How-to · Migrate from ADFS

Leave ADFS behind.
Keep AD. Keep every app.

ADFS gave you federation; it also gave you a server farm to patch, certificates to rotate, and claim rules nobody wants to touch. The migration is less dramatic than it sounds: AD stays the source of truth, apps move one at a time, and the farm is the last thing you turn off.

Start free trial →Open the full docs

AD stays source of truth
Per-app cutover
~7 minutes to read

Walkthrough

From ADFS farm to a decommission ticket.

Six steps, in the order that keeps every relying party working while you move.

01
Inventory your relying-party trusts
Export the full list of relying-party trusts from ADFS (Get-AdfsRelyingPartyTrust in PowerShell gives you everything, including the claim rules). This inventory is the migration plan: every trust is an app that needs a new home, and the sign-in logs tell you which ones are actually still used.
Tip — Trusts with no sign-ins in the last 90 days are candidates for retirement, not migration. Shrink the list before you move it.
02
Map each app: SAML, WS-Fed, and claims
For every live trust, record the protocol (SAML 2.0 or WS-Federation), the endpoints and identifiers, and which claims the app actually consumes. Most claim-rule complexity turns out to be attribute mapping — name, UPN, groups — that any modern IdP expresses in a few lines.
03
Stand up Monosign next to AD
Deploy Monosign — self-hosted, in minutes — and connect Active Directory as its identity source. AD stays the source of truth for users, passwords, and groups; Monosign reads from it and becomes the new federation front door. Nothing about your directory changes.
Tip — Because AD remains authoritative, this step is zero-risk to production: ADFS and Monosign serve side by side against the same directory.
04
Re-point apps one by one — pilot first
Pick one low-stakes internal app as the pilot. Register it in Monosign with the SAML or WS-Fed settings you mapped, update the app to trust Monosign, and test the round-trip with real users. Then work through the inventory app by app; each cutover is independent and reversible.
05
Move MFA and conditional access policies
Recreate your ADFS access control policies and MFA requirements in Monosign — per-app MFA, network conditions, and group scoping. Do this once the apps riding on those policies have moved, so a policy never lives in two engines at the same time.
06
Decommission the ADFS farm last
When the sign-in log on ADFS goes quiet, you are done: remove the relying-party trusts, retire the WAP proxies and the farm, and reclaim the certificates and servers. ADFS is the last thing you switch off, not the first.