Hi, I need to upgrade ADFS from windows 2008 R2 to Windows 2019. We have 10+ Relying party trust on the old ADFS. To minimize the impact, I plan to prepare a new ADFS so I can migrate them one by one to reduce the down time. Below are my questions. To direct the authentication to the new ADFS server, I need to register a new DNS name. Is it correct? We have one ADFS proxy on DMZ. Can one ADFS proxy to redirect the authentication to different ADFS server or do I have to create another ADFS proxy? If this isn't a right way to migrate Relying party trust, please advise the best way. Thanks in advance!

One WAP server can only use one ADFS farm. Is your ADFS on Windows Server 2008 R2 a farm deployment or a stand alone deployment? If that's a farm deployment, you can actually do a parallel run upgrade. It is the same process as in: https://video2.skills-academy.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn486815(v=ws.11) If that's a stand alone deployment, you will have do an actual migration. In that case you will need to bring a new infra with WAP and ADFS. And if the challenge is that you just have one public IP for the WAP, you could in theory publish the new WAP in a pass-through rule on the old WAP. DNS will have to follow, it will also break certificate based authentication (just in case you are using it).

Can one ADFS proxy associate with multiple ADFS server?

Grace Yin 111

Hi,

I need to upgrade ADFS from windows 2008 R2 to Windows 2019. We have 10+ Relying party trust on the old ADFS. To minimize the impact, I plan to prepare a new ADFS so I can migrate them one by one to reduce the down time. Below are my questions.

To direct the authentication to the new ADFS server, I need to register a new DNS name. Is it correct?
We have one ADFS proxy on DMZ. Can one ADFS proxy to redirect the authentication to different ADFS server or do I have to create another ADFS proxy?

If this isn't a right way to migrate Relying party trust, please advise the best way.

Thanks in advance!

1 answer

Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-08-03T20:07:25.317+00:00

One WAP server can only use one ADFS farm.

Is your ADFS on Windows Server 2008 R2 a farm deployment or a stand alone deployment?

If that's a farm deployment, you can actually do a parallel run upgrade. It is the same process as in: https://video2.skills-academy.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn486815(v=ws.11)

If that's a stand alone deployment, you will have do an actual migration. In that case you will need to bring a new infra with WAP and ADFS. And if the challenge is that you just have one public IP for the WAP, you could in theory publish the new WAP in a pass-through rule on the old WAP. DNS will have to follow, it will also break certificate based authentication (just in case you are using it).
Please sign in to rate this answer.
Grace Yin 111 Reputation points

2020-08-11T00:45:42.067+00:00

Hi Piaudonn,

Thank you very much for your reply. We have only one ADFS server. I guess we don't have a farm deployment, but I am not sure. I have searched up online, but I couldn't find the way to verify it. Can you tell me how I can determine if I have a farm development or not?

In case we have the standalone deployment, and public IP and DNS is not an issue, should I just set up another infra with WAP and ADPS (new IP, new DNS, new ADFS proxy), and then move the Relying party trust over one by one?

Please advise!

Thanks a lot!

Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-08-11T01:46:54.153+00:00

Open the Services console. If you see the ADFS service running as Network Service you have a standalone deployment. If it uses a service account, you have a farm deployment.

Grace Yin 111 Reputation points

2020-08-11T15:52:49.967+00:00

Hi Piaudonn,

OK, It is running as Network Service, so I have a standalone development. My plan is below. Please advise if it looks fine.

Install ADFS on the new server

Install a new ADFS Proxy server and map to new ADFS server

Register a DNS name for the new ADFS

Map the new ADFS proxy a new public IP

Get the new metadata and configure on web server

Create Relying party trust on new ADFS server

Need to do it one by one

Thank you in advance!

Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-08-11T20:54:31.353+00:00

Yeah, looks about right.

If your organization is using Azure AD you could also just create an Enterprise Application in Azure AD instead of Relaying Party Trusts in ADFS. Then no need to have ADFS anymore on-premises (you can still have SSO with Azure Active Directory Seamless Single Sign-On) and you can leverage Conditional Access Policies (CAP) and other nice security features in Azure AD (CAP requires Azure AD Premium licenses).

Grace Yin 111 Reputation points

2020-08-16T23:46:49.91+00:00

Hi Piaudonn,

We do have Azure AD, unfortunately we have Office 365 basic Azure AD version, which doesn't come with Group Access Management.

I have another idea which seems to make the upgrade easier. Can you help me to review it?

Upgrade the current ASFS 2.0 on Windows 2008 from standalone development to farm development.

Prepare a new ADFS 3.0 on Windows 2019

Join the new ADFS 3.0 to the ADFS farm

Remove the old ADFS server

I am thinking this should have much less work such as creating a new DNS server, new ADFS proxy server.

Please let me know if it is feasible. Please help!

Thank you very much!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Can one ADFS proxy associate with multiple ADFS server?

1 answer

Your answer