Question

Your organization uses Active Directory Federation Services (AD FS) to provide federated sign-in for Microsoft 365. Users have recently reported intermittent authentication failures, and you want proactive alerting on AD FS token issuance failures, extranet lockouts, and overall service availability from the Microsoft Entra admin center. What must you do to enable this monitoring capability?

Accepted Answer

Install the Microsoft Entra Connect Health agent for AD FS on the federation servers and Web Application Proxy servers.

Answer

Enable staging mode on the Entra Connect server so it collects AD FS diagnostic logs.

Answer

Configure Conditional Access sign-in frequency policies to capture failed AD FS logon events.

Answer

Turn on Entra ID Protection sign-in risk policies to surface federation errors as risky sign-ins.