On-premise AD FS and Windows RDS (RDWeb) integration

Mohammed Alsomali 0 Reputation points
2026-07-09T04:55:08.78+00:00

We have on-premises AD FS with MFA Setup, and recently we deployed Windows RDS to provide RemoteApp access to users, we are using the Classic RDWeb access, want to integrate the RDS with AD FS so the users are authenticated by AD FS, we require guidelines document that shows the step by step configuration that needs to be done.

Thanks.

Microsoft Security | Active Directory Federation Services
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-07-09T04:56:16.09+00:00

    To integrate on-premises AD FS (with MFA) and classic RD Web / Remote Desktop Gateway through Web Application Proxy, follow these high-level steps based on the documented pattern for publishing RD Gateway via AD FS pre-authentication.

    1. Prepare AD FS and Web Application Proxy (WAP)
      • Ensure AD FS is deployed and configured, including MFA policies as required.
      • Ensure Web Application Proxy is installed and joined to the AD FS farm.
      • Confirm AD FS is reachable from WAP and that certificates and trust are correctly configured.
    2. Create a manual Relying Party Trust in AD FS for RD Gateway/RD Web
      In AD FS Management on the AD FS server:
      1. Open AD FS Management.
      2. Select Relying Party Trusts.
      3. Start the Add Relying Party Trust wizard.
      4. Choose Enter data about the relying party manually.
      5. Accept the default settings in the wizard (this is a “dummy” claims-aware RP used only to enforce pre-authentication).
      6. For the Relying Party Trust identifier, enter the external FQDN that will be used for RD Gateway/RD Web access, for example:
        https://rdg.contoso.com/
      7. Finish the wizard.
      This relying party trust will be referenced by Web Application Proxy to enforce AD FS pre-authentication (including MFA) before users reach RD Web/RD Gateway.
    3. Publish RD Gateway / RD Web through Web Application Proxy with AD FS pre-auth
      On the Web Application Proxy server:
      1. Open the Remote Access Management console.
      2. Choose to Publish a new application.
      3. For the External URL, specify the same FQDN used in the relying party trust, e.g. https://rdg.contoso.com/. Publish the root of the site (for example, https://rdg.contoso.com/).
      4. Set Pre-authentication to AD FS.
      5. Select the relying party trust created in step 2 as the pre-authentication target.
      6. Configure backend URL to point to the internal RD Web/RD Gateway server (e.g., https://rdg.internal.contoso.com/).
      Publishing the root (https://rdg.contoso.com/) ensures that both /rdweb and /rpc use the same Web Application Proxy authentication cookie. Authentication to RD Web Access still uses the RD Web form logon, but the WAP/AD FS pre-authentication enforces MFA and SSO before the user reaches RD Web.
    4. Configure RD Collection to support WAP pre-auth cookies (if required)
      The documented pattern for RD Gateway via WAP uses custom RDP properties in RemoteApp RDP files so that:
      • The client knows pre-authentication is required.
      • The browser-acquired WAP cookie is passed to the Remote Desktop Connection client (mstsc.exe).
      This is done on the RD Collection server by configuring the collection to include the necessary custom RDP properties in the RemoteApp RDP files. These properties instruct the client to use the WAP cookie obtained via the browser session. This minimizes extra prompts because the RD Web form logon creates a client-side credential store that mstsc.exe can reuse.
    5. Align AD FS MFA and access policies
      • In AD FS, configure Authentication Policies so that requests coming from WAP (extranet) to this relying party require MFA, as appropriate for your security requirements.
      • AD FS supports differentiating policies for intranet vs extranet and per application. For high-value apps like RDS, consider requiring MFA for all external access.
      • Ensure the chosen MFA provider (Microsoft Entra multifactor authentication or a third-party/custom provider) is enabled as a multifactor option in AD FS authentication policy.
    6. Test end-to-end
      • From an external client, browse to https://rdg.contoso.com/rdweb.
      • Confirm that WAP triggers AD FS pre-authentication and MFA.
      • After successful AD FS sign-in, verify RD Web loads and that launching a RemoteApp uses the WAP cookie and does not prompt for additional credentials beyond the RD Web form (depending on your configuration).
      • Validate that access is blocked when MFA requirements are not met, according to AD FS policy.

    This pattern provides AD FS-based pre-authentication (including MFA) for classic RD Web/RD Gateway using Web Application Proxy and a manually created relying party trust.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.