In case I want to set up authentication with two domains.

I would install 2 ADFS server (1 on each domain), configure SharePoint to enable authentication.

But, does my sharepoint server needs to be domain-joined ? If yes, to which one ?

My two domains will be for internal users (already existing) and external customers (the one I'm gonna create).

1 Answer 1


You do not need to add the SP servers to domain of external customers AD. You can configure ADFS to use claims between SP and the external customers AD.


  • Thanks for answer, according to what you said here, the SP Server could be joined to internal domain ? and both internal/external users will be able to connect to SharePoint as long as I have 2 ADFS Servers in my two domains
    – Nico
    Commented Feb 3, 2015 at 12:55
  • 1
    You will add SP servers to internal domain and configure ADFS for external domain.
    – luccio
    Commented Feb 3, 2015 at 12:57
  • Thanksyou really much for answering me @Luccio ! So, to describe in one word : SP Servers in internal Domain + ADFS in External Domain is enough to allow external users to loggin in SP Site ? Or should I add ADFS in internal domain too ? I must admit, that I don't really understand 100% what are ADFS Roles (except landing on authentication page that gives you a token that is passed to an application)
    – Nico
    Commented Feb 3, 2015 at 13:08
  • 1
    IMHO you will need 2 ADFS and exchange certificates to trust each other. See saml-token base authentication: zoom.it/pPoz#full also please check this article where is the configuration of both adfs explained blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=109
    – luccio
    Commented Feb 3, 2015 at 13:48
  • Ok, I've already bookmarked this link from helloitsliam. But now, with your help, I'm able to understand it better ! Thank you ! If you can confirm me a last thing : adfs servers must me domain joined ... right ? May be a idiot question, but can find any info on this. And the real last question : any advices about implementing this between DMZ and LAN ? I mean : internal AD/ADFS located in LAN, and both external AD/ADFS/SP server(that hosts portal site) in DMZ ? or should I just let SP/ADFS on DMZ and open ports in firewall ?
    – Nico
    Commented Feb 3, 2015 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.