Skip to content

Conversation

tom-maher
Copy link
Contributor

Clarified the V-net to V-net connectivity requirements for AD FS deployment, specifying the communication method between federation servers and WAP servers - https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#communication-between-federation-servers

Clarified the V-net to V-net connectivity requirements for AD FS deployment, specifying the communication method between federation servers and WAP servers - https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#communication-between-federation-servers
Copy link
Contributor

@tom-maher : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change.

Copy link
Contributor

Learn Build status updates of commit ddbc11e:

✅ Validation status: passed

File Status Preview URL Details
WindowsServerDocs/identity/ad-fs/deployment/active-directory-adfs-in-azure-with-azure-traffic-manager.md ✅Succeeded

For more details, please refer to the build report.

@v-dirichards v-dirichards requested a review from Copilot October 10, 2025 15:43
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the documentation for AD FS deployment in Azure to clarify V-net to V-net connectivity requirements. The change replaces the previous statement that no connectivity between virtual networks is needed with specific communication requirements for federation servers and WAP servers.

  • Clarified communication requirements between federation servers and WAP servers
  • Specified HTTP port 80 usage for configuration synchronization
  • Updated guidance on V-net connectivity for AD FS deployments

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

* **DNS Labels for public IP addresses:** Azure Traffic Manager can refer to endpoints ONLY via DNS labels. Therefore, you are required to create DNS labels for the External Load Balancers' public IP addresses.
* **Azure Traffic Manager:** Microsoft Azure Traffic Manager allows you to control the distribution of user traffic to your service endpoints running in different datacenters around the world. Azure Traffic Manager works at the DNS level. It uses DNS responses to direct end-user traffic to globally-distributed endpoints. Clients then connect to those endpoints directly. With different routing options of Performance, Weighted and Priority, you can easily choose the routing option best suited for your organization's needs.
* **V-net to V-net connectivity between two regions:** You do not need to have connectivity between the virtual networks itself. Since each virtual network has access to domain controllers and has AD FS and WAP server in itself, they can work without any connectivity between the virtual networks in different regions.
* **V-net to V-net connectivity between two regions:** Federation servers on an AD FS farm communicate with other servers in the farm and the Web Application Proxy (WAP) servers via HTTP port 80 for configuration synchronization.
Copy link

Copilot AI Oct 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The updated explanation is incomplete and potentially misleading. It only mentions HTTP port 80 but doesn't address whether V-net to V-net connectivity is actually required or not, which was the key point of the original text. Consider clarifying whether connectivity between virtual networks is needed and under what circumstances.

Suggested change
* **V-net to V-net connectivity between two regions:** Federation servers on an AD FS farm communicate with other servers in the farm and the Web Application Proxy (WAP) servers via HTTP port 80 for configuration synchronization.
* **V-net to V-net connectivity between two regions:** V-net to V-net connectivity may be required if your AD FS farm spans multiple regions and federation servers or Web Application Proxy (WAP) servers in different regions need to communicate for configuration synchronization (typically via HTTP port 80). If each region is deployed as a fully self-contained environment with its own domain controllers and AD FS farm, V-net to V-net connectivity may not be necessary. Carefully assess your deployment topology to determine whether cross-region connectivity is needed for your scenario.

Copilot uses AI. Check for mistakes.

@v-dirichards
Copy link
Contributor

@robinharwood, @Xelu86
Can you review the proposed changes?

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team
#assign: @robinharwood, @Xelu86

@prmerger-automator prmerger-automator bot added the aq-pr-triaged tracking label for the PR review team label Oct 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants