Can EntraID Connect Sync be connected to an onsite ADFS without a web proxy

Bill Hind 20 Reputation points
2026-09-02T03:53:02.85+00:00

I have ADFS set up on an onsite Server 2022 DC and I'm wishing to connect it to EntraID Connect without deploying a Web Proxy Server, Is this achievable?

Microsoft Security | Active Directory Federation Services
0 comments
Answer accepted by question author
Marcin Policht 106.8K Reputation points MVP Volunteer Moderator
2026-09-02T11:16:27.1733333+00:00

Yep - you can connect your on-premises AD FS deployment to Microsoft Entra ID through Microsoft Entra Connect without deploying an AD FS Web Application Proxy server.

WAP is not required for Entra Connect or for the federation relationship itself. WAP is primarily used to publish AD FS to the internet so that external users can reach AD FS endpoints. If your AD FS servers are accessible only internally, Entra Connect can configure and manage the federation relationship without WAP.

However, if your goal is to have users authenticate through AD FS from outside your corporate network, then the AD FS endpoints must be externally reachable. In that scenario, Microsoft generally recommends using WAP or another appropriately secured reverse-proxy solution rather than exposing the AD FS servers directly to the internet.

For a typical setup, you would have your on-premises AD DS and AD FS servers, install Microsoft Entra Connect on a suitable member server, and select "Federation with AD FS" as the authentication method. Entra Connect then establishes the federation configuration between your AD FS infrastructure and Microsoft Entra ID. You do not need to install Entra Connect directly on the domain controller or AD FS server.

One important consideration is whether you actually need AD FS. If your objective is simply to synchronize on-premises identities to Entra ID and provide SSO, Password Hash Synchronization (PHS) or Pass-through Authentication (PTA) is generally simpler and avoids the additional AD FS infrastructure and external publishing requirements.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-09-02T03:53:15.84+00:00

    Yes. A Web Application Proxy server is not required to connect AD FS to Microsoft Entra Connect.

    Microsoft Entra Connect supports configuring AD FS with or without Web Application Proxy servers:

    • AD FS federation servers are specified separately from Web Application Proxy servers.
    • Web Application Proxy is described as supporting authentication requests from the extranet.
    • During setup, Web Application Proxy servers are optional because the configuration flow allows adding one or more proxy servers, not requiring them.
    • Microsoft recommends a single Web Application Proxy server for test and pilot deployments, which indicates it is a deployment choice rather than a prerequisite.

    What is required for AD FS with Microsoft Entra Connect:

    1. An AD FS server on Windows Server 2012 R2 or later with remote management enabled.
    2. A TLS/SSL certificate for the federation service name.
    3. WinRM enabled on the remote servers.
    4. Local administrator credentials on the AD FS server.

    What the proxy changes:

    • If no Web Application Proxy is deployed, AD FS can still be used, but the proxy role is the component that supports authentication requests from the extranet.
    • If external/extranet access is needed later, a Web Application Proxy can be added afterward by using Microsoft Entra Connect.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.