AD FS vs authentik: when each option fits
AD FS fits an estate that is tied to Windows Server operations and still depends on WS-Federation relying parties, such as SharePoint sites and line-of-business applications, that were configured years ago with claim rules. authentik fits a team that wants one self-hosted product covering SSO, LDAP, RADIUS and proxy access, and that is prepared to run that product on Linux with PostgreSQL. If your AD FS farm, renewal or Windows Server lifecycle is forcing a decision now, the first task is to count how many relying parties use each protocol, because that count largely determines which option is practical. AD FS remains a capable federation server for organizations that know it well, and the case for leaving it usually rests on lifecycle, licensing or the need to consolidate identity services rather than on any single technical gap.
The protocol inventory matters most for WS-Federation. authentik documents a WS-Federation provider aimed at applications such as SharePoint, but it is labeled an Enterprise feature, supports only the SAML2 token type, and is documented as not supported with Microsoft Entra ID, which requires a SAML 1.0 token. Confirm with the authentik documentation which token types your applications accept, and check whether any SAML 1.0 consumers remain in your estate. Also confirm current edition terms on the authentik pricing page before budgeting, since the WS-Federation provider sits behind the Enterprise edition. Relying parties that cannot accept SAML2 tokens need a separate plan, and this is the point where authentik and AD FS stop being interchangeable.
The decision turns on three things: WS-Federation dependence, in-house operating skills and sizing. Ask whether your team can operate a Linux-based identity service with a database, backups, certificate rotation and upgrades on a regular schedule, since authentik ships as a server container, a worker container and PostgreSQL. Then size the deployment against your user count, your external users and your availability target, and ask the vendor or your implementation partner to show how the configuration maps to your environment. If the WS-Federation inventory is small and your team has the Linux skills, authentik can cover the rest of the scope well. If the inventory is large or heavily WS-Federation based, compare the alternatives before committing.
Which scenario favors AD FS and which favors authentik
This table maps common AD FS estate conditions to the platform that fits better. Read each row against your own estate: if the condition is true for most of your relying parties, it points to that option. Where the answer depends on an unconfirmed detail, the cell says what to verify first.
| Scenario | Better fit | Condition that drives the choice |
|---|---|---|
| SharePoint or other WS-Federation apps that must stay as they are | AD FS | authentik's WS-Federation provider is an Enterprise feature and issues only SAML2 tokens. Confirm each app accepts that token type before choosing authentik. |
| Modern SAML and OIDC apps only | authentik | Native OAuth2/OIDC and SAML providers cover modern apps without claim rule translation, and the free edition includes them. |
| LDAP and RADIUS consumers for network gear and VPNs | authentik | authentik's free edition supports LDAP and RADIUS as outposts, so one product can serve these clients alongside SSO. AD FS does not serve LDAP or RADIUS for these consumers, so these clients usually need a separate service. |
| Proxy access to internal web apps without AD FS Web Application Proxy | authentik | authentik's proxy provider replaces the Web Application Proxy role. Confirm the header, Kerberos and certificate requirements of each published app during testing. |
| Apps that depend on Kerberos or integrated Windows authentication | AD FS | Integrated Windows authentication runs natively on AD FS in a domain. Confirm the specific application behavior on authentik before treating it as equivalent. |
| Small identity team with limited Windows Server and PKI skills | authentik | authentik deploys as containers with PostgreSQL, so operations centre on Linux, containers and the database instead of farm, proxy and certificate management. Ask the team to confirm its container skills. |
| Need for vendor-backed support and SLAs | AD FS | Microsoft support runs through existing Windows Server agreements. authentik's free edition offers community support only, while Enterprise and Enterprise Plus add ticket-based support and SLAs, so price these into the comparison. |
| Data and identity must stay in-country or in an isolated network | authentik | Both can run on-premises, but authentik keeps configuration and data in PostgreSQL that you operate. Confirm the FIPS requirement with the vendor, since FIPS compliance is an Enterprise Plus item. |
| Strict Microsoft-only federation with no Linux operations | AD FS | AD FS fits Windows-only operations. Moving to authentik adds Linux, container and database work that must be staffed or contracted. |
Which authentik edition covers your requirements
The open-source edition is the core of authentik and is licensed under MIT for most of the repository. It is free to download and run, and it covers the protocols most federation projects start with: OAuth2 and OpenID Connect, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy authentication. Support comes from the community Discord, not from a contract, so the operating team carries the response burden for incidents.
- Protocol coverage: OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy providers are included without a subscription.
- License: Most of the code is MIT (SPDX: MIT), which allows self-hosting and internal modification.
- Support model: Community Discord only, with no ticket queue or response commitment.
- Missing for AD FS replacements: The WS-Federation provider and the Google Workspace and Entra ID integrations are not in this edition.
- Operating cost: Your staff, infrastructure and any external help are the costs; the software itself carries no license fee.
Before choosing this edition, confirm that every relying party you plan to move uses a protocol listed here and that your team can own upgrades and incident response without a vendor contract.
The Enterprise edition is priced at $5 per user per month billed annually, plus $0.02 per external user per month, according to the authentik pricing page. It adds features that many federation estates need: the WS-Federation provider for applications such as SharePoint, Google Workspace and Microsoft Entra ID integrations, mTLS client certificate authentication, privileged access management, password history and enhanced audit logging. Its support tier includes ticket-based support for subscriptions over $1k.
- Recurring fee: Per-user pricing as stated on the pricing page, billed annually, so cost scales with headcount and external users.
- WS-Federation: Available on Enterprise, but limited to the SAML2 token type and documented as unsupported with Microsoft Entra ID, which requires a SAML 1.0 token.
- Identity integrations: Google Workspace and Microsoft Entra ID connectors are Enterprise features.
- Security and audit: mTLS, privileged access management, password history and enhanced audit logging are listed as Enterprise-only.
- Support: Ticket-based support for subscriptions over $1k, rather than community Discord alone.
Ask the vendor for a written quote that states the user count basis, how external users are counted and whether the WS-Federation token limit affects your applications. Confirm the terms of the enterprise license in the authentik/enterprise/ directory of the repository.
Enterprise Plus is the tier for organizations that need contractual operations commitments. The authentik pricing page lists it from $20k annually, and adds dedicated support with SLAs, multi-instance deployment support and FIPS compliance for FedRAMP requirements. Those three items are the reasons to consider this tier, and they should be evaluated against your own contracts and regulatory obligations rather than assumed.
- Starting price: From $20k annually, as listed on the authentik pricing page; the final figure depends on the quote.
- SLAs: Dedicated support with service levels, so ask for the exact response and resolution terms in writing.
- Multi-instance support: Relevant when you run separate authentik deployments for different business units, regions or environments.
- FIPS compliance: Listed for FedRAMP requirements; confirm the exact FIPS validation status and build for your target environment with the vendor.
- Enterprise features: Everything in the Enterprise tier is included in the Plus tier pricing structure, so confirm this in the quote.
If an auditor or contracting officer requires a named SLA or FIPS-validated cryptography, request those specifics in writing before budgeting, and confirm the license terms in the repository.
How hosting and data control differ between AD FS and authentik
The core difference is what you run and where your identity data sits. AD FS is a server role inside a Windows Server estate: a farm of AD FS servers joined to your Active Directory, with Web Application Proxy servers in front of them for extranet access. Those servers, their operating system, and the SQL Server or Windows internal database holding farm configuration are all components your own team patches, backs up and places in your network. authentik, by contrast, runs as a server container (core plus an embedded outpost), a worker container for background tasks, and PostgreSQL. Small setups can start with Docker Compose, while larger environments typically move to Kubernetes, following the authentik Kubernetes installation guide. Confirm with your platform team which of these fits your standard hosting pattern before comparing costs.
For data control, the practical point is that authentik keeps its configuration and data in PostgreSQL. According to the architecture documentation, PostgreSQL holds everything except uploaded files, so your database backup, restore and replication design becomes your identity recovery design. Decide where that database runs, who holds its credentials, how point-in-time recovery is tested, and where uploaded files are stored. The 2025.10 release removed Redis and moved caching, tasks, sessions and WebSocket functions to PostgreSQL. The release notes warned of roughly 50% more PostgreSQL connections after upgrading, so check connection pooling and database limits in a staging environment before you adopt that release line.
Residency and compliance claims need confirmation with your auditors and legal team, not assumption. Hosting authentik inside your own cloud account, data center or isolated network keeps identity data under your control, but it does not by itself satisfy any control framework. Ask your assessor which evidence they expect for backups, access to the database, logging of administrative changes and change management for the containers. Also confirm which authentik edition provides the features your assessor requires, since FIPS compliance is listed only in the Enterprise Plus tier on the authentik pricing page.
What control, identity and compliance mean for each option
Federation decisions touch where identities live, who can change them, how keys and certificates are managed, and what evidence an assessor will ask for. The cards below set out those questions for AD FS and authentik so that the team can check each one against its own environment before committing.
Active Directory as authoritative source
AD FS reads users and groups from Active Directory and relies on it for authentication, so the directory remains the system of record. authentik can use Active Directory as an LDAP source and sync users and groups into its own database, which makes the sync direction and the attributes it writes a design decision. Confirm which system owns the user lifecycle, whether authentik may write back to Active Directory, and how disabled accounts are removed from authentik sessions.
Data location and residency
Under a self-hosted authentik deployment, identity data sits in PostgreSQL inside the organization's own infrastructure, with uploaded files as the only exception. AD FS keeps its configuration database in Windows-based farms that the team already operates. Either way, the location of backups, log exports and any cloud-hosted Enterprise connectors must be mapped to the residency commitments made to regulators and customers.
Identity and certificate management
Federation depends on signing and encryption certificates for every relying party. AD FS handles token-signing certificates through its own configuration and rollover process. In authentik, signing keys are managed per provider, so the team must define who generates, stores, rotates and distributes each key, and must update every relying party when a certificate changes. Document this process before migration, because a missed rollover stops sign-in for the affected application.
Patching and release cadence
authentik publishes versions named by year and month, and its security policy lists 2026.5.x and 2026.8.x as the supported lines that receive security fixes. The project announces security releases at least 24 hours in advance, so the operations team needs a window for that notice. The latest release on the releases page is 2026.8.4, published October 14, 2026, so check which line your deployment tracks and plan an upgrade path before a line drops out of support.
Audit evidence
Assessors will ask for logs showing who signed in, which application received a token, and who changed a provider or policy. AD FS writes these events to Windows event logs, which many teams already forward to a SIEM. authentik Enterprise adds enhanced audit logging, so confirm whether the events you need are available in the edition you buy, and how they will be retained and exported. DeployOpen prepares systems, controls and evidence for compliance assessments, but auditors and certification bodies issue the attestations.
FIPS and FedRAMP requirements
If a contract or regulator requires FIPS-validated cryptography or FedRAMP authorization, the open-source authentik edition does not meet that need on its own. The pricing page places FIPS compliance for FedRAMP requirements in the Enterprise Plus tier, alongside dedicated support with SLAs and multi-instance support. Ask the vendor in writing which module versions and deployment modes the FIPS build covers before assuming it fits your authorization boundary.
How a move from AD FS to authentik proceeds
This sequence takes an AD FS estate from an inventory of relying party trusts to a retired farm, with authentik carrying each application across in controlled waves. The order matters because the protocol decisions made early determine whether any application needs authentik Enterprise and how much of Web Application Proxy must be replaced.
Inventory relying party trusts and protocols
Export every AD FS relying party trust, endpoint, claim rule and certificate, then match each trust to an owner and to real sign-in activity over a representative period. Your team, with the application owners, produces a register that lists each app, its protocol (SAML, OpenID Connect, WS-Federation or Kerberos-based access), the claims it needs and whether it is still used. The step is done when every trust in the farm has a row and each row has an owner who has confirmed whether the app stays, moves or retires.
Decide which apps need WS-Federation
Split the register into apps that can use SAML2 or OpenID Connect and apps that depend on WS-Federation, such as SharePoint-style relying parties. authentik's WS-Federation provider is labeled an Enterprise feature and issues only the SAML2 token type, and it is documented as not supported with Microsoft Entra ID because Entra ID requires a SAML 1.0 token. Confirm each WS-Federation app's token requirement with its vendor, then record whether Enterprise licensing is needed. The step closes with a written decision for every WS-Federation app.
Deploy authentik with PostgreSQL
Your platform or infrastructure team deploys authentik on infrastructure you control, using the Docker Compose or Kubernetes guidance from the project, with the server and worker containers and a PostgreSQL database that holds configuration and data. Compose suits test and small-scale setups, so production sizing and high availability are decided here with the vendor documentation and your own load figures. The step is done when the instance is reachable over TLS, backups of the database run and a restore has been tested in a non-production copy.
Connect Active Directory as a source
Configure the Active Directory source in authentik so user accounts, groups and attributes come from the existing directory rather than a second copy. The identity team works with the directory administrators to choose the bind account, search base and group mappings, and confirms that password checks and account disablement flow through correctly. The step is complete when test users from each relevant group can sign in and their group membership appears as expected in authentik.
Rebuild SAML and OIDC providers
For each app on the register that stays on modern protocols, create the matching authentik provider and application, then translate the AD FS claim rules into authentik property mappings and group-based policies. Application owners test sign-in in a non-production tenant, and the team compares the claims received by the app with those it received from AD FS. The step is done when each app has a signed-off test case and a documented rollback path that keeps AD FS available until cutover.
Replace Web Application Proxy with an outpost
Identify every app published through Web Application Proxy and decide whether authentik's embedded or standalone outpost, or its proxy provider, fits each one. Pre-authentication, header-based apps, certificates and the load balancer rules that AD FS required all need to be re-tested, because the traffic path changes. The step closes when each published app is reachable through the new path from outside the network and the old proxy entries are marked for removal.
Pilot with low-risk apps
Move a small group of low-impact, well-understood apps first, and run them alongside AD FS for a defined observation period agreed in the project plan. The team watches sign-in logs, support tickets and failed claims, and fixes mapping or policy issues before they reach larger populations. The step is done when the pilot apps have run without open defects and the owners accept the operating runbook.
Cut over in waves and retire the farm
Move the remaining apps in waves grouped by owner or business function, updating each relying party's endpoints and certificates on the agreed date and keeping the AD FS trust in place until the wave is confirmed. Once no active trust remains in the activity reports, disable the AD FS relying party trusts, then decommission the farm and Web Application Proxy servers and remove their certificates and service accounts. Timing depends on the number of trusts, WS-Federation dependencies and change windows, so the schedule should be scoped and agreed in writing before work begins.
Questions buyers ask before switching from AD FS to authentik
Can SharePoint WS-Federation access stay on the free authentik edition?
No. authentik's WS-Federation provider, the one aimed at applications such as SharePoint, is labeled an Enterprise feature, and it supports only the SAML2 token type. The free Open Source edition covers OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy authentication, so any relying party that depends on WS-Federation needs a licensing decision before the migration is scoped. Confirm with the authentik vendor which edition and token type your specific SharePoint configuration requires, and confirm the current authentik WS-Federation provider documentation for limits that apply to your version. Also note that the provider is documented as not supported with Microsoft Entra ID, because Entra ID requires a SAML 1.0 token.
How much effort and time does an AD FS to authentik migration need?
The effort depends on the number of relying party trusts, how many use WS-Federation, how many need claim rules translated into authentik property mappings, and how many users sit in Active Directory sources. No duration is supplied here, so ask any implementation partner for a fixed-scope estimate built from your own inventory of trusts, claim rules and certificates. Before you ask, run a relying party inventory so the scope is based on real usage rather than an assumed application list. Each application you add to the scope adds testing, cutover and rollback planning, and the proxy replacement adds more if you publish internal apps through Web Application Proxy today.
What does the internal team need to provide for the migration?
The team needs four things to start:
- Active Directory admin access, or an admin who can create a read-only service account for the authentik LDAP source.
- Named application owners for every relying party, who can confirm claims, test sign-in and approve cutover.
- Linux and container skills for the server and worker containers, plus network and certificate management.
- PostgreSQL skills for backup, connection limits, tuning and upgrades, because authentik stores its configuration and data in PostgreSQL.
If these skills are not in-house, ask whether the scope includes knowledge transfer and runbooks, and confirm the staffing with the vendor or partner in writing.
Can our team run authentik without outside help?
A competent team can run authentik itself, since the project is open source and deployments are documented with Docker Compose and Kubernetes. The harder part is the surrounding work: directory integration, claim mapping for each relying party, certificate lifecycles, load balancer rules that AD FS previously imposed, and tested backups. Start with a small pilot application, measure how much time the team spends on it, and decide afterward whether to keep operations in-house or buy a support plan. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms in your environment under a written scope, and offers ongoing support as a retainer.
What does Enterprise support add beyond the free edition?
The Open Source edition offers community support only, through the project's Discord. The Enterprise edition adds ticket-based support for subscriptions over $1k, along with features such as the Microsoft Entra ID and Google Workspace integrations, privileged access management and enhanced audit logging, according to the authentik pricing page. Enterprise Plus adds dedicated support with SLAs, multi-instance deployment support and FIPS compliance. Confirm current prices, the exact support terms and any response commitments in writing with authentik before you budget, because the pricing page is the source for these tiers and may change.
How do authentik upgrades affect the PostgreSQL database?
The 2025.10 release changed the database load. authentik no longer uses Redis and moved caching, tasks, sessions and WebSocket functions to PostgreSQL. The 2025.10 release notes warn of roughly 50% more PostgreSQL connections after upgrading. Before any upgrade, check your connection limits, connection pooling and database sizing, and include that check in the upgrade runbook. Plan backups before each upgrade and test the restore path in a non-production environment. Security fixes are supported for the 2026.5.x and 2026.8.x lines, and the project announces security releases at least 24 hours in advance, so build that window into your patch process.
Does authentik replace Active Directory or only federate it?
authentik federates with Active Directory rather than replacing it. It can use Active Directory as an LDAP user source, so existing accounts and groups remain where they are, and it provides SAML, OIDC, RADIUS and proxy access on top. Ask your team to confirm which directory attributes, group memberships and password policies must be reflected in authentik, and whether any application needs Kerberos. Changes to the directory itself remain with your Active Directory administrators.
How DeployOpen helps with an authentik or AD FS exit
DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted platforms inside your own infrastructure, including the cloud accounts, data centers or isolated networks where AD FS runs today. For an authentik move, the work usually starts with an evaluation of your relying party inventory: every AD FS relying party trust, its protocol, its claim rules, the certificates it depends on and whether anyone still uses it. That inventory decides which applications become authentik SAML or OIDC providers, which need the WS-Federation provider and therefore an Enterprise license, and which must be retired before cutover. Confirm with the authentik pricing page and your own application owners before assuming any relying party can move to the free edition.
Implementation then covers the authentik server and worker containers, the PostgreSQL database that stores configuration and data, the Active Directory source, the outposts that replace Web Application Proxy where needed, and the sizing decisions that follow from your user count and high availability requirements. Integration work includes wiring each application's login flow, MFA policy and group mapping, and testing sign-in with real users before any trust is switched. Migration is sequenced application by application, with a rollback path for each. Operations follow: backups of the database and configuration, controlled upgrades against the supported release lines in the authentik security policy, and written runbooks for your operators. Most engagements are fixed-scope, so the scope, deliverables and timelines are agreed in writing before work starts, and DeployOpen provides a quote based on that scope. Ongoing support, upgrades and continuous testing are available as a retainer if your team wants a provider to keep the platform current after cutover. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications; independent auditors and certification bodies do that work. Ask any provider, including DeployOpen, to show the written scope, the list of out-of-scope items and who on your side owns the decisions about application access.
