Retiring AD FS on a live enterprise

Single sign-on for roughly 30 applications ran through a two-server AD FS farm. Before it could be retired, the farm was upgraded through three Windows Server versions and recovered from a catastrophic crash.

• A live enterprise with users in multiple countries and no outage window to hide in.
• Every relying party had its own application owner, trust configuration, and claims rules.
• Token-signing and SSL certificate rollovers had to be handled until the farm was gone.

1. 01Upgraded the farm through 2012 R2, 2016, and 2019, and recovered it from a crash that corrupted its configuration.
2. 02Scripted the relying-party inventory and migration in PowerShell.
3. 03Ran every application through the same pre-cutover question set before moving it.
4. 04Planned authentication cutovers around business hours, coordinating application owners and user communication.
5. 05Decommissioned the two-server farm after the last relying party moved.

Roughly 30 relying parties moved to Entra ID in under a month, and the AD FS farm was decommissioned.

One question set for every application turns thirty migrations into one repeatable procedure.

• Retiring AD FS with PowerShellSheet 01 / 30
• Eight questions before a relying party cutoverSheet 03 / 30

• AD FS
• Entra ID
• SAML 2.0
• PowerShell
• Migration