In-pace upgrade possibility for ADFS Web application proxy servers

Abhishek Rai 46 Reputation points
2026-07-21T07:53:50.17+00:00

I am writing to know regarding the possibility on in-place upgrade of ADFS Web application proxy servers from Windows 2016 to 2025.
I can provide the details required, these servers are not domain joined, are in DMZ, no external application URL published on Remote Access console.

Microsoft Security | Active Directory Federation Services
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-07-21T07:54:36.1866667+00:00

    Yes. An in-place upgrade path from Windows Server 2016 to Windows Server 2025 is supported for nonclustered systems.

    For Web Application Proxy specifically, after the AD FS farm behavior level is updated, Web Application Proxy must be upgraded to the latest level. The documented post-upgrade steps are:

    1. Sign in to the Web Application Proxy server and open an elevated PowerShell session.
    2. Import the federation certificate and note its thumbprint.
    3. Reconfigure WAP by running: 
         $trustcred = Get-Credential -Message "<Enter Domain Administrator credentials>"
   Install-WebApplicationProxy -CertificateThumbprint "<SSLCertThumbprint>" -FederationServiceName "<FScomputername>" -FederationServiceTrustCredential $trustcred
    4. Review connected WAP servers: 
         Get-WebApplicationProxyConfiguration
    5. If older WAP servers remain, remove them from the connected server list and keep only the upgraded servers: 
         Set-WebApplicationProxyConfiguration -ConnectedServersName "WAPServerName1", "WAPServerName2"
    6. Upgrade the WAP configuration version: 
         Set-WebApplicationProxyConfiguration -UpgradeConfigurationVersion

    If building a replacement server instead of upgrading in place is preferred, Web Application Proxy can also be installed and configured fresh by adding the Remote Access role and Web Application Proxy role service, then running the Web Application Proxy Configuration Wizard in the Remote Access Management console.

    Because these servers are in a DMZ and not domain joined, the documented WAP configuration model still applies: configuration is done against the AD FS federation service using the federation service name, certificate, and administrator credentials.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.