Microsoft Entra ID
GeneralConnect Health Adfs
In brief
The documentation now describes the AD FS service overview, updated alert filtering and details, and the revised Usage Analytics experience with time-range controls. Screenshots and metadata were also refreshed.
What Entra admins need to know
Administrators can use the updated navigation and monitoring guidance to review federation server status, alerts, performance, usage, and security reports.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Open a PowerShell window, and then run the following command:
Set-AdfsProperties -AuditLevel Verbose
The "basic" audit level is enabled by default. For more information, see AD FS audit enhancement in Windows Server 2016.
Monitor AD FS using Microsoft Entra Connect Health
Open Microsoft Entra Connect Health, select AD FS services, and then select a service. The service page provides federation server status, alerts, performance and usage charts, and security reports.
:::image type="content" source="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-overview.png" alt-text="Screenshot of the Connect Health AD FS service overview with callouts for server details, Quick Start, service properties, and alerts." lightbox="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-overview.png":::
Alerts for AD FS
The Microsoft Entra Connect Health Alerts section provides you page lists active and resolved alerts. Use the list of active alerts. Eachtime-range control to include older resolved alerts, and use search to filter the list. Select an alert includes relevant information, resolution steps, and links to related documentation.
You can double-click an active or resolved alert,row to open the details panel, which contains alert metadata, affected servers, resolution guidance, related documentation, and a new blade with additional information, steps you can take to resolve the alert, and links to relevant documentation. You can also view historical data on alerts that were resolved in the past.
Usage Analytics for AD FS
Microsoft Entra Connect Health Usage Analytics analyzes the authentication traffic of your federation servers. You can double-clickThe service page shows application visits from the usage analytics box, to openpast 24 hours, including total visits, total applications, and the usage analytics blade, which shows you several metrics and groupings.top applications by traffic.
To select additional metrics, specifySelect View Usage Details to open a time range, or to change the grouping, right-click on the usage analytics chart and select Edit Chart. Then you can specify the time range, select a different metric,detailed panel and change the grouping. You can view the distribution of the authentication traffic based on different "metrics" and group each metric using relevant "group by" parameters described in the following section:
Metric : Total Requests - Total number of requests processed by AD FS servers.
| |
Metric: Total Failed Request - The total number failed requests processed by the federation service. (This metric is only available on AD FS for Windows Server 2012 R2)
| |
Metric : User Count - Average number of unique users actively authenticating using AD FS
Performance Monitoring for AD FS
Microsoft EntraThe Performance Monitoring section shows token requests per second for federation servers alongside application visit volume from the past 24 hours. Use the charts together to compare federation traffic with the applications generating that traffic. Select View detailed monitoring below either visualization to change the time range and refine the displayed data.
:::image type="content" source="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-performance-and-usage.png" alt-text="Screenshot of Connect Health Performance MonitoringAD FS performance and usage monitoring with callouts for token-request throughput, application visits, and detailed monitoring." lightbox="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-performance-and-usage.png":::
Security reports for AD FS
The Security Reporting section provides monitoring information on metrics. Selectingentry points to bad-password and risky-IP reports. Use the Monitoring box, openssummary cards to review recent activity, and then open a new bladereport for detailed trends, affected users or IP addresses, notification settings, and export actions.
:::image type="content" source="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-security-reports.png" alt-text="Screenshot of Connect Health AD FS security reporting cards with detailed information on the metrics.callouts for bad-password trends and risky IP activity." lightbox="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-security-reports.png":::
By selecting the Filter option at the top of the blade, you can filter by server to see an individual server’s metrics. To change metric, right-click on the monitoring chart under the monitoring blade and select Edit Chart (or select the Edit Chart button). From the new blade that opens up, you can select additional metrics from the drop-down and specify a time range for viewing the performance data.
Top 50 Usersusers with failed Username/Passwordusername/password logins
One of the common reasons for a failed authentication request on an AD FS server is a request with invalid credentials, that is, a wrong username or password. Usually happens to users due to complex passwords, forgotten passwords, or typos.
But there are other reasons that can result in an unexpected number of requests being handled by your AD FS servers, such as: An application that caches user credentials and the credentials expire or a malicious user attempting to sign into an account with a series of well-known passwords. These two examples are valid reasons that could lead to a surge in requests.
Microsoft Entra Connect Health for ADFSAD FS provides a report about the top 50 Usersusers with failed loginsign-in attempts due to invalid usernameusernames or password. Thispasswords. The report is achievedgenerated by processing the audit events generated byfrom all the AD FS servers in the farms.
Within this report you have easy access to the following pieces of information:
- Total
#number of failed requests with a wrongusername/username or password in the last 30daysdays. Average #Daily number of users that failed with a bad username/passwordlogin per day.sign-in.
Clicking this part takes you toOn the mainservice page, select the Bad Password Attempts report. The report blade that provides additional details. This blade includes a graph with trending information to help establish30-day trend chart and a baseline about requests with wrong username or password. Additionally, it providestable of the list of top 50 users with the number of failed attempts during the past week. Notice top 50 users from the past week could help identify bad most bad-password spikes. attempts.
The graph provides the following information:
- The total
#number of failedloginssign-ins due to a badusername/username or passwordon a per-day basis.each day. - The total
#number of unique usersthatwith failedlogins on a per-day basis.sign-ins each day. ClientThe client IP addressoffor the lastrequestrequest.
The report provides the following information:
| Report Item | Description |
|---|---|
| User ID | Shows the user ID that was used. This value is what the user typed, which in some cases is the wrong user ID being used. |
| Failed Attempts | Shows the total |
| Last Failure | Shows the time stamp when the last failure occurred. |
| Last Failure IP | Shows the Client IP address from the latest bad request. If you see more than one IP addresses in this value, it may include forward client IP together with user's last attempt request IP. |
@@ -6,8 +6,8 @@ ms.assetid: dc0e53d8-403e-462a-9543-164eaa7dd8b3 ms.subservice: hybrid-connect ms.tgt_pltfrm: na ms.topic: how-to-ms.date: 05/26/2026-ms.custom: H1Hack27Feb2017, sfi-ga-nochange, sfi-image-nochange, msecd-doc-authoring-1012+ms.date: 09/10/2026+ms.custom: H1Hack27Feb2017, sfi-ga-nochange, msecd-doc-authoring-1012 #customer intent: As an identity administrator, I want to install the Microsoft Entra Connect Health agent on my AD FS and Web Application Proxy servers so that I can monitor my federation infrastructure from the Microsoft Entra admin center. --- @@ -140,9 +140,9 @@ The Usage Analytics feature needs to gather and analyze data, so the Microsoft E >[!IMPORTANT] >This step is required only for primary AD FS servers. -1. Open a PowerShell window and run the following command:+Open a PowerShell window, and then run the following command: - `Set-AdfsProperties -AuditLevel Verbose`+`Set-AdfsProperties -AuditLevel Verbose` The "basic" audit level is enabled by default. For more information, see [AD FS audit enhancement in Windows Server 2016](/windows-server/identity/ad-fs/technical-reference/auditing-enhancements-to-ad-fs-in-windows-server). @@ -228,91 +228,60 @@ The `Role` parameter currently takes the following values: ## Monitor AD FS using Microsoft Entra Connect Health +Open [Microsoft Entra Connect Health](https://aka.ms/aadconnecthealth), select **AD FS services**, and then select a service. The service page provides federation server status, alerts, performance and usage charts, and security reports. -## Alerts for AD FS-The Microsoft Entra Connect Health Alerts section provides you the list of active alerts. Each alert includes relevant information, resolution steps, and links to related documentation.--You can double-click an active or resolved alert, to open a new blade with additional information, steps you can take to resolve the alert, and links to relevant documentation. You can also view historical data on alerts that were resolved in the past.+:::image type="content" source="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-overview.png" alt-text="Screenshot of the Connect Health AD FS service overview with callouts for server details, Quick Start, service properties, and alerts." lightbox="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-overview.png"::: -+## Alerts for AD FS+The **Alerts** page lists active and resolved alerts. Use the time-range control to include older resolved alerts, and use search to filter the list. Select an alert row to open the details panel, which contains alert metadata, affected servers, resolution guidance, related documentation, and a feedback option. ## Usage Analytics for AD FS-Microsoft Entra Connect Health Usage Analytics analyzes the authentication traffic of your federation servers. You can double-click the usage analytics box, to open the usage analytics blade, which shows you several metrics and groupings.+Microsoft Entra Connect Health Usage Analytics analyzes the authentication traffic of your federation servers. The service page shows application visits from the past 24 hours, including total visits, total applications, and the top applications by traffic. > [!NOTE] > To use Usage Analytics with AD FS, you must ensure that AD FS auditing is enabled. For more information, see [Enable Auditing for AD FS](#enable-auditing-for-ad-fs). > > ---To select additional metrics, specify a time range, or to change the grouping, right-click on the usage analytics chart and select Edit Chart. Then you can specify the time range, select a different metric, and change the grouping. You can view the distribution of the authentication traffic based on different "metrics" and group each metric using relevant "group by" parameters described in the following section:--**Metric : Total Requests** - Total number of requests processed by AD FS servers.--|Group By | What the grouping means and why it's useful? |-| --- | --- |-| All | Shows the count of total number of requests processed by all AD FS servers.|-| Application | Groups the total requests based on the targeted relying party. This grouping is useful to understand which application is receiving how much percentage of the total traffic. |-| Server |Groups the total requests based on the server that processed the request. This grouping is useful to understand the load distribution of the total traffic.-| Workplace Join |Groups the total requests based on whether they are coming from devices that are workplace joined (known). This grouping is useful to understand if your resources are accessed using devices that are unknown to the identity infrastructure. |-| Authentication Method | Groups the total requests based on the authentication method used for authentication. This grouping is useful to understand the common authentication method that gets used for authentication. Following are the possible authentication methods <ol> <li>Windows Integrated Authentication (Windows)</li> <li>Forms Based Authentication (Forms)</li> <li>SSO (Single Sign On)</li> <li>X509 Certificate Authentication (Certificate)</li> <br>If the federation servers receive the request with an SSO Cookie, that request is counted as SSO (Single Sign On). In such cases, if the cookie is valid, the user is not asked to provide credentials and gets seamless access to the application. This behavior is common if you have multiple relying parties protected by the federation servers. |-| Network Location | Groups the total requests based on the network location of the user. It can be either intranet or extranet. This grouping is useful to know what percentage of the traffic is coming from the intranet versus extranet. |-+Select **View Usage Details** to open a detailed panel and change the displayed time range. -**Metric: Total Failed Request** - The total number failed requests processed by the federation service. (This metric is only available on AD FS for Windows Server 2012 R2)--|Group By | What the grouping means and why it's useful? |-| --- | --- |-| Error Type | Shows the number of errors based on predefined error types. This grouping is useful to understand the common types of errors. <ul><li>Incorrect Username or Password: Errors due to incorrect username or password.</li> <li>"Extranet Lockout": Failures due to the requests received from a user that was locked out from extranet </li><li> "Expired Password": Failures due to users logging in with an expired password.</li><li>"Disabled Account": Failures due to users logging with a disabled account.</li><li>"Device Authentication": Failures due to users failing to authenticate using Device Authentication.</li><li>"User Certificate Authentication": Failures due to users failing to authenticate because of an invalid certificate.</li><li>"MFA": Failures due to user failing to authenticate using multifactor authentication.</li><li>"Other Credential": "Issuance Authorization": Failures due to authorization failures.</li><li>"Issuance Delegation": Failures due to issuance delegation errors.</li><li>"Token Acceptance": Failures due to ADFS rejecting the token from a third-party Identity Provider.</li><li>"Protocol": Failure due to protocol errors.</li><li>"Unknown": Catch all. Any other failures that do not fit into the defined categories.</li> |-| Server | Groups the errors based on the server. This grouping is useful to understand the error distribution across servers. Uneven distribution could be an indicator of a server in a faulty state. |-| Network Location | Groups the errors based on the network location of the requests (intranet vs extranet). This grouping is useful to understand the type of requests that are failing. |-| Application | Groups the failures based on the targeted application (relying party). This grouping is useful to understand which targeted application is seeing most number of errors. |--**Metric : User Count** - Average number of unique users actively authenticating using AD FS+## Performance Monitoring for AD FS+The **Performance Monitoring** section shows token requests per second for federation servers alongside application visit volume from the past 24 hours. Use the charts together to compare federation traffic with the applications generating that traffic. Select **View detailed monitoring** below either visualization to change the time range and refine the displayed data. -|Group By | What the grouping means and why it's useful? |-| --- | --- |-|All |This metric provides a count of average number of users using the federation service in the selected time slice. The users are not grouped. <br>The average depends on the time slice selected. |-| Application |Groups the average number of users based on the targeted application (relying party). This grouping is useful to understand how many users are using which application. |+:::image type="content" source="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-performance-and-usage.png" alt-text="Screenshot of Connect Health AD FS performance and usage monitoring with callouts for token-request throughput, application visits, and detailed monitoring." lightbox="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-performance-and-usage.png"::: -## Performance Monitoring for AD FS-Microsoft Entra Connect Health Performance Monitoring provides monitoring information on metrics. Selecting the Monitoring box, opens a new blade with detailed information on the metrics.+## Security reports for AD FS -+The **Security Reporting** section provides entry points to bad-password and risky-IP reports. Use the summary cards to review recent activity, and then open a report for detailed trends, affected users or IP addresses, notification settings, and export actions. -By selecting the Filter option at the top of the blade, you can filter by server to see an individual server’s metrics. To change metric, right-click on the monitoring chart under the monitoring blade and select Edit Chart (or select the Edit Chart button). From the new blade that opens up, you can select additional metrics from the drop-down and specify a time range for viewing the performance data.+:::image type="content" source="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-security-reports.png" alt-text="Screenshot of Connect Health AD FS security reporting cards with callouts for bad-password trends and risky IP activity." lightbox="media/how-to-connect-health-adfs/connect-health-active-directory-federation-services-security-reports.png"::: -## Top 50 Users with failed Username/Password logins+### Top 50 users with failed username/password logins One of the common reasons for a failed authentication request on an AD FS server is a request with invalid credentials, that is, a wrong username or password. Usually happens to users due to complex passwords, forgotten passwords, or typos. But there are other reasons that can result in an unexpected number of requests being handled by your AD FS servers, such as: An application that caches user credentials and the credentials expire or a malicious user attempting to sign into an account with a series of well-known passwords. These two examples are valid reasons that could lead to a surge in requests. -Microsoft Entra Connect Health for ADFS provides a report about top 50 Users with failed login attempts due to invalid username or password. This report is achieved by processing the audit events generated by all the AD FS servers in the farms.--+Microsoft Entra Connect Health for AD FS provides a report about the top 50 users with failed sign-in attempts due to invalid usernames or passwords. The report is generated by processing audit events from all AD FS servers in the farm. Within this report you have easy access to the following pieces of information: -* Total # of failed requests with wrong username/password in the last 30 days-* Average # of users that failed with a bad username/password login per day.+* Total number of failed requests with a wrong username or password in the last 30 days.+* Daily number of users that failed with a bad username/password sign-in. -Clicking this part takes you to the main report blade that provides additional details. This blade includes a graph with trending information to help establish a baseline about requests with wrong username or password. Additionally, it provides the list of top 50 users with the number of failed attempts during the past week. Notice top 50 users from the past week could help identify bad password spikes. +On the service page, select the **Bad Password Attempts** report. The report includes a 30-day trend chart and a table of the top 50 users with the most bad-password attempts. The graph provides the following information: -* The total # of failed logins due to a bad username/password on a per-day basis.-* The total # of unique users that failed logins on a per-day basis.-* Client IP address of for last request--+* The total number of failed sign-ins due to a bad username or password each day.+* The total number of unique users with failed sign-ins each day.+* The client IP address for the last request. The report provides the following information: | Report Item | Description | | --- | --- | | User ID |Shows the user ID that was used. This value is what the user typed, which in some cases is the wrong user ID being used. |-| Failed Attempts |Shows the total # of failed attempts for that specific user ID. The table is sorted with the most number of failed attempts in descending order. |+| Failed Attempts |Shows the total number of failed attempts for that specific user ID. The table is sorted by the number of failed attempts in descending order. | | Last Failure |Shows the time stamp when the last failure occurred. | | Last Failure IP |Shows the Client IP address from the latest bad request. If you see more than one IP addresses in this value, it may include forward client IP together with user's last attempt request IP. |