EIDFED-009: AD FS Server Configuration Assessment
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Federation & Hybrid Identity
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Active Directory Federation Services (AD FS) servers handle authentication for federated domains and process security-sensitive SAML tokens. Misconfigured AD FS settings such as weak token signing algorithms, disabled audit logging, overly permissive extranet access, or outdated claim rules can be exploited for token forgery, credential harvesting, or unauthorized access. The AD FS configuration should be regularly assessed against Microsoft security baselines and hardening guides.
Valor recomendado
AD FS servers configured per Microsoft security baseline with SHA-256 signing, comprehensive audit logging, and current Windows Server patches
Remediación
Review the AD FS server configuration including token signing algorithm (should be SHA-256), audit log settings (should capture success and failure events), extranet access policies, and claim rule complexity. Ensure AD FS servers are running the latest Windows Server patches and that the AD FS farm is configured with redundant servers. Validate that the AD FS service account follows least-privilege principles and that the token signing certificate private key is properly protected.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, IA-8(4)