I am currently looking for some best practices installing a SharePoint 2013 farm (two WFEs, one App Server, one OWA, two SQL Server in failover cluster) in a DMZ.

Both farms (internal and the one in the DMZ) shall be completely seperate from each other with one exception: Internal users should access both farms with the same user account.

Am I right that I only need to install an ADFS proxy in the DMZ Or do I need more to achieve this?

2 Answers 2


DMZ is poor placement practice for a SharePoint farm. The reason is in a typical deployment you need to authenticate to Active Directory which is most often kept internal. This means there are numerous ports you must open to each DC within the internal network.

The best practice would be to use a pre-auth reverse proxy, such as WAP + ADFS. WAP is the only service that needs to reside in the DMZ.

  • Good point. Would you recommend in my case to implement additionally an "external domain" in the DMZ so all external users are stored there? Internal users are further stored in the internal AD.
    – airliner
    Feb 26, 2019 at 6:52
  • No. The issue isn't external vs. internal, the issue is that you need to open up numerous ports on the backchannel firewall due to the ports required for the SharePoint servers to be domain members. Instead, just put all SharePoint servers on the internal network.
    – user6024
    Feb 26, 2019 at 16:09

You should also consider using Azure AD Application Proxy instead of the OnPrem ADFS + WebApplicationProxy combination.

AAD-Proxy completely eliminates the need of any inbound ports. It also enables Kerberos-Authentication, which does not bring the bunch of drawbacks that come with ADFS&WAP&SAML.

  • 1
    Unfortunately AAD isn't applicable in this scenario (I tried to get them to Office 365, but no). We're working in a quite picky environment with some special requirements regarding storage and accessability by law.
    – airliner
    Feb 26, 2019 at 6:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.