Prepare federation certificate names before a Work Folders lab becomes production

Source facts

Microsoft’s Work Folders walkthrough starts by preparing AD FS before the later proxy and client stages. The walkthrough distinguishes its self-signed test certificate from the publicly trusted certificate recommended for production. Its certificate example includes names for the federation service, enterprise registration, and federation server. Microsoft documentation.

Applicability

Use this review when planning the federation endpoint for the documented Work Folders design. Identify the real service names and certificate authority. Check the procedure’s release-specific limits before adapting any historical lab instruction.

DSE recommendation

Create a certificate-name worksheet before requesting issuance. Have the federation and certificate owners confirm which names the planned service requires and who will maintain the certificate. Keep lab identities and trust decisions visibly separate from the production request. Allow time for issuance and validation, and avoid copying sample hostnames into the deployment record.

Verification

Inspect the issued certificate against the approved name worksheet and trust arrangement. Verify the intended federation endpoint through an authorized test before moving to later Work Folders stages. Record the certificate identity, responsible owner, and any name mismatch. Resolve the mismatch through the approved certificate process before publishing the service to clients.

Official references

Microsoft Learn: Deploy Work Folders with AD FS and Web Application Proxy – Step 1, Set Up AD FS. Source reviewed September 8, 2026.