Академический Документы
Профессиональный Документы
Культура Документы
| TechNet Search
(http://technet.microsoft.com/)
Sign in (https://blogs.technet.microsoft.com/wp-login.php?aadsso_action=login)
(https://blogs.technet.microsoft.com
/rmilne/feed/)
(http://ca.linkedin.com
/in/rhoderickmilne)
About Me -
Biography
(https://blogs.technet.microsoft.com
/rmilne/about/)
(https://blogs.technet.microsoft.com
/rmilne/about/)
Email Address
Subscribe!
Unsubscribe
Popular Tags
Exchange
(https://blogs.technet.microsoft.com
/rmilne/tag/exchange/)
1 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
Upon It
/rmilne/tag/tips-n-tricks/)
Office 365
(https://blogs.technet.microsoft.com
Before we discuss the integration of Office with the on-premises AD FS infrastructure, lets just again be
/rmilne/tag/office-365/)
clear on the criticality of ensuring that AD FS is available when the Office 365 domain is set to use AD FS
authentication. For whatever reason if the AD FS infrastructure is unavailable, then Office 365 cannot PowerShell
complete the authentication process and thus users cannot get access to Office 365. This will cause a (https://blogs.technet.microsoft.com
service impacting outage that will require resolution from you, not Microsofts online services team. /rmilne/tag/powershell/)
For this reason, unless you really need to leverage AD FS please review the Azure AD Connect password Exchange 2013 SP1
hash synchronisation feature. (https://blogs.technet.microsoft.com
Apologies if I sound pessimistic, but I dont want to obviate the requirement for AD FS redundancy! /rmilne/tag/exchange-2013-sp1/
AD FS in Azure
Exchange 2007
(https://blogs.technet.microsoft.com
/rmilne/tag/exchange-2007/
On the topic of AD FS redundancy one option is to also host a portion of your AD FS infrastructure in
Azure. This is a perfect solution if you do not have sufficient capacity in your current datacentre, or your Windows
datacentres are located in close proximity of each other and a major incident would take both of them (https://blogs.technet.microsoft.com
down. /rmilne/tag/windows/)
There is a whitepaper published for this exact scenario. Please check this link Exchange 2010 SP3
(http://technet.microsoft.com/library/dn509539.aspx). The documentation covers three main scenarios (https://blogs.technet.microsoft.com
to meet the situations discussed above: /rmilne/tag/exchange-2010-sp3/
Scenario 1: All Office 365 SSO integration components deployed on-premises. This is the Hyper-V
traditional approach; you deploy directory synchronization and Active Directory Federation (https://blogs.technet.microsoft.com
Services (AD FS) by using on-premises servers. /rmilne/tag/hyper-v/)
Scenario 2: All Office 365 SSO integration components deployed in Windows Azure. This is
Exchange 2016
the new, cloud-only approach; you deploy directory synchronization and AD FS in Windows
(https://blogs.technet.microsoft.com
Azure. This eliminates the need to deploy on-premises servers.
Scenario 3: Some Office 365 SSO integration components deployed in Windows Azure for /rmilne/tag/exchange-2016/
disaster recovery. This is the mix of on-premises and cloud-deployed components; you deploy Azure
directory synchronization and AD FS, primarily on-premises and add redundant components in (https://blogs.technet.microsoft.com
Windows Azure for disaster recovery. /rmilne/tag/azure/)
Supportability Dates
This is an example of hosting AD FS in Azure for DR purposes: (https://blogs.technet.microsoft.com
/rmilne/tag/supportability-dates/
AD FS
(https://blogs.technet.microsoft.com
/rmilne/tag/adfs/)
Exchange Workshop
(https://blogs.technet.microsoft.com
/rmilne/tag/exchange-workshop/
2 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
Outlook
(https://blogs.technet.microsoft.com
/rmilne/tag/outlook/)
Recent Posts
How To Install AD FS
2016 For Office 365
Part 3
(https://blogs.technet.microsoft.com
/rmilne/2017/05
/14/how-to-install-
ad-fs-2016-for-office-
365-part-3/)
Unable to RDP to
Azure VM From Hotel
WiFi
(https://blogs.technet.microsoft.com
/rmilne/2017/05
/12/unable-to-rdp-
to-azure-vm-from-
hotel-wifi/)
How To Install AD FS
2016 For Office 365
Part 2
(https://blogs.technet.microsoft.com
/rmilne/2017/05
/10/how-to-install-
AD FS is supported for deployment on Azure Virtual Machines (http://msdn.microsoft.com/en-us/library
ad-fs-2016-for-office-
/azure/jj156090.aspx#BKMK_WhyADFS), but there are AD FS best practices that require technologies
365-part-2/)
beyond what AD FS offers itself, such as load balancing/high availability. In addition to this please also
Office 365 Workshop
consider the pricing for running this IAAS. Read through the deployment caveats in the AD FS Azure
Links May 2017
documentation above and also the additional discussion points here (http://msdn.microsoft.com/en-us
(https://blogs.technet.microsoft.com
/library/azure/jj156090.aspx#BKMK_ContrastsForADFS).
/rmilne/2017/05
Updating AD FS
/05/office-
365-workshop-links-
may-2017/)
Back to the business at hand updating Office 365 so that it now uses your on-premises AD FS server!
How To Install AD FS
To do this we will need to leverage the Azure AD PowerShell cmdlets.
2016 For Office 365
In the previous posts we reviewed the required pre-requisites. One to circle back on was that the AD FS (https://blogs.technet.microsoft.com
servers will require Internet access to complete the configuration with Office 365. This will require /rmilne/2017/04
outbound access on HTTP and HTTPS using ports TCP 80 and 443 respectively. If this is not open, then /28/how-to-install-
you will receive an error. ad-fs-2016-for-
office-365/)
Note that at the time of writing there are two modules for administering Azure AD. Currently the V1
and V2 modules are available, which are separate modules and installations from one another. The V1
Archives
module is called MSOnline and the V2 is called AzureAD.
May 2017
Azure Active Directory V2 General Availability Module overview information can be found here
(https://blogs.technet.microsoft.com
(https://docs.microsoft.com/en-us/powershell/azure/overview?view=azureadps-2.0). For detailed
/rmilne/2017/05/)(4)
information on how to install and run this module from the PowerShell Gallery including prerequisites,
April 2017
please review this (https://msdn.microsoft.com/powershell/gallery/readme).
(https://blogs.technet.microsoft.com
/rmilne/2017/04/)(12)
March 2017
Currently not all of the V1 module commands are present in V2. This gap will be closed over time.
(https://blogs.technet.microsoft.com
While some tasks need to be accomplished using the V2 module, this post will use the V1 module. The
/rmilne/2017/03/)(6)
below is an example of the V2 module. We can see the name of AzureAD and its version using the
February 2017
below cmdlets:
(https://blogs.technet.microsoft.com
Get-Module AzureAD /rmilne/2017/02/)(5)
January 2017
Get-Command *AzureADDomain*
(https://blogs.technet.microsoft.com
/rmilne/2017/01/)(2)
All of 2017
(https://blogs.technet.microsoft.com
/rmilne/2017/)(29)
All of 2016
(https://blogs.technet.microsoft.com
/rmilne/2016/)(56)
3 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
All of 2015
(https://blogs.technet.microsoft.com
/rmilne/2015/)(72)
All of 2014
(https://blogs.technet.microsoft.com
/rmilne/2014/)(83)
All of 2013
(https://blogs.technet.microsoft.com
/rmilne/2013/)(63)
All of 2012
(https://blogs.technet.microsoft.com
/rmilne/2012/)(51)
(https://msdnshared.blob.core.windows.net/media/2017/05/image158.png) All of 2011
(https://blogs.technet.microsoft.com
/rmilne/2011/)(20)
We can get the V1 module from Quick Tip: Is There A Shortcut URL To Download Azure AD PowerShell
(https://blogs.technet.microsoft.com/rmilne/2015/06/19/quick-tip-is-there-a-shortcut-url-to-download-
azure-ad-powershell/). Select the Azure Active Directory Connection download page
(http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185)
download, and scroll down to the bottom of the page. Download and install the V1 MSI installation file.
At the time of writing this was version 1.1.166.0.
The shortcut to the Azure AD module can be found under administrative tools, and also on the desktop.
It should be listed as Active Directory Module for Windows PowerShell.
In order to manually import the Azure AD V1 module we can run the below in PowerShell:
Import-Module MSOnline
Rather than having to type that, in this case we will run the shortcut to the Active Directory Module for
Windows PowerShell on a domain joined server on the corporate network. For reference this machine is
DC-2.wingtiptoys.ca, and the primary AD FS server is ADFS-2016-1.wingtiptoys.ca.
(https://msdnshared.blob.core.windows.net/media/2017/05/image159.png)
We can see the current status of the domains within this tenant. the Get-MsolDomain
(http://msdn.microsoft.com/en-us/library/azure/dn194090.aspx) cmdlet will show the domains, and we
are interested in the first domain Wingtiptoys.ca.
4 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
(https://msdnshared.blob.core.windows.net/media/2017/05/image160.png)
(https://msdnshared.blob.core.windows.net/media/2017/05/image184.png)
An area of concern should be noted here for customers that have multiple top level domains. Back with
early AD FS 2.0 builds customers with multiple top level UPNs had to deploy separate AD FS instances
for each domain suffix. A rollup (http://support.microsoft.com/kb/2607496) was added to assist with
this and the SupportMultipleDomain switch. Please see here for more details
(http://community.office365.com/en-us/w/sso/support-for-multiple-top-level-domains.aspx) if you have
multiple sign-on domains.
(https://msdnshared.blob.core.windows.net/media/2017/05/image185.png)
5 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
(https://msdnshared.blob.core.windows.net/media/2017/05/image186.png)
Please be aware that it can take up to two hours for domain authentication changes to apply. Go drink
a vat of coffee or play some crossy road!
(https://msdnshared.blob.core.windows.net/media/2017/05/image260.png)
6 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
(https://msdnshared.blob.core.windows.net/media/2017/05/image261.png)
The astute reader will notice that Edge in-private mode was used. This keeps my testing separate from
the other IE Instances running on my laptop.
One thing to note, when testing this connectivity please do so on a regular client machine that has the
proper access to the Internet and where the browser is not totally locked down. For example on a
Server 2008 R2 SP1 server, when browsing to https://outlook.office365.com/wingtiptoys.ca
(https://outlook.office365.com/wingtiptoys.ca) the user experience is very different from the screenshots
above.
For lab purposes, you can relax the browser hardening from the default level so that you can test Office
365 from a Windows Server. Please review this post (https://blogs.technet.microsoft.com/rmilne
/2017/04/21/unable-to-access-owa-or-office-365-portal-on-servers/) for the necessary steps.
7 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
(https://msdnshared.blob.core.windows.net/media/TNBlogsFS/prod.evol.blogs.technet.com
/CommunityServer.Blogs.Components.WeblogFiles/00/00/00/91/09/metablogapi/image_1605BC97.png)
KB 2650717 How to diagnose single sign-on (SSO) logon issues in Office 365 by using Remote
Connectivity Analyzer (http://support.microsoft.com/kb/2650717) discusses using the tool to validate
SSO.
BONUS TIP if you get tired of typing that long URL to get to the site, try http://exrca.com
(http://exrca.com)
(https://msdnshared.blob.core.windows.net/media/2017/05/image262.png)
Note that we went to the following URLs. Can you work out why there are three outlook.com ones at
the top?
8 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
(https://msdnshared.blob.core.windows.net/media/2017/05/image263.png)
Additional Reading
I love this KB as it links to so many other articles that are relevant and introduce many of the issues that
can arise with an AD FS deployment.
Cheers,
Rhoderick
9 of 10 15-05-2017 20:52
How To Install AD FS 2016 For Office 365 Part 3 250 Hello https://blogs.technet.microsoft.com/rmilne/2017/05/14/how-to-install-a...
(https://blogs.technet.microsoft.com/rmilne/tag/office-365/)
Comments (0)
Name *
Email *
Website
Post Comment
10 of 10 15-05-2017 20:52