Azure AD Connect user sign-in options

Davidddddd 26 Reputation points
2019-12-31T11:07:18.283+00:00

We are going though the unnecessarily complicated process of migrating Azure AD Connect to a new server. (Surely they could automate the migration to a new Azure AD Connect with the same configuration?)

In this environment, users currently sign in to Azure / Office 365 using Federation with AD FS.

When looking at the sign-in screen in the current Azure AD Connect instance, I was expecting to see current sign-in method that is being used selected. But instead, it simply shows no options as selected. I'm assuming this is because the current Azure AD Connect instance was originally installed before most of these options were ever available. I assume then that Azure AD Connect has not been used at all to manage AD FS, even though AD FS is running Windows 2012 R2 currently. I also noticed there is no folder %ProgramData%\AADConnect\ADFS containing AD FS backup files, which also indicates that Azure AD Connect is not currently managing AD FS.
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-azure-ad-trust

So onto my questions.

If I select the sign-in option "Federation with AD FS", I understand that Azure AD Connect will start to manage AD FS in respect to the Azure AD trust and the AD FS certificates. At this time, I prefer for Azure AD Connect to not manage this. I just want to migrate to a new Azure AD Connect for now.

If I select the sign-in option "Do not configure", am I correct in my understanding that it will simply leave the authentication alone and AD FS will continue to simply work as it did before? If so, I will go with selecting this option. Are there any drawbacks to be aware of?

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,559 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David 701 Reputation points
    2019-12-31T13:29:22.253+00:00

    Correct, if you choose " Do not configure", no changes will be made to your existing ADFS architecture.

    1 person found this answer helpful.
    0 comments
  2. David Bird 1 Reputation point
    2020-02-13T14:47:23.813+00:00

    I'm currently in the same situation and had the exact same question. Thankfully I found the following blog post which says to select "Do not configure" if you already have AD FS configured in your environment. Microsoft's documentation should be more clear about this and mention "Do not configure" is an option if you have an existing AD FS infrastructure and are performing a swing migration of Azure AD Connect.

    https://www.franken.pro/blog/azure-ad-connect-swing-migration-single-multiple-sync-server-towards-one-azure-ad-tenant

    0 comments
  3. Eirik Lindem 6 Reputation points
    2020-10-22T07:00:38.27+00:00

    Hi.
    Sorry to hijack this question, but I am in a similar situation.
    Rather than not letting Azure AD connect manage my ADFS I want to change that, but I am afraid of the consequences of changing the Sign-in method from "not configured" to "federated sign-in".
    I am currently using "federated sign-in" just not configured by Azure AD Connect.
    Can I break something when changing the setting in Azure AD connect?

    Thanks..