Retiring AD FS While Keeping Outlook Connected
Tailspin Toys has 6,000 mailboxes in a hybrid deployment with Exchange 2016 on-premises and Exchange Online. Authentication uses AD FS 2016 with WAP servers; the AD FS farm certificate and the WAP certificate expire in 45 days. The company wants to move to password hash sync with seamless single sign-on and retire AD FS. 1,200 users work on domain-joined laptops that rarely connect to VPN. Outlook Anywhere is still enabled. Autodiscover uses split-brain DNS: the internal record points to on-premises and the external record points to Exchange Online. Some users report repeated password prompts when off the corporate network. The identity team wants a cutover in one weekend. MFA is required for all users via Conditional Access, and an emergency access account exists.
1. Sequence the authentication migration from AD FS to PHS with seamless SSO, including what must be verified before disabling AD FS.
Read the worked answer
Treat this as a phased identity cutover, not a one-weekend event. Pre-work: confirm the UPN suffix is a verified routable domain, install or configure AD Connect with PHS and seamless SSO enabled, and confirm the emergency access account is excluded from Conditional Access and synced. Enable PHS in staging mode and test a pilot ring while AD FS remains authoritative. Then convert the federated domain to managed; this is the actual cutover and can take time to replicate. Keep AD FS running for rollback until the pilot and a full business day of sign-ins are clean.
Before disabling AD FS, verify: all users authenticate via PHS, seamless SSO works on domain-joined devices on and off VPN, Conditional Access policies still apply, and legacy auth is blocked or remediated. The certificate expiry in 45 days is a forcing function but not a reason to skip the pilot; if the conversion slips, renew the certificates rather than rush. Decommission WAP and AD FS only after the managed domain has been stable, and export the configuration first. For 6,000 users, a one-weekend cutover with no pilot is the risk, not the technology.
2. Why do off-VPN domain-joined users get repeated password prompts, and how does the Autodiscover design contribute? What would you change?
Read the worked answer
The repeated prompts are a symptom of the client still trying to authenticate against the on-premises namespace while the mailbox is in Exchange Online. Split-brain DNS sends internal Autodiscover to on-premises, and the internal SCP in Active Directory points Outlook to the on-premises Client Access service. Off VPN, the client may still have the SCP cached or resolve autodiscover.contoso.com to the on-premises name, then fail or prompt repeatedly because AD FS or WAP is not reachable or the certificate is expiring. Modern authentication also needs to reach Exchange Online's Autodiscover endpoint.
Change the design so cloud mailboxes use Exchange Online Autodiscover internally and externally, using Autodiscover v2 or a CNAME to autodiscover.outlook.com, and remove or update the on-premises SCP if any mailboxes remain on-premises. For a hybrid with on-premises mailboxes, keep internal Autodiscover on-premises but ensure it returns the correct target for cloud users; the cleaner path is to move all mailboxes to Exchange Online and point Autodiscover there. Test with the Microsoft Remote Connectivity Analyzer and clear the Outlook Autodiscover cache.
3. What will break when AD FS is retired, and what pre-work prevents an outage for Outlook and mobile clients?
Read the worked answer
Retiring AD FS changes the authentication path; it does not change mailbox location. What breaks: clients that still use basic auth, such as Outlook 2013 without modern auth updates, IMAP/POP devices, and some native mobile mail apps, will fail once legacy auth is blocked or AD FS is gone. Cached credentials may prompt once and then work if the client supports modern auth; any relying party trusts or applications that depend on AD FS will break.
Pre-work: inventory client protocols from sign-in logs, upgrade Outlook, move mobile devices to Outlook mobile, disable basic auth, verify Autodiscover points to Exchange Online, and test MFA and Conditional Access after conversion. Also check the hybrid OAuth configuration and the Exchange certificate used for server-to-server auth; free/busy between on-premises and cloud can fail if the OAuth certificate or connectors are misconfigured. Keep the AD FS farm available but powered off for a rollback window; do not delete it until the certificate expiry is no longer a factor. Communicate that users may see one sign-in prompt after cutover, which is expected.