Category Archives: ADFS

ADFS SmartLink for OnedriveMapper

ADFS SmartLinks are very useful tools to get your user signed into a service super quickly. As of version 3.02, OnedriveMapper supports these links for both IE and Native authentication mode.

I wrote an article on how to create an ADFS smartlink for the Intune portal once, that should get you started, but point your smartlink to “https://{YOUR TENANT NAME}”.

Then configure $adfsSmartLink in OnedriveMapper with your ADFS SmartLink. OnedriveMapper should then immediately get logged into Onedrive For Business, reducing logon delays by seconds or more depending on the auth method you’re using.

Office 365 fallback from ADFS to Password Sync with ADFS down

Because I’ve been asked too many times and keep having to look up the commands, I’m just going to throw them here for reference. If your ADFS farm, federated with Office 365, goes down for some reason and is no longer reachable, the Microsoft way of unfederating your Office 365 logon domain won’t work, as the set-msoladfscontext command won’t be able to reach your ADFS machine.

Simply setting the domain’s authentication mode from Federated to Managed will also do the trick and allow your users to login with their synced passwords:

Import-Module MSOnline
Set-MsolDomainAuthentication -Authentication Managed -DomainName

ADFS v2 to v3 side by side migration for Office 365

Some time ago we built a second ADFS farm at our datacenter. We knew we had to upgrade to v3 at some point, but wanted to keep our v2 farm intact so we could always do a rollback. We also wanted to use a new domain name for our brand new Windows 2012 R2 ADFS cluster, including the WAP proxies.

Setting all this up proved fairly easy, ADFS v3 was Continue reading ADFS v2 to v3 side by side migration for Office 365

Error 0x80075227 and 0x8007520C on a Web Application Proxy 2012R2

Today while implementing a KEMP load balancing solution for ADFS v3 and WAP together with a colleague, I ran into errors on my WAP servers. Both seemed to be connected fine, the IdpInitiatedSignon.aspx page worked….but when I tried to run Get-WebApplicationProxyADFSRelyingParty in Powershell, I got 0x80075227 to chew on.

At first just ADFS+WAP, load balanced, worked, this error surfaced when we added a Non Claims Aware trust to a Sharepoint 2013 Kerberos enabled server so we could publish it using Windows Authentication (which we needed for various BI / Excel components that require Kerberos). The Sharepoint servers were also load balanced, we expect the KEMP has issues with SNI.

Connecting the WAP server directly to ADFS, without the KEMP load balancer in between solved this issue for now, we’re still looking into the configuration of the KEMP with their technicians to find a way to load balance this effectively without compromising on security.

Update: our engineer who worked with KEMP reported that an extra VIP was required because of SNI.