Skip to content

Update V-net connectivity explanation for AD FS #8090

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update V-net connectivity explanation for AD FS #8090

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...y/ad-fs/deployment/active-directory-adfs-in-azure-with-azure-traffic-manager.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ The basic design principles will be same as listed in Design principles in the a
* **Network Security Groups:** As storage accounts, Network Security Groups created in a region cannot be used in another geographical region. Therefore, you will need to create new network security groups similar to those in the first geographical region for INT and DMZ subnet in the new geographical region.
* **DNS Labels for public IP addresses:** Azure Traffic Manager can refer to endpoints ONLY via DNS labels. Therefore, you are required to create DNS labels for the External Load Balancers' public IP addresses.
* **Azure Traffic Manager:** Microsoft Azure Traffic Manager allows you to control the distribution of user traffic to your service endpoints running in different datacenters around the world. Azure Traffic Manager works at the DNS level. It uses DNS responses to direct end-user traffic to globally-distributed endpoints. Clients then connect to those endpoints directly. With different routing options of Performance, Weighted and Priority, you can easily choose the routing option best suited for your organization's needs.
* **V-net to V-net connectivity between two regions:** You do not need to have connectivity between the virtual networks itself. Since each virtual network has access to domain controllers and has AD FS and WAP server in itself, they can work without any connectivity between the virtual networks in different regions.
* **V-net to V-net connectivity between two regions:** Federation servers on an AD FS farm communicate with other servers in the farm and the Web Application Proxy (WAP) servers via HTTP port 80 for configuration synchronization.
Copy link

Copilot AI Oct 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The updated explanation is incomplete and potentially misleading. It only mentions HTTP port 80 but doesn't address whether V-net to V-net connectivity is actually required or not, which was the key point of the original text. Consider clarifying whether connectivity between virtual networks is needed and under what circumstances.

Suggested change
* **V-net to V-net connectivity between two regions:** Federation servers on an AD FS farm communicate with other servers in the farm and the Web Application Proxy (WAP) servers via HTTP port 80 for configuration synchronization.
* **V-net to V-net connectivity between two regions:** V-net to V-net connectivity may be required if your AD FS farm spans multiple regions and federation servers or Web Application Proxy (WAP) servers in different regions need to communicate for configuration synchronization (typically via HTTP port 80). If each region is deployed as a fully self-contained environment with its own domain controllers and AD FS farm, V-net to V-net connectivity may not be necessary. Carefully assess your deployment topology to determine whether cross-region connectivity is needed for your scenario.

Copilot uses AI. Check for mistakes.

## Steps to integrate Azure Traffic Manager
### Deploy AD FS in the new geographical region
Expand Down