Migrate Microsoft 365 from ADFS to Cloud Authentication
Question details
The organization needs a staged plan to replace ADFS authentication for Microsoft 365 and, if required, remove dependencies on local Active Directory and Exchange.
- Product
- Microsoft 365, Microsoft Entra ID, Microsoft Entra Connect Sync, ADFS, and Exchange
- Device & OS
- not provided
- Scenario
- Move Microsoft 365 sign-in from federation to managed authentication, with an optional transition to cloud-only identities and mailboxes.
- Observed behavior
- The desired state is working Microsoft 365 authentication without ADFS, with directory synchronization and on-premises services removed only when they are no longer required.
Identify federated domains, synchronization tools, mailbox locations, and applications that depend on ADFS or local Active Directory. Verify a cloud-only administrator account can sign in independently of ADFS, and choose whether synchronized identities will remain or become cloud-only.
Replace ADFS with Microsoft Entra ID managed authentication
Use this process to remove ADFS from Microsoft 365 sign-in while retaining directory synchronization if needed.
Password Hash Synchronization (PHS) allows Microsoft Entra ID to validate passwords in the cloud. Pass-through Authentication (PTA) replaces ADFS but still requires on-premises authentication agents and access to local Active Directory, so it is not a fully cloud-independent endpoint.
Changing authentication does not move mailboxes or disable directory synchronization. Treat those as separate migration tasks.
In the Microsoft Entra admin center, review Identity > Settings > Domain names and identify federated domains. Review ADFS relying party trusts and document applications, authentication policies, and sign-in features that must be preserved.
On the Microsoft Entra Connect Sync server, open Microsoft Entra Connect and select Configure > Change user sign-in. Follow Microsoft's current migration procedure to prepare PHS or PTA without converting production domains before testing; for PHS, verify password hashes have synchronized, and for PTA, verify agent availability.
In the Microsoft Entra admin center, open Identity > Hybrid management > Microsoft Entra Connect > Connect Sync and locate Staged rollout of cloud authentication. Enable the selected method for a supported pilot group, then test Microsoft 365 sign-in, MFA, Conditional Access, and required applications.
After the pilot succeeds, follow Microsoft's current federation-to-managed conversion procedure for each production domain. Sign in with representative user accounts and verify that Microsoft 365 no longer redirects them to ADFS.
Review Microsoft Entra sign-in logs and test every remaining ADFS relying party. Remove Microsoft 365 federation configuration and decommission ADFS infrastructure only after no required application or service still depends on it.
Move identities and mailboxes to a cloud-only Microsoft 365 environment
Use this additional process only if the organization also intends to stop using local Active Directory, synchronization, and Exchange services.
Keep working with Office documents during your Microsoft 365 transition
WPS Office does not migrate Microsoft 365 identities, replace ADFS, or administer Exchange. It offers a free, lightweight alternative for everyday document work, with a familiar interface and Microsoft Office format compatibility to help users transition their editing workflows.
Frequently Asked Questions
Do I need to disable directory synchronization to stop using ADFS?
No. You can convert federated domains to managed authentication while keeping Microsoft Entra Connect Sync. Prepare PHS or PTA through Microsoft Entra Connect > Configure > Change user sign-in, test the change, and then complete the domain conversion.
Which authentication method should I choose if I want to remove local Active Directory?
PHS supports cloud-side password validation and is generally the relevant option when removing on-premises authentication dependencies. PTA still relies on local agents and Active Directory. Complete and validate password hash synchronization before retiring the local directory.
Does staged rollout remove federation from my domain?
No. Staged rollout lets selected users test cloud authentication while the domain remains federated. After testing through the Microsoft Entra admin center's Staged rollout settings, perform the separate federation-to-managed conversion using Microsoft's current procedure.
Can I uninstall Microsoft Entra Connect immediately after changing authentication?
Not if you still need synchronized identities or attributes. For a cloud-only transition, resolve dependencies first, disable synchronization at the tenant level using Microsoft's supported procedure, confirm cloud management, and only then remove the synchronization software.
Can WPS Office perform the ADFS or Exchange migration?
No. These changes require Microsoft Entra ID, Microsoft 365, and Exchange administration tools. WPS Office is an alternative for opening and editing Office documents, not a tenant identity or mailbox migration tool.
