Conquering BYOD with Implementing ConfigMgr 2012 R2 and Windows Intune,“ADFS”, “WAP”, “Workplace Join” and “Work Folders”. Part I

January 9, 2014 at 3:55 pm in ADFS, ADFS 2.1, ADFS 3.0, BYOD, WAP, Work Folders, Workplace Join by Kenny Buntinx [MVP]


In the next few posts, I wanted to take a look at the changes to be found in Windows Server 2012 R2 with respect to Active Directory Federation Services (AD FS) that is used for mainly Product and features such as “Windows Intune” , “Workplace Join” and “Work Folders” Introduced in windows 8.1 .

Through the new Workplace Join feature within R2, AD FS becomes a focal point for mobile access in the enterprise and an integral component in the Microsoft Bring Your Own Device (BYOD) vision. Workplace Join allows unmanaged/untrusted operating systems such as Windows RT/Windows 8.1 and IOS to be moved into a more controlled access context, by allowing their registration and affiliation with Active Directory.

Workplace Join is made possible by the Device Registration Service (DRS) that is included with the Active Directory Federation Role in Windows Server 2012 R2. When a device is Workplace Joined, the DRS provisions a device object in Active Directory and sets a certificate on the consumer device that is used to represent the device identity. The DRS is meant to be both internal and external facing. Companies that deploy both DRS and the Web Application Proxy will be able to Workplace Join devices from any internet connected location. To further secure this process, additional factors can be also used with Windows Azure Active Authentication (Phone Factor).

Work Folders is a brand new direction for enabling access to data in offline scenarios, along the lines of Dropbox and Skydrive Pro, but without the web and sharing features. Like most Microsoft OS features, Work Folders is tied to a specific release of Windows; however according to this Channel 9 video, Microsoft will release Work Folders for Windows 7, iOS and “other devices“ soon.

For all that technology to make it work, you will need to implement ADFS 3.0 which is only available in Windows Server 2012 R2 . The current levels of AFDS are difficult to find, so I will list them once more :

  • ADFS 2.0 – Windows 2003/2008/2008R2 (supported only for SSO in Windows Intune)
  • ADFS 2.1 – Windows 2012 (supported only for SSO in Windows Intune)
  • ADFS 3.0 – Windows 2012 R2 (supports SSO in Windows Intune , Workplace Join and Work Folders)

To be able to support ADFS 3.0, we will need some prerequisites that I will list below:

  • Forest Functional Level = min 2003 or higher

To check the ForestLevel –> Get-ADObject -Identity "cn=Schema,cn=Configuration,dc=vnextdemo,dc=be" -Properties * | Select objectVersion

  • Domain Controller OS = Min 2012 or higher

· If no DC 2012R2 then upgrade schema with Adprep. New Device class requires a schema change to Active Directory. For those upgrading an existing Windows setup, the appropriate files can be found on the R2 installation CD under D:\Support\ADPrep.

· If upgrading to 2012R2 for DC :

            • Execute following command PS C:\> netdom query FSMO
            • Then use the Move-ADDirectoryServerOperationMasterRole cmdlets to move them.  You can do this with a simple one liner! Move-ADDirectoryServerOperationMasterRole -identity "DC01" -OperationMasterRole 0,1,2,3,4


  • ADFS 3.0 and Web Application Proxy requires to be installed on Windows server 2012 R2 


In the next blog post , I will continue on how to setup the ADFS 3.0 to support “Windows Intune” , “Workplace Join” and “Work Folders”. So stay tuned for Part II


Hope it Helps ,

Kenny Buntinx

Enterprise Client Management MVP

Tweet about this on TwitterShare on FacebookShare on Google+Share on LinkedInPin on Pinterest