📖 What is Microsoft Entra ID Federation?
Microsoft Entra ID Federation is a trust relationship between Microsoft Entra ID and an external identity provider, such as AD FS. It allows users to be authenticated by the external provider before being granted access to Microsoft 365 services.
"Understand that if the on-premises Identity Provider (IdP) goes down, users cannot authenticate unless you have configured a backup authentication method."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID Federation?
- ▸ Trust relationship established using protocols like SAML or WS-Federation, allowing an external Identity Provider to validate user credentials.
- ▸ Authentication flow where Entra ID redirects the user to the external IdP, receiving a security token instead of the password.
- ▸ Enables seamless Single Sign-On (SSO) for users accessing both on-premises resources and Microsoft 365 cloud services with one identity.
- ▸ Strict security model where passwords remain on-premises, making it ideal for organizations with high compliance or regulatory requirements.
- ▸ Critical dependency on the external IdP's availability; if the on-premises infrastructure fails, users cannot access cloud services.
🎯 How does Microsoft Entra ID Federation appear on the MS-102 Exam?
You may be asked to recommend the correct identity model for a highly regulated company that strictly prohibits passwords from being stored in the cloud, necessitating a federated trust with an external IdP.
A scenario might describe a total outage of the on-premises AD FS servers. You will need to identify that federated users are blocked from Microsoft 365 and suggest a failover solution.
Expect questions comparing Federation, Pass-Through Authentication, and Password Hash Sync, requiring you to select the best option based on specific organizational requirements for availability, security, and infrastructure complexity.
❓ Frequently Asked Questions
What is the primary risk of using Federation compared to Password Hash Sync?
The primary risk is the 'single point of failure.' If your on-premises IdP or the network connection to it goes down, users cannot authenticate to Microsoft 365, whereas PHS allows cloud-based authentication.
Can a tenant use both Federation and Password Hash Sync simultaneously?
Yes, through a feature called 'staged rollout.' This allows administrators to move users from federation to cloud-managed authentication in batches to test stability and provide a backup authentication path.