription. (No quote-based pricing plan). | A flexible monthly & quote-based pricing plan for all size organizations. |
| Security                  | Doesn’t support.                                       | It supports fraud prevention, social login, and cloud security. |
| Adaptive Authentication   | Doesn’t support.                                       | It supports Adaptive Multi-Factor Authentication.    |


### Further Reading {#further-reading}

- [Directory Services](https://www.miniorange.com/products/directory-services)
- [Single Sign-On SSO](https://blog.miniorange.com/what-is-single-sign-on-sso/)
- [Login Using Azure AD](https://www.miniorange.com/iam/login-with-external-idp/configure-azure-ad-sso)


Microsoft Azure Active Directory (Azure AD) is cloud service that provides IAM & helps administrators handle multiple user logins.

AZURE AD Authentication

What is ADFS?

What is Azure Active Directory? | Microsoft Azure AD