Planning the AD FS Topology

The first consideration in the AD FS planning process is the number of federation servers to be deployed, and the sizing of those servers. In the AD FS section of the TechNet site, Microsoft provides detailed capacity planning guidance along with a sizing calculator that can be used to determine how many federation servers are needed, along with the sizing recommendations for each server. However, the reality is that for a new Lync Online deployment, most organizations will not have the data that must be input to make use of the sizing tools provided. For this reason, and also because the resource requirements for a federation server are not significant, Microsoft also provides separate guidance for AD FS deployments that are planned for Office 365. This information can be used to estimate the number of federation servers and federation server proxies that should be deployed based on the number of users who will be accessing Office 365. For example, Table 28.7 provides guidelines on the number of servers recommended based on the Lync Online user count.

Table 28.7. Recommended Number of AD FS Servers Based on User Count

Note from Table 28.7 that a minimum of two servers is recommended for all scenarios, regardless of user count. The reason for this is that, although a single federation server can handle many user connections, this configuration would represent a single point of failure for a relatively critical service. Two federation servers is therefore the minimum recommendation to allow resiliency for SSO. Connections to multiple federation servers in a farm must be load balanced, which can be accomplished using Microsoft’s built-in network load balancing (NLB) feature, or using a hardware load balancer.

Regardless of the number of servers involved, each deployment of AD FS constitutes a single instance of a federation service, and each federation service is represented by a fully qualified domain name that is unique within the organization. If the federation service will provide connections from external systems, a public DNS name is required. If split brain DNS is used, a DNS host record for the federation service needs to be configured for both the internal and the external zones.

One service account is also used to run AD FS across all servers within a federated service instance. With a standalone AD FS deployment, a dedicated service account is not required, and the NETWORK SERVICE account is automatically specified by the AD FS installer to serve this purpose. However, a dedicated service account is still recommended for standalone deployments to reduce the attack surface of the federation server. A user account should therefore be created for this purpose in Active Directory before the installation of AD FS, and then configured as a dedicated service account for AD FS during the initial configuration. The service account does not require any particular rights to the AD domain; however, it must be a member of the local Administrators group on each federation server.