> For the complete documentation index, see [llms.txt](https://enterprise.hideez.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://enterprise.hideez.com/hideez-server-integration/saml-integration/microsoft-exchange-for-authentication-via-saml/adfs-installation.md).

# ADFS Installation

## **1. Preparation for ADFS Installation**

### **1.1 Create a Certificate Template**

ADFS requires trusted certificates to ensure secure communication. These certificates can be generated using your internal Certificate Authority (CA). Follow these steps to create a certificate template:

1. **Access Certificate Templates Management**:

   * Open the **Certification Authority** console.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeUg_6tTTfXYooSezcZOiHTbi_O2qoYZfq3jKE5e1_QoXvCSitZ20ZBkRjqX7m_f9xR8DbJSZUVsncuMLSPILx6SvjQiOj-ew7AAm-aAKN1PqBkPP_A51Xi8Tf9qqDdMQf-lgJ9KQ?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

   * Navigate to **Certificate Templates** → Right-click and select **Manage**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc0p6vbWr_wFVtpkIBFJY-LTdnQQY32uqgpdNwzNpVPmq73ZE5n9GqvuFkgwUkaLDiRY9tIQL3O1kl2PHemCnrt0xY_Ftr1g4UlrpsZHDhYS7isLskvptadSGHwe8A-EqeQVI_C5w?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>
2. **Duplicate an Existing Template**:

   * Locate the **Web Server** template, right-click it, and select **Duplicate Template**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcPjyJvuQB1DkATWAKFzS_4hG9gQL4tE2tATRLJnVkxyieb4TDWEO51BfOlDUsWORL4JzFk71nCYhzhohy-B5KMtlIa33tnzob6YO10B5eesOQASyAAp09G63bC0ekwszHFMziGZQ?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>
3. **Modify the Template**:
   * Go to the **General** tab:
     * In **Template display name**, enter a name like "SSL Certificates."
   * Go to the **Security** tab:

     * Select **Authenticated Users** and check **Enroll** under the **Allow** column. Click **OK**.

     <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfc6UIYhdgdRHJ-tNgkTMrcBWgp_OQT3PPfUKG2AYk1uCtPB3lNy5ChV6eHuT3ERx6CRw084nSVeMwtuXMm2PJHaE-fx9FTCQKAqBwtS2057pp5pgnhG-3xV5GbMdaZ8br1DaJ76w?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>
4. **Publish the New Template**:

   * Close the **Certificate Templates** console.
   * In the **Certification Authority** console, right-click **Certificate Templates** → **New** → **Certificate Template to Issue**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXe2Rxp-h39IahXtrss4POsoKschi1Edm-vVQ7vzDJQbCXPVG5ZJ1Y46VG6uI_dVTZEeCIdtQPhiY-RL_-2_3DiL8PouqxQpUciOzhJj1-I5srkWXYubFBKFGtyOgP4W8xXDxnI_?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

   * Select the newly created template (e.g., SSL Certificates) and click **OK**.

   The template will now appear under **Certificate Templates** in the **Certification Authority** console.

### **1.2 Generate a Certificate for ADFS**

Once the certificate template is created, generate a certificate for the ADFS server:

1. **Open MMC (Microsoft Management Console)**:
   * Press **Win + R**, type `mmc.exe`, and press **Enter**.
   * Go to **File** → **Add/Remove Snap-in…** → Select **Certificates** and click **Add**.
   * Choose **Computer account** and click **Finish**.
2. **Request a New Certificate**:

   * Expand **Certificates (Local Computer)** → Right-click **Personal** → **All Tasks** → **Request New Certificate**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdKQLg-QYcS5QILCFCQjsS3N7FNW5EszEjgwOkgGZDCL7nGj1iE1Otp4whWFkzyZvMZ9bDqIL5SW4KjQzrNeIfA35-C64UIbF6AzGjdZS1AY0qTKXWqnElQn9MqfriT3biT3yotxw?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

* Follow the wizard until the template selection window appears.
* Select the newly created template (e.g., SSL Certificates) and click **More information is required to enroll for this certificate**

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfQ1KiUWWHkBoOmy34moaUBayWosAf5m8kz_6AypC1ThUQX0TDVVNHUUGRdAtR8ULV8x3l7oZ3FMqaWWsapP69TdXSYuzWy6j7sBEjFtC86gZhVG6uQUsuKJ96sq7Avee_bl4HYZg?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

3. **Specify Certificate Details**:

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcxqanAm1oy_RV9zYu8o5kjqSh9nXtC0U3BsKPFopB6rpHidagbgpyZOY8240XdnCQS0E7BTvUH1_Vsxhs6e0IsYrbLN1oJ4lyf3qPMp2xCjGkaZCH_RKh6mZXT1JRsa1L0JBCzTA?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

* In the **Subject name** group:
  * Set **Type** to **Common Name** and enter the **Fully Qualified Domain Name (FQDN)** of your ADFS server (e.g., `adfs.ad.contoso.com`). Click **Add**.
* In the **Alternative name** group:
  * Set **Type** to **DNS** and enter the **FQDN** again (e.g., `adfs.ad.contoso.com`). If multiple names are used for ADFS, add them all.

4. **Enroll**:

* After entering the required details, click **OK** and **Enroll** to generate the certificate.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXexfE-gLghagu5us3WWE4VmMFfevbTXsGJWIwHKX2Gw3_q9EQNT7kQXxtdphNxyfi52JJwj3hXCHC_wecuRrRwMvRI8bigVF0MCcAGnQQ09exmkDQxH64llJornuEbsk5tuT4jeAA?key=e2qx57R0hZ7MDRvJbziIVxF6" alt="" width="563"><figcaption></figcaption></figure>

The new certificate will appear in the **Certificates (Local Computer)** → **Personal** section.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeT3BLz7T1zCGPWtWviGnNtX_BUzu3UL8XpzrUwfmaBgpZd1pN8XWecN8o2YeDDqAYa4ZvkhALfTz3V1lUq2XW037FFYCI_lDt_66TOLrjwlYe2mON5r46Vp9xZcrSjpngz1WkxRA?key=e2qx57R0hZ7MDRvJbziIVxF6" alt="" width="563"><figcaption></figcaption></figure>

### **1.3 Create a Service Account for ADFS**

Microsoft recommends using a **Group Managed Service Account (gMSA)** to run the ADFS service. To create the account:

1. **Prepare the Key Distribution Service (KDS)**:
   * Run the following PowerShell command on a domain controller:

     ```powershell
     Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)
     ```
2. **Create the gMSA**:
   * Use the following syntax to create the gMSA:

     ```powershell
     New-ADServiceAccount -Name <AccountName> -DnsHostName <FederationServiceName> -ServicePrincipalNames http/<FederationServiceName>
     ```
   * Example:

     ```powershell
     New-ADServiceAccount -Name FSgMSA -DnsHostName adfs.contoso.com -ServicePrincipalNames http/adfs.contoso.com
     ```

## **2. Install ADFS Role**

### **2.1 Add ADFS Role**

1. Open **Server Manager**.
2. Click **Manage** → **Add Roles and Features**.
3. Follow the wizard and select **Active Directory Federation Services** when prompted to choose a role.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcQe-hqGaold5OXJ4rHAD5fa5U1BPg-fDufeDUJlnzD1PVDJPNGqe5KK_roCadtVymbal-j8VplOBRyPWQziUhfaG1FwpSf5HViHFucGMv9g-ATmyi2NqWLM8R2784XDJoEB8BW-g?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

### **2.2 Configure ADFS**

1. After installation, open the **Server Manager** dashboard.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdcRwYZU79fuhMxYhpCPptshHINkSl9nXlcb97yr6-oCI3sG2UTgovgIlrs6_IbEy1ehrvQC_z_Z9cGUlMR5bzIeiHXNtSSd4CMP5abfVdYKGGyQo1KuXM8hQNR3XYGQT0Fo1z_Rw?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

2. Click **Configure the federation service on this server**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcGQIJ-c1NFhKyMpz2SwDvZpc92Me7Fw0isCF0HOGt1uRQ0Se3tEQaOqbtCg2AJIW-xDXafrW6rNGSP5HOufCnjpqXOJfuJmfdJr42TqgK8sGg8inKLJ8VHO-gSNcYlQo4Q5roG?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

3. Follow the ADFS configuration wizard:

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdaM8RxQhppp-TZsx6-iPeydG84FavwQJ6nq1KzzLjnVuOa8qp0wh85L2lT8jnf_bWCaKRHaaWo-W8NKhCWz4b8QdQF5IcOUSH7sidi2RYZHARr-5QFsNaCL30p0f0k60jcPmi2sw?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

* **Specify the Certificate**: Select the SSL certificate created earlier.
* **Federation Service Name**: This will auto-fill based on the certificate (e.g., `adfs.contoso.com`).
* **Federation Service Display Name**: Enter the name of your organization.
* **Specify the Service Account**: Use the gMSA created earlier (e.g., FSgMSA).

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdGT1XS9S-7IrnWLBuwDQzluUXwYDl3ydi2QXed50i2-iSywo7fAubu7g1YyrDF197En4-q9QakeD7LzyXsiOMqRSF5ySsLhMEaZXX6j_sEQoc_A1IwemBkb3R854ClMgLJVfWRyQ?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

2. Leave the remaining options as default and complete the configuration.

{% hint style="info" %}

### **Next Steps**

After setting up ADFS, proceed to [integrate it with Microsoft Exchange by configuring claims-based authentication for **Outlook Web App (OWA)** and **Exchange Admin Center (EAC)**. ](/hideez-server-integration/saml-integration/microsoft-exchange-for-authentication-via-saml.md)
{% endhint %}

{% hint style="success" %}
For more information, refer to the [official Microsoft documentation on ADFS installation](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/ad-fs-deployment).
{% endhint %}

***