Verify both sides of a Work Folders proxy publication

Source facts

The documented setup installs the AD FS and Work Folders certificates in the proxy computer’s local certificate store. Publication selects an external URL, certificate, and backend URL. The wizard initially sets the backend URL equal to the external one. Microsoft calls for a separate published Work Folders application for each Work Folders server. Microsoft documentation.

Applicability

Use this review at the proxy-publication stage of the documented federation design. Identify the actual external name, backend server, certificate, and relying-party configuration. Check the current supported procedure before adapting the lab example.

DSE recommendation

Prepare a publication map showing each external endpoint and its intended backend. Have the proxy and file-service owners confirm the mapping and certificate selection. Inspect the wizard’s default backend value rather than accepting it automatically. Record the access policy and the person who will accept external client behavior before publishing.

Verification

Test an approved client connection through the external endpoint and verify which backend handles it. Compare the observed certificate and target with the publication map. For multiple servers, test each published application separately. Retain failures and mismatches as open findings before making the endpoint available to the wider client population.

Official references

Microsoft Learn: Deploy Work Folders with AD FS and Web Application Proxy – Step 4, Set Up Web Application Proxy. Source reviewed September 8, 2026.