Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues when the number of external users reach over 20,000 or 50,000?

Is it a bad idea to create a separate domain and authenticate external users against AD and build an SSO using ADFS; or it makes sense to use third party identity management and SSO solution like auth0, Okta, CA?

What benefit I would get if I rely on these commercial third party solutions?

1 Answer 1


The only reasons to create a separate AD domain is to have a different password policy, to segment replication.

You can minimize risk of a compromised DC only by having a new forest. Any domain in a forest can result in compromised Enterprise Admin credentials.

The ADFS server must be trusted by both domains, so a Domain trust or a forest trust is needed. If you don't do this, then home realm discovery will become difficult.

If you intend to use MSFT online, Azure AD for synchronization, multiple domains and forests are supported but it's more complicated. Just know that when you provision in one location (US) it doesn't allow you to share the same namespace in the UK. (e.g. [email protected] is country specific). This is a temporary limitation that will be corrected soon.

ADFS vs Ping vs Auth0? Well who are you integrating with? What are your in-house skills? do those providers have the PII protections you require?

Yes, AD can scale to over a million of objects (the US Army/Navy has a massive AD forest). This info is from 2007 so I'm sure it's much higher now.

Question for you - what do you have resources for: one perfectly robust AD infrastructure, or two infrastructures? (e.g. isolate the outages/load)

  • If you choose for an existing or a new AD forest, it may become difficult to let users login with their external emailaddress. That means, the external users will have to remember a new username. In my opinion, that is a big reason to choose another option.
    – Michael
    Commented Feb 19, 2015 at 7:36
  • Well. we are not doing ADFS to let the external users login with their own domain account. And we made the decision that it is ok they have a new password to use our portal.
    – Goli E
    Commented Feb 19, 2015 at 17:33
  • in terms of inhouse skills, I am worried that setting up an AD forest and writing a SSO module from scratch will end up being more expensive and less secure than using a third party like Ping. We have some skilled developers but they have never implemented a SSO.
    – Goli E
    Commented Feb 19, 2015 at 17:34
  • @Michael pretty sure UPN aliases will permit the email address style login. You could use PW sync between forests to accomodate that scenario. (not that it's the best) Commented Feb 19, 2015 at 18:01
  • @GoliE SSO on the webserver is needed no matter which vendor you choose. If you're looking at windows development/ASP then look at Windows Identity Foundation and asp.net lots of easy samples there. Heck, just right click your Visual Studio project and hit, ADD STS, and you're almost done. Commented Feb 19, 2015 at 18:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .