Back up federation settingsĪlthough this deployment changes no other relying parties in your AD FS farm, you can back up your settings:

Specifically, look for customizations in PreferredAuthenticationProtocol, federatedIdpMfaBehavior, SupportsMfa (if federatedIdpMfaBehavior isn't set), and PromptLoginBehavior. Verify any settings that might have been customized for your federation design and deployment documentation.

To find your current federation settings, run Get-MgDomainFederationConfiguration. When you step up Azure AD Connect server, it reduces the time to migrate from AD FS to the cloud authentication methods from potentially hours to minutes. Install Azure Active Directory Connect (Azure AD Connect) or upgrade to the latest version. Required rolesįor staged rollout, you need to be a Hybrid Identity Administrator on your tenant. Migration process flowīefore you begin your migration, ensure that you meet these prerequisites. To learn how to configure staged rollout, see the staged rollout interactive guide migration to cloud authentication using staged rollout in Azure AD). We recommend using staged rollout to test before cutting over domains. Refer to the staged rollout implementation plan to understand the supported and unsupported scenarios. Staged rollout is a great way to selectively test groups of users with cloud authentication capabilities like Azure AD Multi-Factor Authentication (MFA), Conditional Access, Identity Protection for leaked credentials, Identity Governance, and others, before cutting over your domains.

Microsoft sso login