Glossary
Federation
By Emil Björk · Microsoft ecosystem consultant, Gothenburg
An authentication model where a trusted external identity provider authenticates users instead of the local directory.
Federation is an authentication model where a trusted external identity provider authenticates users on behalf of the relying party, with trust expressed via cryptographically signed assertions (SAML, OIDC). In Microsoft 365's history, federation with Active Directory Federation Services (AD FS) was the common pattern for hybrid identity — Entra ID redirected users to on-prem AD FS, which authenticated and signed assertions back. Microsoft is steering customers off federation in favour of cloud-side authentication (Password Hash Sync or Pass-Through Authentication), which is simpler and more resilient. The term federation also describes cross-tenant trust (Entra ID B2B) and broader IdP-to-RP trust relationships.
Worked example
A company set up AD FS-based federation with Entra ID years ago because it was the standard hybrid identity pattern at the time. Every sign-in redirects the user's browser from Entra ID out to an on-premises AD FS server, which authenticates against local Active Directory and redirects back with a signed token. When that AD FS server has an unplanned outage, no user in the company can sign into anything Microsoft 365-related, anywhere, until it comes back — the single point of failure federation quietly introduces is exactly why Microsoft now steers customers toward Password Hash Sync instead, which keeps authentication working even if on-premises infrastructure is down.
Common pitfalls
Keeping AD FS federation running out of inertia — "it's always been this way" — rather than because of a genuine, specific regulatory requirement is a common and avoidable risk, since it adds an on-prem outage as a single point of failure for every cloud sign-in with no corresponding benefit for most organisations. Confusing authentication federation (AD FS trusting Entra ID, or Entra ID trusting another IdP) with the unrelated concept of cross-tenant B2B trust is an easy mix-up, since both use the word "federation" but solve completely different problems. And assuming a federation migration to Password Hash Sync is purely a technical cutover misses that it also changes where password policy and account lockout are actually enforced — from on-prem AD's rules to Entra ID's, which is worth validating rather than assuming is a non-event.