AD FS farms are some of the oldest, most fragile and most attacked servers in many companies. Microsoft recommends moving applications to Entra ID and authentication to password hash sync or cloud methods. How to inventory relying parties, move them in stages, replace AD FS-based AWS role federation with IAM Identity Center, and decommission the farm.
Active Directory Federation Services was how many companies first connected on-premises accounts to cloud applications, including AWS, where an AD FS relying party trust mapped AD groups to IAM roles. It still works. It also means internet-facing Windows servers, web application proxies, token-signing certificates that expire at inconvenient times, and a target attackers know well.
Microsoft's guidance is to migrate applications from AD FS to Entra ID and move authentication to cloud methods, with password hash synchronization as its recommended default, and it publishes a decommission guide for the farm itself.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Inventory every relying party trust and check its sign-in activity. Entra's AD FS application activity report shows which are used and whether they can move.
Move SaaS applications to Entra enterprise applications, using gallery templates where they exist, one group of users at a time.
Replace AD FS role federation into AWS with IAM Identity Center: Entra ID as the identity source over SAML with SCIM provisioning, groups mapped to permission sets per account. People get short-lived credentials and one portal instead of per-account role selection.
Move authentication from federation to password hash sync (or pass-through or certificate-based authentication if policy requires), using staged rollout to move groups gradually.
Recreate claims rules that applications depend on as Entra claims mappings, and test each one.
When the activity report shows no traffic, follow Microsoft's decommission guide: remove trusts, revoke certificates, shut down proxies and servers.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Amazon Cognito in 2026: Everything That Changed, for Teams Who Wrote It Off
Cognito spent two years fixing the reasons people left it: new Lite, Essentials and Plus tiers with managed login and passkeys, then in 2026 multi-Region replication, password-hash import, client-secret rotation, federation triggers, self-service rate limits and machine-to-machine tokens without a domain. What changed, what it costs, and whether to look again.
Read
Identity for AI Agents in 2026: The Agent Is Not the User
When software acts for people, identity has to answer new questions: whose permissions does the agent carry, who approved this action, and how does your API tell a real agent from an impersonator? The patterns that work (on-behalf-of tokens, asynchronous approval with CIBA, Cross App Access, MCP's OAuth model and signed agent traffic) and what to build first.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.