- [Instructor] Active Directory Federation Services
is a server role that isn't new and to be honest,
it hasn't really changed in function all that much
over the last few versions.
It is however becoming increasingly important
in the changing landscape of corporate networks.
The function of federated identity
is to form trusts across organizational lines
to allow you to claim
the identity of someone in your network
as someone who should be granted permissions
to a resource in another.
Let me use for example Landon Cafe
which is the in-house restaurant at the Landon Hotel.
They are technically separate organizations
so they have their own separate Active Directory,
their own resources and their own users.
Landon Hotel has a guest billing application
with access controlled by their Active Directory.
The restaurant has a security group
for the room service employees and for the cashiers.
ADFS can be used to create a relying party trust
so that the hotel's application will be able to identify
the specific restaurant employees
that are allowed to access the app.
It's easy to see the benefit of federated identity
for this type of partner relationship.
ADFS doesn't grant access to browse or view
another organization's directory.
Instead, it uses the principles discussed for certificates.
The domain with the application is configured
to trust the user domain
to vouch for the group membership of their users.
The resource domain can then grant access
without either domain opening up any extra information
about their users, groups, or resources.
Here's another environment that may benefit
from this kind of relationship.
Hybrid networks are on the rise.
More and more networks are beginning
to distribute server workloads
between on-prem and Azure servers.
The Azure space and the on-prem servers are configured
to serve replicas of the same directory.
But ultimately, the two are separate entities.
The users in the cloud and the users on-premise
have to be coordinated.
Federated identity and other features of the ADFS role
make this kind of link possible
and add features to user accounts.
Whether you want to add multi-factor authentication
or registration of devices that aren't joined to the domain,
the federation of the identity of these users and devices
is becoming more and more prevalent within organizations.
As you plan a migration
or new deployment of Windows Server 2019,
make sure you aren't too focused on roles and features
that are new or noticeably upgraded.
Consider what may be coming in your organization
that will more fully take advantage of roles like ADFS
and other features that are already there.