Thank you for the replies. I'm still a bit shaky on the actual requirements for AD FS with respect to on-premise. I understand you need an identity source to authenticate to D365. AAD can be one of those sources if you are authenticating to D365 cloud. In reviewing the D365 F+O documentation it also mentions Active Directory trusts are supported, which seems to imply that AD FS wouldn't be required as you could use local authentication instead?
The only context AD FS against on-premise D365 F+O makes sense is the following scenario:
-Users are provisioned/synced to AAD and can authenticate to D365 cloud natively without AD FS (Meaning the user navigates here - https://home.dynamics.com. AKA an office.com application)
-Inside of the AAD tenant, a published Azure application is created targeting the AD FS server via SAML logon/reply URLs. Whatever users/group you apply against the Azure published application has access
Based on above, an AAD user can authenticate with the same credential to D365 cloud or on-prem via two distinct application URLs (Office.com or XXXADFSXXX URL). Do I have this right???
Perhaps I am reading too far into the details or assembling the puzzle pieces in the incorrect order here. I'm simply not seeing this AD FS requirement accurately depicted in the D365 F+O on-prem requirements.
