← All talks

Federation Explained: ADFS, Entra ID, and User Login Flow #shorts

BSides Frankfurt1:1771 viewsPublished 2026-03Watch on YouTube ↗
About this talk
Understanding federated app access: User requests access, redirected through Entra ID/Azure AD, to ADFS, then Active Directory. Verified credentials are signed by ADFS, granting an app-specific token from Entra ID. Finally, access is granted. #FederatedApp #EntraID #ADFS #ActiveDirectory #Cybersecurity
Show transcript [en]

We have the first one which is federation. Usually it's federation with ADFS, but it can be like there's many other solutions that you can use as well. And it works something like this. So, the user goes to a federated app and says that I want access. And it says that no, you need to go to Azure Active Directory, which I guess is called Entra ID nowadays. They change names for things all the time. And I guess while it still says Azure AD in documentations and some like XE X files and stuff are named that still I'm still also going to mix it up if they can't keep the one name. But anyways, um yes, they need to go to Entra ID. And

Entra ID says that no, you need to go to ADFS. So, you go to ADFS and ADFS checks with Active Directory. And if the credential is valid, then the ADFS server will sign it with their secret. And then you have that secret which is well like you have the package which is signed. So, you can go to ADFS to uh sorry, to Entra ID with that thing from ADFS. And they will give you then an application specific token, which you can then present finally to the federated app. And finally, you're in. So, that's the flow.