title: Verify ADFS federation with Azure AD
body: <p>In relation to this question:
  <a href="https://stackoverflow.com/questions/47333314/azure-ad-graph-api-using-on-premise-domain/47342535">Azure AD graph API using on-premise domain</a></p>
  
  <p>I have set up an federation between the on premise ADFS and Azure AD using the Azure AD connect tool. In the last step of the verification I ran into this:</p>
  
  <p><img src="https://i.imgur.com/U0ETwoy.jpg" alt="Imgur"></p>
  
  <p>I believe that it is because the ADFS needs to somehow be exposed to the internet. Probably using an proxy server. In the Azure portal the Domain is now marked as federated. I have tried to do a post to <a href="https://login.microsoftonline.com/" rel="nofollow noreferrer">https://login.microsoftonline.com/</a>{domain}/oauth2/token, it works when I use xx.onmicrosoft.com users created directly an the Azure AD domain. When I use a user@{domain} user syncronized from the on premise AD I still get </p>
  
  <p>""error": "invalid_grant",
      "error_description": "AADSTS70002: Error validating credentials. AADSTS50126: Invalid username or password....." like I did before I set up the federation. I would actually expect to be somehow redirected to the on premise login screen</p>
  
  <p>So two questions:</p>
  
  <ol>
  <li><p>Is it nessesary to have the ADFS exposed to the internet via a proxy for the federation not to fail?</p></li>
  <li><p>How can I properly test logging in to Azure AD using the on premise user?</p></li>
  </ol>
  
  <p>Thanks in advance :)</p>
  
  <p>-Dan</p>