How to enable Active Directory Federation Services auditing

Most organizations have users that need to use on-premises applications as well as third-party cloud applications. ADFS makes this easier by integrating the authentication process between Active Directory and the various applications. With ADFS, users only need to sign in once with their Active Directory credentials to be signed in on to all the other applications, for a specific period of time. This also means if a malicious user gets hold of just a single set of credentials, it puts the whole network and the third-party applications at risk. Therefore ADFS has to be constantly and thoroughly audited. Using native AD tools, this task becomes complicated as an admin will have to go through numerous logs to find any entry that might be a cause for concern.

ADAdudit Plus, on the other hand, can make this task a lot easier. It is a real-time Active Directory auditing and reporting tool that has a special section for ADFS auditing. It audits the ADFS logons, extranet lockouts, and so on. It also alerts the admins in real time if it detects anything suspicious.

Here is a comparison of the auditing process using native AD tools and ADAudit Plus. Enabling Audit Policy is the first step in the process and is common to both methods.