Hello ITPro. I ran across a question that discusses deploying AD FS for "device registration" and which functional level of the AD DS Forest is required. It appears that AD FS is supported all the way back to a forest functional level of 2003, but if you want to use certificate authentication you have to upgrade to 2008R2. For "Device Registration" it appears the minimum is 2012 R2.
That is all well and good, but I also ran across this article:
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-requirements#BKMK_4
It states the following:
"Schema requirements
New installations of AD FS 2016 require the Active Directory 2016 schema (minimum version 85).
Raising the AD FS farm behavior level (FBL) to the 2016 level requires the Active Directory 2016 schema (minimum version 85)."
I even went as far as to deploy a new domain in the lab using a functional level of 2008R2.. AD FS installed just fine using 2016 servers. It didn't support Device Registration, but my guess is that if I upgraded the forest to 2012 R2 it would have worked.
So that leaves the question, what is an AD FS 2016 installation and how does it differ from what I deployed in the lab? I just installed the role using the standard install-windowsfeature command and ran through the post setup process with a self signed certificate. I never got an error stating that a forest functional level of 2016 was required before installing or configuring.
Regards,
Adam Tyler