Azure AD Federation Services Test

Federation with Azure AD enables users to authenticate using on-premises credentials and access all resources in cloud.

When you federate your on-premises environment with Azure AD, you establish a trust relationship between the on-premises identity provider (IP) and Azure AD.

Due to this established trust, Azure AD honors the security token issued by the on-premises identity provider post authentication, to grant access to resources protected by Azure AD.

If the AD FS service stops running or if the IP fails to obtain a security token, then Azure users will be denied access to their critical cloud resources. To avoid this, administrators can run the Azure AD Federation Services test at configured intervals, track the status of the service, and be promptly alerted to the 'unhealthy' state of the service and the reasons for the same.

Target of the Test: A Microsoft Azure Active Directory Connect

Agent deploying the test: An internal agent

Output of the test: One set of results for the Azure AD Federation service that is monitored

Configurable parameters for the test

Parameters	Description
Test Period	How often should the test be executed.
Host	The host for which the test is to be configured.
Port	The port at which the specified Host listens
Tenant ID	Specify the Directory ID of the Azure AD tenant to be monitored. To know how to determine the Directory ID, refer to Configuring the eG Agent to Monitor a Microsoft Azure Subscription Using Azure ARM REST API.
Client ID, Client Password, and Confirm Password	To connect to the target tenant, the eG agent requires an Access token in the form of an Application ID and the client secret value. For this purpose, you should register a new application with the Azure AD tenant. To know how to create such an application and determine its Application ID and client secret, refer to Configuring the eG Agent to Monitor a Microsoft Azure Subscription Using Azure ARM REST API. Specify the Application ID of the created Application in the Client ID text box and the client secret value in the Client Password text box. Confirm the Client Password by retyping it in the Confirm Password text box.
DD Frequency	Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.
Detailed Diagnosis	To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled: The eG manager license should allow the detailed diagnosis capability Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.

Measures made by the test:

Measurement	Description	Measurement Unit	Interpretation
Status	Indicates the current status of the federation service.		The values that this measure reports and their corresponding numeric values are listed in the table below: Measure Value Numeric Value Healthy 1 Unhealthy 0 Note: By default, this measure reports the Measure Values listed in the table above to indicate the status of the Azure AD federation service. In the graph of this measure however, the same is represented using the numeric equivalents only.
Number of active alerts from last 30 minutes	Indicates the number of unresolved alerts for the Azure AD Federation service during the last 30 minutes.	Number	If the Status measure reports the value Unhealthy, then you can use the detailed diagnosis of this measure to view the type of alerts that were raised on the service, which could have contributed to the abnormal service state.
Number of resolved alerts from last 30 minutes	Indicates the number of resolved alerts for the Azure AD Federation service during the last 30 minutes.	Number	Use the detailed diagnosis of this measure to view the details of the resolved alerts.
Token request rate from last 30 minutes	Indicates the rate at which security token requests were serviced by the Federation service during the last 30 minutes.	Requests/Sec	A high value is desired for this measure.
Number of federation servers	Indicates the number of federation servers supporting the Azure AD FS service.	Number	Use the detailed diagnosis of this measure to know which are the federation servers and if there are any active alerts on each of the servers.
Number of federation servers proxy	Indicates the number of proxy federation servers.	Number

You can use the detailed diagnosis of the Number of active alerts from last 30 minutes measure to view the type of alerts that were raised on the service, which could have contributed to the abnormal service state.

Figure 1 : The detailed diagnosis of the Number of active alerts from last 30 minutes measure

Use the detailed diagnosis of the Number of federation servers measure to know which are the federation servers and if there are any active alerts on each of the servers.

Figure 2 : The detailed diagnosis of the Number of federation servers measure