How do I migrate from AD FS to password hash sync or pass-through authentication using Staged Rollout?

Key facts

• Staged Rollout requires the Hybrid Identity Administrator role and only applies to users synced by Microsoft Entra Connect, not cloud-only users.
• You can add up to 10 groups per feature (password hash sync, pass-through authentication, seamless SSO); nested and dynamic groups are not supported.
• A newly added Staged Rollout group should hold no more than 200 members at first to avoid a UX time-out; you can add more users afterward.
• Staged Rollout never converts the domain: you still run Update-MgDomain -AuthenticationType Managed (or use Entra Connect) for the cutover.
• Converting a domain from federated to managed can take up to 60 minutes, so build that into the maintenance window.
• Microsoft recommends password hash sync for cloud authentication, and the Entra ID Protection leaked credentials report needs password hash sync no matter which sign-in method you use.

Password hash sync or pass-through authentication?

Both options remove AD FS from the sign-in path. Microsoft's migration guide recommends password hash sync (PHS). It needs no extra servers, runs as part of the Entra Connect sync cycle every two minutes, and keeps working if your on-premises servers go down.

Pick pass-through authentication (PTA) only if you must enforce on-premises account states at every sign-in: locked out, expired account, expired password or logon hours. PTA needs agents on domain-joined servers with outbound internet access. Even with PTA, enable PHS as well so you have a backup method and leaked credential detection.

Prerequisites and licensing

• Role: Hybrid Identity Administrator to configure Staged Rollout. Domain administrator credentials for each AD forest where you enable seamless SSO.
• Microsoft Entra Connect installed or upgraded to the latest version. Microsoft notes this cuts migration time from potentially hours to minutes.
• Password hash sync enabled on the Entra Connect Optional features page, with a full sync cycle completed so every user's hash is in Entra ID. Do this even if you plan to use PTA.
• For PTA: a Windows Server 2012 R2 or later domain-joined server (not the Entra Connect server) for each extra agent, plus Smart Lockout settings reviewed.
• Single sign-on plan: Primary Refresh Token SSO for Windows 10 and later Entra joined or hybrid joined devices, the Enterprise SSO plug-in for managed Apple devices, and seamless SSO for older domain-joined Windows.
• Conditional Access policies and tenant branding ready for migrated users. Conditional Access needs Entra ID P1; branding is available with a Microsoft 365 license.
• Cloud-only security groups for the pilot. Microsoft recommends cloud groups to avoid sync latency.
• PowerShell: Install-Module Microsoft.Graph -Scope CurrentUser for the domain conversion, and the AD FS PowerShell module on a federation server for backups.

What Staged Rollout does not support

Check these before you pick pilot users. Staged Rollout is a temporary test mechanism, not a permanent mixed state.

• Legacy authentication such as POP3 and SMTP. Legacy clients fall back to federation.
• Apps that send a domain_hint parameter. Those users keep authenticating through AD FS.
• SSPR with password writeback is not guaranteed to work consistently while a user is in Staged Rollout.
• Nested groups, dynamic groups, and groups that contain contact objects.
• Windows 10 PRT acquisition on versions older than 1903, or when the user's on-premises UPN is not routable.
• Nonpersistent VDI on Windows 10 1903 or later must stay on a federated domain.
• Windows Hello for Business hybrid certificate trust with certificates issued through AD FS as the registration authority, and smart card users.
• Password expiration is not applied to PHS users in Staged Rollout unless you enable CloudPasswordPolicyForPasswordSyncedUsersEnabled.

Step 1: Prepare AD FS and document your settings

1. With Microsoft Graph PowerShell, run Get-MgDomainFederationConfiguration for each federated domain and save the output. Note PreferredAuthenticationProtocol, federatedIdpMfaBehavior, SupportsMfa and PromptLoginBehavior.
2. On the AD FS server, export the Microsoft Office 365 Identity Platform relying party trust and its claim rules (script below). Consider the AD FS Rapid Restore Tool for a full farm backup.
3. Replace any AD FS access control policies with Entra Conditional Access policies, including a policy that blocks legacy authentication.
4. Confirm the Entra Connect sync setting synchronizeUpnForManagedUsersEnabled is true so UPN changes keep syncing after users become managed.
5. Send users a short notice: off-network, they will now see the Microsoft Entra sign-in page instead of the AD FS page.

# Back up federation settings before you change anything
# Microsoft Graph PowerShell: save current federation settings
Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomainFederationConfiguration -DomainId contoso.com |
  Format-List * | Out-File C:\temp\contoso-federation.txt

# On the AD FS server: export the Microsoft 365 relying party trust
(Get-AdfsRelyingPartyTrust -Name "Microsoft Office 365 Identity Platform") |
  Export-CliXML "C:\temp\O365-RelyingPartyTrust.xml"

Step 2: Enable seamless SSO (if you need it)

Seamless SSO only triggers for users in Staged Rollout, so it does not affect AD FS for everyone else. Run this on the Entra Connect server once per AD forest.

# Enable seamless SSO on an AD forest from the Entra Connect server
cd "$env:ProgramFiles\Microsoft Azure Active Directory Connect"
Import-Module "$env:ProgramFiles\Microsoft Azure AD Sync\Bin\ADSync\ADSync.psd1"
Import-Module .\AzureADSSO.psd1

# Sign in with a Hybrid Identity Administrator account
New-AzureADSSOAuthenticationContext
Get-AzureADSSOStatus | ConvertFrom-Json

# Domain administrator credentials for the target forest
$creds = Get-Credential
Enable-AzureADSSOForest -OnPremCredentials $creds

Notes on seamless SSO

• These AzureADSSO cmdlets ship with Entra Connect and are still the documented method. They are not the retired AzureAD module.
• Enable-AzureADSSOForest creates the AZUREADSSOACC computer account in the forest.
• Deploy the seamless SSO URLs to the intranet zone with Group Policy, as covered in the seamless SSO quickstart.

Step 3: Turn on Staged Rollout and add pilot groups

Members of a new group switch right away. If you edit membership later, changes can take up to 24 hours. Each action is written to the Entra audit log, and the Hybrid Auth workbooks show users added, removed and their sign-ins.

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as at least a Hybrid Identity Administrator.
2. Go to Entra ID > Entra Connect > Connect sync.
3. Under Staged rollout of cloud authentication, select Enable staged rollout for managed user sign-in.
4. On the Enable staged rollout feature page, set Password Hash Sync (or Pass-through authentication) to On, and set Seamless single sign-on to On if you enabled it. Do not combine PHS and PTA.
5. Add your pilot security group to each feature you turned on. Keep a new group at 200 members or fewer.
6. Add the same group to Seamless single sign-on. Seamless SSO only applies if the user is also in a PHS or PTA group.
7. Expect each pilot user to need one more interactive sign-in through AD FS before managed sign-in takes effect. To skip it, issue the user a Temporary Access Pass right after you add them.

Step 4: Test pilot sign-ins

1. Off the corporate network, open a private browser to myapps.microsoft.com and enter a pilot user's UPN. The user should see the Entra tenant-branded sign-in page, not the AD FS page.
2. On the corporate network with seamless SSO, the user should see 'Trying to sign you in' and then sign in silently.
3. In the Entra admin center, open the sign-in logs and filter by the user's UPN to confirm the sign-in succeeded.
4. Check AD FS event logs for any sign-ins that still reach AD FS from pilot users, which points to legacy clients or apps sending domain_hint.
5. Warn PHS pilot users that a password change can take up to 2 minutes to work in the cloud.

Step 5: Convert the domain to managed with PowerShell

Staged Rollout does not change the domain. Schedule the cutover off hours, since conversion can take up to 60 minutes and new browser sign-ins may not prompt during that time. You can convert one domain at a time, starting with the smallest. If AD FS was originally set up by Entra Connect, you can instead use Configure > Change user sign-in in the Entra Connect wizard. For PTA, confirm every agent shows Active before you convert.

# Convert a federated domain to managed with Microsoft Graph PowerShell
Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "Domain.ReadWrite.All","Domain-InternalFederation.ReadWrite.All","Directory.AccessAsUser.All"

# Convert one domain
Update-MgDomain -DomainId "contoso.com" -AuthenticationType "Managed"

# Confirm the change
Get-MgDomain -DomainId "contoso.com" | Select-Object Id, AuthenticationType

Step 6: Clean up and decommission AD FS

1. In the Entra admin center, go back to Entra ID > Entra Connect > Connect sync > Enable staged rollout for managed user sign-in and slide each feature to Off.
2. If you used PTA, update the sign-in method in Entra Connect so it shows pass-through authentication as enabled.
3. Move any SaaS apps still federated with AD FS to Entra ID enterprise applications.
4. Use Entra Connect Health for AD FS to confirm no new authentication requests reach the Microsoft 365 relying party trust, then remove that trust.
5. If AD FS serves no other relying parties, follow Microsoft's AD FS decommission guide to remove the servers and WAP proxies.
6. Roll over the seamless SSO Kerberos decryption key on the AZUREADSSO computer account at least every 30 days.

Rollback plan

During the pilot, rollback is simple: remove the user from the group, or slide the feature Off. The user needs one more interactive sign-in through Entra ID before they go back to AD FS.

After cutover, rollback means making the domain federated again with New-MgDomainFederationConfiguration, using the values you saved in Step 1. Keep AD FS running and its certificates valid until you are sure you will not need it.

# Re-federate a domain using your saved AD FS values (example values shown)
Connect-MgGraph -Scopes "Domain-InternalFederation.ReadWrite.All","Domain.ReadWrite.All"

New-MgDomainFederationConfiguration -DomainId "contoso.com" `
  -DisplayName "Contoso" `
  -IssuerUri "http://contoso.com/adfs/services/trust/" `
  -PassiveSignInUri "https://sts.contoso.com/adfs/ls/" `
  -ActiveSignInUri "https://sts.contoso.com/adfs/services/trust/2005/usernamemixed" `
  -MetadataExchangeUri "https://sts.contoso.com/adfs/services/trust/mex" `
  -SignOutUri "https://sts.contoso.com/adfs/ls/" `
  -SigningCertificate "<Base64 token-signing certificate>" `
  -PreferredAuthenticationProtocol "wsFed" `
  -FederatedIdpMfaBehavior "acceptIfMfaDoneByFederatedIdp"

Common errors and fixes

How to verify it worked

• Get-MgDomain -DomainId contoso.com returns AuthenticationType: Managed for every converted domain.
• In the Entra admin center, the Entra Connect page shows Federation as Disabled and Password Hash Sync (or Pass-through authentication) as Enabled, with Seamless single sign-on Enabled if you use it.
• For PTA, the Pass-through authentication page lists your agents with status Active.
• Sign-in logs, filtered by test users' UPNs, show successful sign-ins with no redirect to AD FS.
• Entra Connect Health for AD FS, or the AD FS event logs, show no new requests for the Microsoft 365 relying party trust.
• Staged Rollout features are all set to Off after cutover.

List the authentication type for all verified domains

Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomain | Where-Object IsVerified |
  Select-Object Id, AuthenticationType, IsDefault |
  Format-Table -AutoSize

When to call a consultant

Book a free call and we will map your AD FS dependencies and outline a pilot-first path to cloud authentication.

Take the 2-min fit check Talk to a specialist

How Accred Consulting approaches it

Accred starts with a free call to learn how your AD FS farm is used today: which relying parties it serves, where MFA happens, and which clients still use legacy auth. We then send a written plan with a fixed-fee or hourly scope. Our US-based team turns on password hash sync, rebuilds any AD FS access rules as Conditional Access policies, and runs a Staged Rollout pilot with IT staff first, then a wider group. We convert domains in an off-hours window with a documented rollback, and only decommission AD FS after logs show no remaining traffic.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

Sources

• Microsoft Learn: Microsoft Entra Connect: Cloud authentication via Staged Rollout
• Microsoft Learn: Migrate from federation to cloud authentication in Microsoft Entra ID
• Microsoft Learn: Authentication for Microsoft Entra hybrid identity solutions
• Microsoft Learn: Troubleshoot Pass-through Authentication