Troubleshooting Active Directory Federation Services

2018-01-04 | dh

Enabling single sign-on for your users must not be a big deal. There are multiple hybrid identity authentication scenarios available to obtain single sign-on capabilities to your users:

When should I use AD FS instead of other hybrid authentication methods?

When to use AD FS

More information about the different sign in methods can be found in my edX course Manage Office 365 Identities.

Keep in mind that your AD FS deployment is essential for your users to access Office 365 applications. Both internal and external users require a stable running AD FS environment. Some basic considerations before starting the AD FS troubleshooting:

Here are some common and basic AD FS tests that can be performed:

As you can install and configure your AD FS farm with Azure AD Connect, you can also perform various AD FS-related tasks with minimal user intervention by using the AAD Connect wizard.

If you are having sign-in issues, search for the Correlation ID or Activity ID, depending on the issue in your error message. For example:


This ID is generated when the token issuance request comes to Federation Passive web application or directly to STS and remains the same for the entire duration of the request. Open the event viewer and have a look for this ID in the AD FS Admin log.

Another diagnostic tool from Microsoft is to use the Remote Connectivity Analyzer to verify the connectivity to your AD FS farm.

Finally, enable AD FS debug tracing:

  1. Open Event Viewer
  2. Right click Application and Services Logs and select View – Show Analytics and Debug Logs
  3. Navigate to AD FS Tracing, right click on Debug and select Enable Log to start debug tracing immediately.

I hope this little piece of information will help you to troubleshoot your federation services farm. Of course, there are a lot of more troubleshooting guides regarding AD FS available. These are only the basic tasks and how to identify the problem.

Tags: ,

Categories: ADFS, Office365