Building Identity Federation With Saml Azure Ad

Building Identity Federation with SAML Azure AD

Overview

Identity federation enables users authenticated by one identity provider to access resources managed by another without maintaining separate credentials. This skill covers establishing SAML 2.0 federation between an organization's on-premises Active Directory (via AD FS or third-party IdP) and Microsoft Entra ID (formerly Azure AD), as well as configuring federated SSO for third-party SaaS applications. Federation eliminates password synchronization concerns and keeps authentication authority on-premises while extending SSO to cloud resources.

When to Use

• When deploying or configuring building identity federation with saml azure ad capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Common Misconfigurations & Verification

• Assertion signature not enforced: the SP/relying party accepts an unsigned or SP-signed-only <saml:Assertion>, enabling signature stripping. Verify the IdP signs the assertion (not just the <Response>) and the SP rejects SignatureMethod=rsa-sha1 and unsigned assertions. Test by replaying a captured assertion with the <ds:Signature> removed — it must fail.
• Golden SAML exposure: anyone who can export the AD FS token-signing private key can mint assertions for any user. Confirm the key lives in an HSM/DKM-protected store, alert on Set-AdfsCertificate and event 307/510, and rotate after any DC/AD FS compromise.
• Audience/recipient not validated: SP ignores <AudienceRestriction> or Recipient, so a token issued for app A is replayed at app B. Verify each SP pins its own EntityID as the required audience.
• NameID and NotOnOrAfter: persistent NameID plus missing NotOnOrAfter/NotBefore checks allow indefinite replay. Confirm short assertion lifetimes and that InResponseTo is bound to a real AuthnRequest.
• Verification: pull Get-MgDomainFederationConfiguration -DomainId corp.example.com and confirm signingCertificate, issuerUri, and preferredAuthenticationProtocol=saml match AD FS; decode an assertion with SAML-tracer and confirm signed assertion, correct Audience, and a fresh NotOnOrAfter.

Prerequisites

• On-premises Active Directory domain
• AD FS 2019+ or third-party SAML IdP (Okta, Ping, etc.)
• Microsoft Entra ID tenant (P1 or P2 license recommended)
• Azure AD Connect (if using hybrid identity with password hash sync as backup)
• Public TLS certificate for federation endpoint
• DNS records for federation service name

Core Concepts

Federation Models

SAML Federation Architecture

User → Cloud App (SP)
   │
   └── Redirect to Azure AD
          │
          ├── Azure AD checks federated domain
          │
          └── Redirect to on-premises AD FS
                 │
                 ├── AD FS authenticates against Active Directory
                 │
                 ├── AD FS issues SAML token
                 │
                 └── Token posted back to Azure AD
                        │
                        ├── Azure AD validates federation trust
                        │
                        ├── Azure AD issues its own token
                        │
                        └── User receives access token for cloud app

Federation Trust Components

Workflow

Step 1: Prepare AD FS Infrastructure

# Install AD FS role
Install-WindowsFeature ADFS-Federation -IncludeManagementTools

# Configure AD FS farm
Install-AdfsFarm `
    -CertificateThumbprint $certThumbprint `
    -FederationServiceDisplayName "Corp Federation Service" `
    -FederationServiceName "fs.corp.example.com" `
    -ServiceAccountCredential $gmsaCredential

# Verify AD FS is operational
Get-AdfsProperties | Select-Object HostName, Identifier, FederationPassiveAddress

Step 2: Configure Azure AD Federated Domain

# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Domain.ReadWrite.All"

# Convert managed domain to federated
# Using AD FS federation metadata URL
$domainId = "corp.example.com"
$federationConfig = @{
    issuerUri = "http://fs.corp.example.com/adfs/services/trust"
    metadataExchangeUri = "https://fs.corp.example.com/adfs/services/trust/mex"
    passiveSignInUri = "https://fs.corp.example.com/adfs/ls/"
    signOutUri = "https://fs.corp.example.com/adfs/ls/?wa=wsignout1.0"
    signingCertificate = $base64Cert
    preferredAuthenticationProtocol = "saml"
}

# Apply federation settings to domain
New-MgDomainFederationConfiguration -DomainId $domainId -BodyParameter $federationConfig

Step 3: Configure AD FS Claims Rules

# Add Relying Party Trust for Azure AD
Add-AdfsRelyingPartyTrust `
    -Name "Microsoft Office 365 Identity Platform" `
    -MetadataUrl "https://nexus.microsoftonline-p.com/federationmetadata/2007-06/federationmetadata.xml"

# Configure claim rules
$rules = @"
@RuleTemplate = "LdapClaims"
@RuleName = "Extract AD Attributes"
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
   Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory",
   types = ("http://schemas.xmlsoap.org/claims/UPN",
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"),
   query = ";userPrincipalName,mail,givenName,sn;{0}",
   param = c.Value);

@RuleTemplate = "PassThroughClaims"
@RuleName = "Pass Through UPN as NameID"
c:[Type == "http://schemas.xmlsoap.org/claims/UPN"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
   Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer,
   Value = c.Value,
   ValueType = c.ValueType,
   Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"]
       = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent");
"@

Set-AdfsRelyingPartyTrust `
    -TargetName "Microsoft Office 365 Identity Platform" `
    -IssuanceTransformRules $rules

Step 4: Configure Third-Party SaaS Federation

For each SaaS application that supports SAML SSO via Azure AD:

1. Navigate to Microsoft Entra Admin Center > Enterprise Applications
2. Add the application from the gallery (or create custom SAML)
3. Configure Single Sign-On > SAML:
   • Identifier (Entity ID): Application's entity ID
   • Reply URL (ACS): Application's assertion consumer service URL
   • Sign-on URL: Application's login URL
4. Map user attributes/claims:
   • NameID: user.userprincipalname (email format)
   • Additional claims as required by the application
5. Download the Federation Metadata XML or certificate
6. Configure the SaaS app with Azure AD's federation details

Step 5: Certificate Lifecycle Management

AD FS token-signing certificates expire and must be renewed:

# Check current certificate expiration
Get-AdfsCertificate -CertificateType Token-Signing | Select-Object Thumbprint, NotAfter

# AD FS supports auto-rollover (enabled by default)
Get-AdfsProperties | Select-Object AutoCertificateRollover

# If manual rotation is needed:
# 1. Add new certificate as secondary
Set-AdfsCertificate -CertificateType Token-Signing -Thumbprint $newThumbprint -IsPrimary $false
# 2. Update Azure AD with new certificate
# 3. Promote to primary
Set-AdfsCertificate -CertificateType Token-Signing -Thumbprint $newThumbprint -IsPrimary $true
# 4. Remove old certificate
Remove-AdfsCertificate -CertificateType Token-Signing -Thumbprint $oldThumbprint

Validation Checklist

• AD FS farm operational with valid TLS and token-signing certificates
• Azure AD domain configured as federated with correct metadata
• Claims rules properly transform AD attributes to SAML assertions
• Test user can authenticate through federation flow end-to-end
• MFA enforced at AD FS or Azure AD conditional access level
• Certificate auto-rollover enabled or manual rotation scheduled
• Federation metadata endpoint publicly accessible
• Smart lockout configured to prevent brute force
• Extranet lockout policies configured on AD FS
• Monitoring configured for AD FS health and certificate expiry
• Disaster recovery: managed authentication fallback documented

References

• Microsoft Entra Federation Documentation
• AD FS Design Guide
• Configure AD FS for Azure AD Federation
• SAML 2.0 Authentication - OASIS