Active Directory Federation Services is the federation server role in Windows Server, and Microsoft now recommends migrating off it to Entra ID. Pages here cover replacing AD FS with self-hosted Keycloak, authentik or WSO2 Identity Server instead.
Moving AD FS relying parties to Keycloak: inventorying trusts, re-creating SAML and OpenID Connect clients, translating claim rules to mappers, LDAP and Kerberos federation with the existing Active Directory, and what to do with WS-Federation apps Keycloak does not serve.
Moving from AD FS to authentik for smaller estates: SAML and OIDC providers for modern apps, the WS-Federation provider for apps such as SharePoint and its Enterprise licensing and SAML2-token limit, Active Directory sources, and replacing Web Application Proxy with an outpost.
For AD FS estates with many WS-Federation relying parties: moving to WSO2 Identity Server, which supports WS-Federation alongside SAML, OIDC and SCIM, using Active Directory as a user store, and deciding between the open source build and a WSO2 subscription.
Comparing AD FS with Keycloak as an on-premises federation server: protocols, claim rules versus mappers, Kerberos and Active Directory integration, farm and proxy architecture versus Keycloak clusters, MFA options, and the platform each ties you to.
Comparing AD FS with authentik for organizations that want one self-hosted product for SSO, LDAP, RADIUS and proxy access: protocol coverage including WS-Federation on authentik Enterprise, Active Directory integration, sizing and who operates it.
Cost of ownership by component: Windows Server core and CAL licensing for AD FS and Web Application Proxy servers, SQL Server for larger farms, certificate and patching work, against Keycloak on Linux with a database, support subscription, migration and operations.
Microsoft's recommended exit from AD FS is Entra ID. For organizations that need federation to stay on-premises, in-country or inside an isolated network: what a self-hosted replacement must cover, which open-source servers fit, and how to sequence relying party moves.
Web Application Proxy publishes AD FS and internal apps to the internet. This page covers replacing it with Pomerium or authentik's proxy provider: pre-authentication, header and Kerberos apps, certificates and the load balancer rules AD FS imposed.
Before leaving AD FS, list every relying party trust, its protocol, claim rules, certificates and real usage: Microsoft's migration readiness script and activity report, exporting trust settings, and turning the result into a migration plan for a new identity provider.
AD FS farms still on Windows Server 2016 lose extended support on January 13, 2027. This page weighs upgrading the farm and Web Application Proxy servers to a newer Windows Server against using the deadline to replace AD FS with a self-hosted identity provider.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.