Active Directory Federation Services (AD FS) is Microsoft’s federation platform for single sign-on. It lets users authenticate once and then access other applications through security tokens issued by a trusted identity provider. Instead of every service handling passwords directly, AD FS brokers trust between systems.
In cyber security, AD FS matters because it sits on a high-value trust path. If attackers compromise a federation server or its signing keys, they may be able to issue or abuse tokens, impersonate users, or move into cloud and on-premises services that rely on the same trust relationship. Defenders treat AD FS as Tier 0 infrastructure: harden servers, protect token-signing credentials, monitor authentication and federation logs, and use phishing-resistant MFA for privileged access. In real attacks, AD FS abuse often blends in with normal sign-in traffic, so detecting unusual token issuance or admin changes is critical.