Azure AD Federation Services Test
Federation with Azure AD enables users to authenticate using on-premises credentials and access all resources in cloud.
When you federate your on-premises environment with Azure AD, you establish a trust relationship between the on-premises identity provider (IP) and Azure AD.
Due to this established trust, Azure AD honors the security token issued by the on-premises identity provider post authentication, to grant access to resources protected by Azure AD.
If the AD FS service stops running or if the IP fails to obtain a security token, then Azure users will be denied access to their critical cloud resources. To avoid this, administrators can run the Azure AD Federation Services test at configured intervals, track the status of the service, and be promptly alerted to the 'unhealthy' state of the service and the reasons for the same.
Target of the Test: A Microsoft Azure Active Directory Connect
Agent deploying the test: An internal agent
Output of the test: One set of results for the Azure AD Federation service that is monitored
Parameters | Description |
---|---|
Test Period |
How often should the test be executed. |
Host |
The host for which the test is to be configured. |
Port |
The port at which the specified Host listens |
Tenant ID |
Specify the Directory ID of the Azure AD tenant to be monitored. To know how to determine the Directory ID, refer to Configuring the eG Agent to Monitor a Microsoft Azure Subscription Using Azure ARM REST API. |
Client ID, Client Password, and Confirm Password |
To connect to the target tenant, the eG agent requires an Access token in the form of an Application ID and the client secret value. For this purpose, you should register a new application with the Azure AD tenant. To know how to create such an application and determine its Application ID and client secret, refer to Configuring the eG Agent to Monitor a Microsoft Azure Subscription Using Azure ARM REST API. Specify the Application ID of the created Application in the Client ID text box and the client secret value in the Client Password text box. Confirm the Client Password by retyping it in the Confirm Password text box. |
DD Frequency |
Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency. |
Detailed Diagnosis |
To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:
|
Measurement | Description | Measurement Unit | Interpretation | ||||||
---|---|---|---|---|---|---|---|---|---|
Status |
Indicates the current status of the federation service. |
|
The values that this measure reports and their corresponding numeric values are listed in the table below:
Note: By default, this measure reports the Measure Values listed in the table above to indicate the status of the Azure AD federation service. In the graph of this measure however, the same is represented using the numeric equivalents only. |
||||||
Number of active alerts from last 30 minutes |
Indicates the number of unresolved alerts for the Azure AD Federation service during the last 30 minutes. |
Number |
If the Status measure reports the value Unhealthy, then you can use the detailed diagnosis of this measure to view the type of alerts that were raised on the service, which could have contributed to the abnormal service state. |
||||||
Number of resolved alerts from last 30 minutes |
Indicates the number of resolved alerts for the Azure AD Federation service during the last 30 minutes. |
Number |
Use the detailed diagnosis of this measure to view the details of the resolved alerts. |
||||||
Token request rate from last 30 minutes |
Indicates the rate at which security token requests were serviced by the Federation service during the last 30 minutes. |
Requests/Sec |
A high value is desired for this measure. |
||||||
Number of federation servers |
Indicates the number of federation servers supporting the Azure AD FS service. |
Number |
Use the detailed diagnosis of this measure to know which are the federation servers and if there are any active alerts on each of the servers. |
||||||
Number of federation servers proxy |
Indicates the number of proxy federation servers. |
Number |
|
You can use the detailed diagnosis of the Number of active alerts from last 30 minutes measure to view the type of alerts that were raised on the service, which could have contributed to the abnormal service state.
Figure 1 : The detailed diagnosis of the Number of active alerts from last 30 minutes measure
Use the detailed diagnosis of the Number of federation servers measure to know which are the federation servers and if there are any active alerts on each of the servers.
Figure 2 : The detailed diagnosis of the Number of federation servers measure