Welcome to the ITFreeTraining video on the features of Active Directory Federation Services.
This video will look at features and differences between the different versions of Active Directory
Federation Services available from Microsoft. By the end of this video, you will know which
features are available and which operating systems you will need to use in order to get
these features.
The first version I will look at is version 3.0. This is the latest version of Active
Directory Federation Services. In order to use it, you will need to be using Windows
Server 2012 R2. There are some additional features added in this release. First there
is a feature called Workplace Join.
Workplace Join is designed to allow mobile devices like Apple's IOS and Windows based
devices to access Windows based services. For example, you could use your mobile device
to access files and folders on the company's network. It can also be used on operating
systems like Windows 8.1. When this video was created, Samsung had just added support
for Workplace Join to one of its devices, so by the time you watch this video there
may be some support for some Android mobile devices.
The easiest way to think of Workplace Join is to think of it as a lighter version of
joining a computer to the domain. Once a device has been registered with Workplace Join, it
can access some of the features like files and folders just like a domain computer could.
However, other features like group policy are not available. The concept behind Workplace
join is just like a computer in a domain; the user only needs to sign-in once to gain
access to all the resources on the network.
The next new feature is 'enhanced access control for reduced risk management'. This is a
whole heap of new features designed to make Active Directory Federation Services more
secure, depending on the needs of the organization. For example, if you have a sensitive application,
you can configure it to always prompt the user for credentials when it is accessed.
If you decide to use Workplace Join, you also have the option to disable the mobile device's
access, if required. There are also additional options. For example: configuring when multi-factor
authentication will be used.
The next new feature is 'simplified deployment experience'. This makes AD FS easier to install
than previous versions. The most noticeable feature is that it no longer requires IIS.
Having not to install IIS reduces the attack surface of the server. It also makes it easier
to install on a Domain Controller though, in a production environment, I would not recommend
this. However, sometimes it cannot be helped.
The next feature is that the user interface includes the ability to configure SQL Server.
This makes it easier to configure and use AD FS with SQL Server than in previous versions.
Lastly there is built in support for 'group managed services accounts'. In Windows Server
2008 R2, Microsoft introduced the managed service account. This is a service account
in which Active Directory manages the password for the administrator. Although useful, these
can be difficult to set up and use. With Windows Server 2012 R2, the process of using a group
managed service account is very simple and the same group managed service account can
be used on multiple servers. Using Group Managed Service Accounts makes the server a lot more
secure, as Active Directory will change the password used at periodic times and uses very
complex passwords.
There are also some changes to AD FS 3.0 from the previous versions.
First, the Federation Service Proxy component has been moved to the Remote Access Role.
With the move, it has also changed its name to Web Application Proxy. This provides the
same reverse proxy functions as before, that is, can be installed in a DMZ to allow access
to a Federation Server located on the internal network from the internet. This helps keep
the Federation Server more secure.
With AD FS 3.0 there are also some features that have been removed. Primarily among these
are the Web Agents. These have been available since the first release of AD FS. These are
not used as much nowadays and thus may be why Microsoft decided to remove them in 3.0.
The next two versions of AD FS that I will look at is 2.1 and 2.0. There is not too much
difference between the two so I have grouped them together. AD FS 2.1 is included with
Windows Server 2012. When compared to 2.0, there are only very minor changes. For this
reason, it is considered by most that the only difference is that it is included with Windows
Server 2012 rather than being a download, like in Windows Server 2008. If you do decide
to migrate from 2.0 to 2.1 you should only experience very minor issues, if any at all.
Version 2.0 of AD FS is available for Windows Server 2008 and Windows Server 2008 R2 as
a free download from Microsoft. With the release of 2.0, there are some additional features
that have been added.
First there is web support across domains. If you are planning to use AD FS between domains,
this is a useful feature. Most people tend to think of Active Directory Federation Services
for accessing resources outside the company. However, it can also be used for company users
to access internal applications, including those running in different domains.
The next new feature is improved federation trust support. This is particularly important
if you are connecting to non-Windows Federation systems. It does this by adding support for
industry standard metadata formats.
The last change is the improved management interface. This change makes it is easier
to configure Active Directory Federation Services.
There are also some features that have been removed.
The first feature that has been removed is using AD LDS as an account store. AD LDS is
still supported as an attribute store. However, in most cases you will use a Domain Controller
to authenticate users when using Active Directory Federation Services.
The next feature that has been removed is support for Windows NT Token-based web agent.
This will only be an issue if you are using the web agents.
The only noticeable difference between AD FS 2.1 and AD FS 2.0 is that the in-place
upgrade from AD FS 1.1 is not available in AD FS 2.1. If you want to upgrade to version
2.1 of AD FS, you will need to perform a migration. If you are using AD FS 1.1, you can perform
an in-place upgrade to version 2.0.
The last two versions that I will look at are 1.1 and 1.0. If you are using Windows
Server 2008 or Windows Server 2008 R2, 1.1 is included with the operating system. If
you are using Windows Server 2003 R2, 1.0 is available as a free download. Either version
provides basic AD FS functionality - that is, a single sign on service.
With the first release of Active Directory Federation Services from Microsoft, there
were some compatibility problems with non-Microsoft Federation systems. This was fixed in version 2.0.
Well, that covers it for all the different versions of Active Directory Federation Services.
I hope you have found this video informative and I hope it helps you make the right decision
about which version you want to use. Until the next free video from us, thanks for watching
and see you next time.