In-pace upgrade possibility for ADFS Web application proxy servers

Yes. An in-place upgrade path from Windows Server 2016 to Windows Server 2025 is supported for nonclustered systems.

For Web Application Proxy specifically, after the AD FS farm behavior level is updated, Web Application Proxy must be upgraded to the latest level. The documented post-upgrade steps are:

1. Sign in to the Web Application Proxy server and open an elevated PowerShell session.
2. Import the federation certificate and note its thumbprint.
3. Reconfigure WAP by running:

      $trustcred = Get-Credential -Message "<Enter Domain Administrator credentials>"
      Install-WebApplicationProxy -CertificateThumbprint "<SSLCertThumbprint>" -FederationServiceName "<FScomputername>" -FederationServiceTrustCredential $trustcred
   

4. Review connected WAP servers:

      Get-WebApplicationProxyConfiguration
   

5. If older WAP servers remain, remove them from the connected server list and keep only the upgraded servers:

      Set-WebApplicationProxyConfiguration -ConnectedServersName "WAPServerName1", "WAPServerName2"
   

6. Upgrade the WAP configuration version:

      Set-WebApplicationProxyConfiguration -UpgradeConfigurationVersion
   

If building a replacement server instead of upgrading in place is preferred, Web Application Proxy can also be installed and configured fresh by adding the Remote Access role and Web Application Proxy role service, then running the Web Application Proxy Configuration Wizard in the Remote Access Management console.

Because these servers are in a DMZ and not domain joined, the documented WAP configuration model still applies: configuration is done against the AD FS federation service using the federation service name, certificate, and administrator credentials.

References:

• Plan your Windows Server upgrade
• Upgrade an existing AD FS farm by using Windows Internal Database
• Upgrade to AD FS in Windows Server 2016 with SQL Server
• Upgrading AD RMS to Windows Server 2016