Deploy AD FS on a Managed Microsoft AD domain

This guide describes how you can deploy Microsoft Active Directory Federation Services (AD FS) for Windows Server 2019 in a Managed Service for Microsoft Active Directory domain.

The following diagram illustrates the deployment:

Architecture

Users communicate with an HTTPS load balancer that uses a Google-managed certificate to terminate SSL connections. The load balancer forwards connections to a VM instance that runs Microsoft AD FS for Windows Server 2019 and that is joined to Managed Microsoft AD domain. Communication between the load balancer and the VM instance is secured by using a self-signed SSL certificate.

The deployment uses a single AD FS instance and the Windows Internal Database, which makes it suitable for small environments. For environments with increased reliability or security demands, consider deploying multiple AD FS instances in a farm configuration and deploying federation proxies.

Before you begin

Create a Managed Microsoft AD domain.
Retrieve the delegated administrator account credentials of the Managed Microsoft AD domain. By default, the delegated administrator account is named setupadmin.
Create a public DNS zone. You use this zone to create a public DNS name for AD FS.
Make sure that you're familiar with the requirements for deploying AD FS.

Preparing the project and network

You need to prepare your Google Cloud project and VPC network for the deployment of AD FS.

Create a VM instance

Create a service account and VM instance to run AD FS:

In the Google Cloud console, open Cloud Shell.

Activate Cloud Shell
Set your default project ID:
```
gcloud config set project PROJECT_ID
```
Replace PROJECT_ID with the ID of your Google Cloud project.
Set your default region and zone:
```
gcloud config set compute/region REGION
gcloud config set compute/zone ZONE
```
Replace the following:
- REGION: The ID of the region you want to deploy in.
- ZONE: The ID of the zone you want to deploy in.
Create a service account:
```
gcloud iam service-accounts create SA_NAME
```
Replace SA_NAME with the name of the service account.
Create a VM instance that runs Windows Server 2019 and uses a specialize script to automatically install the AD FS server role:
```
gcloud compute instances create VM_NAME \
  --machine-type n2-standard-8 \
  --image-family windows-2019 \
  --image-project windows-cloud \
  --boot-disk-size 50 \
  --boot-disk-type pd-ssd \
  --subnet SUBNET_NAME \
  --service-account SA_NAME@$(gcloud config get-value core/project).iam.gserviceaccount.com \
  --metadata sysprep-specialize-script-ps1="Add-WindowsFeature ADFS-Federation -IncludeManagementTools;Add-WindowsFeature RSAT-AD-PowerShell;Add-WindowsFeature RSAT-ADDS-Tools"
```
Replace the following:
- VM_NAME: The name of the VM instance.
- SUBNET_NAME: The name of the subnet to deploy AD FS in.
- SA_NAME: The name of the service account.
Note: Depending on your performance requirements, consider using a machine type larger than n2-standard-8 for AD FS.

To configure and join the VM instance to your Active Directory domain, complete the following steps:
1. Monitor the initialization process of the VM by viewing its serial port output:
```
gcloud compute instances tail-serial-port-output VM_NAME
```
  Wait about 3 minutes until you see the output Instance setup finished, then press Ctrl+C. At this point, the VM instance is ready to be used.
2. Create a username and password for the VM instance.
3. Connect to the VM by using Remote Desktop and log in using the username and password created in the previous step.
4. Right-click the Start button (or press Win+X) and click Windows PowerShell (Admin).
5. Confirm the elevation prompt by clicking Yes.
6. Join the computer to your Active Directory domain and restart:
```
Add-Computer -Domain DOMAIN -Restart
```
  Replace DOMAIN with the DNS name of your Active Directory domain.
  
  Wait for approximately 1 minute for the restart to complete.

Create a load balancer

You need to create a load balancer that lets users access AD FS by using a single virtual IP address.

To associate the VM instance that runs AD FS with the load balancer, you first create an unmanaged instance group, and then assign this instance group to the load balancer:

Return to your existing Cloud Shell session.

Create the unmanaged instance group:

gcloud compute instance-groups unmanaged create INSTANCE_GROUP_NAME &&
gcloud compute instance-groups set-named-ports INSTANCE_GROUP_NAME --named-ports=http:443

Replace INSTANCE_GROUP_NAME with the name of the group you want to create.

Add the existing VM instance to the instance group:

gcloud compute instance-groups unmanaged add-instances INSTANCE_GROUP_NAME --instances VM_NAME

Create a health check that probes the HTTPS port of AD FS:
```
gcloud compute health-checks create tcp HEALTH_CHECK_NAME --port 443
```
Replace HEALTH_CHECK_NAME with a name for the health check.
Create a load balancer backend service that uses the HTTPS health check and instance group that you created previously: