> For the complete documentation index, see [llms.txt](https://enterprise.hideez.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://enterprise.hideez.com/hideez-server-integration/saml-integration/microsoft-exchange-for-authentication-via-saml/adfs-installation.md).

# ADFS Installation

## **1. Preparation for ADFS Installation**

### **1.1 Create a Certificate Template**

ADFS requires trusted certificates to ensure secure communication. These certificates can be generated using your internal Certificate Authority (CA). Follow these steps to create a certificate template:

1. **Access Certificate Templates Management**:

   * Open the **Certification Authority** console.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeUg_6tTTfXYooSezcZOiHTbi_O2qoYZfq3jKE5e1_QoXvCSitZ20ZBkRjqX7m_f9xR8DbJSZUVsncuMLSPILx6SvjQiOj-ew7AAm-aAKN1PqBkPP_A51Xi8Tf9qqDdMQf-lgJ9KQ?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

   * Navigate to **Certificate Templates** → Right-click and select **Manage**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc0p6vbWr_wFVtpkIBFJY-LTdnQQY32uqgpdNwzNpVPmq73ZE5n9GqvuFkgwUkaLDiRY9tIQL3O1kl2PHemCnrt0xY_Ftr1g4UlrpsZHDhYS7isLskvptadSGHwe8A-EqeQVI_C5w?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>
2. **Duplicate an Existing Template**:

   * Locate the **Web Server** template, right-click it, and select **Duplicate Template**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcPjyJvuQB1DkATWAKFzS_4hG9gQL4tE2tATRLJnVkxyieb4TDWEO51BfOlDUsWORL4JzFk71nCYhzhohy-B5KMtlIa33tnzob6YO10B5eesOQASyAAp09G63bC0ekwszHFMziGZQ?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>
3. **Modify the Template**:
   * Go to the **General** tab:
     * In **Template display name**, enter a name like "SSL Certificates."
   * Go to the **Security** tab:

     * Select **Authenticated Users** and check **Enroll** under the **Allow** column. Click **OK**.

     <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfc6UIYhdgdRHJ-tNgkTMrcBWgp_OQT3PPfUKG2AYk1uCtPB3lNy5ChV6eHuT3ERx6CRw084nSVeMwtuXMm2PJHaE-fx9FTCQKAqBwtS2057pp5pgnhG-3xV5GbMdaZ8br1DaJ76w?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>
4. **Publish the New Template**:

   * Close the **Certificate Templates** console.
   * In the **Certification Authority** console, right-click **Certificate Templates** → **New** → **Certificate Template to Issue**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXe2Rxp-h39IahXtrss4POsoKschi1Edm-vVQ7vzDJQbCXPVG5ZJ1Y46VG6uI_dVTZEeCIdtQPhiY-RL_-2_3DiL8PouqxQpUciOzhJj1-I5srkWXYubFBKFGtyOgP4W8xXDxnI_?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

   * Select the newly created template (e.g., SSL Certificates) and click **OK**.

   The template will now appear under **Certificate Templates** in the **Certification Authority** console.

### **1.2 Generate a Certificate for ADFS**

Once the certificate template is created, generate a certificate for the ADFS server:

1. **Open MMC (Microsoft Management Console)**:
   * Press **Win + R**, type `mmc.exe`, and press **Enter**.
   * Go to **File** → **Add/Remove Snap-in…** → Select **Certificates** and click **Add**.
   * Choose **Computer account** and click **Finish**.
2. **Request a New Certificate**:

   * Expand **Certificates (Local Computer)** → Right-click **Personal** → **All Tasks** → **Request New Certificate**.

   <figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdKQLg-QYcS5QILCFCQjsS3N7FNW5EszEjgwOkgGZDCL7nGj1iE1Otp4whWFkzyZvMZ9bDqIL5SW4KjQzrNeIfA35-C64UIbF6AzGjdZS1AY0qTKXWqnElQn9MqfriT3biT3yotxw?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

* Follow the wizard until the template selection window appears.
* Select the newly created template (e.g., SSL Certificates) and click **More information is required to enroll for this certificate**

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfQ1KiUWWHkBoOmy34moaUBayWosAf5m8kz_6AypC1ThUQX0TDVVNHUUGRdAtR8ULV8x3l7oZ3FMqaWWsapP69TdXSYuzWy6j7sBEjFtC86gZhVG6uQUsuKJ96sq7Avee_bl4HYZg?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

3. **Specify Certificate Details**:

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcxqanAm1oy_RV9zYu8o5kjqSh9nXtC0U3BsKPFopB6rpHidagbgpyZOY8240XdnCQS0E7BTvUH1_Vsxhs6e0IsYrbLN1oJ4lyf3qPMp2xCjGkaZCH_RKh6mZXT1JRsa1L0JBCzTA?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

* In the **Subject name** group:
  * Set **Type** to **Common Name** and enter the **Fully Qualified Domain Name (FQDN)** of your ADFS server (e.g., `adfs.ad.contoso.com`). Click **Add**.
* In the **Alternative name** group:
  * Set **Type** to **DNS** and enter the **FQDN** again (e.g., `adfs.ad.contoso.com`). If multiple names are used for ADFS, add them all.

4. **Enroll**:

* After entering the required details, click **OK** and **Enroll** to generate the certificate.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXexfE-gLghagu5us3WWE4VmMFfevbTXsGJWIwHKX2Gw3_q9EQNT7kQXxtdphNxyfi52JJwj3hXCHC_wecuRrRwMvRI8bigVF0MCcAGnQQ09exmkDQxH64llJornuEbsk5tuT4jeAA?key=e2qx57R0hZ7MDRvJbziIVxF6" alt="" width="563"><figcaption></figcaption></figure>

The new certificate will appear in the **Certificates (Local Computer)** → **Personal** section.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeT3BLz7T1zCGPWtWviGnNtX_BUzu3UL8XpzrUwfmaBgpZd1pN8XWecN8o2YeDDqAYa4ZvkhALfTz3V1lUq2XW037FFYCI_lDt_66TOLrjwlYe2mON5r46Vp9xZcrSjpngz1WkxRA?key=e2qx57R0hZ7MDRvJbziIVxF6" alt="" width="563"><figcaption></figcaption></figure>

### **1.3 Create a Service Account for ADFS**

Microsoft recommends using a **Group Managed Service Account (gMSA)** to run the ADFS service. To create the account:

1. **Prepare the Key Distribution Service (KDS)**:
   * Run the following PowerShell command on a domain controller:

     ```powershell
     Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)
     ```
2. **Create the gMSA**:
   * Use the following syntax to create the gMSA:

     ```powershell
     New-ADServiceAccount -Name <AccountName> -DnsHostName <FederationServiceName> -ServicePrincipalNames http/<FederationServiceName>
     ```
   * Example:

     ```powershell
     New-ADServiceAccount -Name FSgMSA -DnsHostName adfs.contoso.com -ServicePrincipalNames http/adfs.contoso.com
     ```

## **2. Install ADFS Role**

### **2.1 Add ADFS Role**

1. Open **Server Manager**.
2. Click **Manage** → **Add Roles and Features**.
3. Follow the wizard and select **Active Directory Federation Services** when prompted to choose a role.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcQe-hqGaold5OXJ4rHAD5fa5U1BPg-fDufeDUJlnzD1PVDJPNGqe5KK_roCadtVymbal-j8VplOBRyPWQziUhfaG1FwpSf5HViHFucGMv9g-ATmyi2NqWLM8R2784XDJoEB8BW-g?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

### **2.2 Configure ADFS**

1. After installation, open the **Server Manager** dashboard.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdcRwYZU79fuhMxYhpCPptshHINkSl9nXlcb97yr6-oCI3sG2UTgovgIlrs6_IbEy1ehrvQC_z_Z9cGUlMR5bzIeiHXNtSSd4CMP5abfVdYKGGyQo1KuXM8hQNR3XYGQT0Fo1z_Rw?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

2. Click **Configure the federation service on this server**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcGQIJ-c1NFhKyMpz2SwDvZpc92Me7Fw0isCF0HOGt1uRQ0Se3tEQaOqbtCg2AJIW-xDXafrW6rNGSP5HOufCnjpqXOJfuJmfdJr42TqgK8sGg8inKLJ8VHO-gSNcYlQo4Q5roG?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

3. Follow the ADFS configuration wizard:

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdaM8RxQhppp-TZsx6-iPeydG84FavwQJ6nq1KzzLjnVuOa8qp0wh85L2lT8jnf_bWCaKRHaaWo-W8NKhCWz4b8QdQF5IcOUSH7sidi2RYZHARr-5QFsNaCL30p0f0k60jcPmi2sw?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

* **Specify the Certificate**: Select the SSL certificate created earlier.
* **Federation Service Name**: This will auto-fill based on the certificate (e.g., `adfs.contoso.com`).
* **Federation Service Display Name**: Enter the name of your organization.
* **Specify the Service Account**: Use the gMSA created earlier (e.g., FSgMSA).

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdGT1XS9S-7IrnWLBuwDQzluUXwYDl3ydi2QXed50i2-iSywo7fAubu7g1YyrDF197En4-q9QakeD7LzyXsiOMqRSF5ySsLhMEaZXX6j_sEQoc_A1IwemBkb3R854ClMgLJVfWRyQ?key=e2qx57R0hZ7MDRvJbziIVxF6" alt=""><figcaption></figcaption></figure>

2. Leave the remaining options as default and complete the configuration.

{% hint style="info" %}

### **Next Steps**

After setting up ADFS, proceed to [integrate it with Microsoft Exchange by configuring claims-based authentication for **Outlook Web App (OWA)** and **Exchange Admin Center (EAC)**. ](/hideez-server-integration/saml-integration/microsoft-exchange-for-authentication-via-saml.md)
{% endhint %}

{% hint style="success" %}
For more information, refer to the [official Microsoft documentation on ADFS installation](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/ad-fs-deployment).
{% endhint %}

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://enterprise.hideez.com/hideez-server-integration/saml-integration/microsoft-exchange-for-authentication-via-saml/adfs-installation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.