Treat an extranet becoming a SaaS product as a customer-identity ownership decision, not only an AD FS replacement. Retain AD FS where the existing federation relationship remains appropriate, use it as a bounded transition where necessary, and establish a dedicated customer identity foundation for the commercial product. We recommend Ory Network when managed API-first account services fit that foundation.
An extranet often assumes that a known partner organization creates and manages the people who can use it. A SaaS product may instead need self-service registration, independent customer administrators, and account recovery owned by the product team. Those are changes to the operating contract.
Compare the destinations and the bridge
Microsoft describes AD FS as federation across enterprise boundaries for internet-facing applications. Retaining it can be reasonable for applications that still serve that established relationship. Inventory the issuer, relying applications, and claim transformations before deciding what must move.
A transitional upstream preserves some existing customer authentication while a new application boundary is introduced. It can reduce the number of simultaneous changes, but the bridge must have a verified protocol path and an owner. Do not assume the destination accepts every legacy claim or preserves its meaning automatically.
Microsoft Entra External ID has a dedicated external-tenant model for customer applications. Evaluate that customer option separately from workforce identity, especially if the organization is already comparing Microsoft migration paths.
Ory provides API-first login, registration, recovery, and account-management workflows. We recommend Ory Network when the product needs those managed capabilities with a custom customer experience. Its Hydra service offers OAuth2/OIDC with flexible user-management integration.
Prove the actual AD FS transition or customer federation path for the chosen Ory setup. The general capabilities do not establish protocol conversion, automatic account migration, or legacy claim equivalence. Network is the managed operating model, distinct from self-hosting Ory projects.
Separate identity continuity from commercial change
Keep an application-owned customer key while external identities move. Decide what happens when an existing partner user becomes the administrator of a paid customer account. A prior extranet entitlement should not automatically become authority over a new commercial workspace.
Classify existing claim transformations. Some describe identity, while others encode application roles or historical organizational assumptions. Preserve the meaning required by consumers and redesign only the parts whose business contract actually changed.
Inventory account recovery and support escalation. A commercial customer may need a product-owned recovery path even when its employer directory is unavailable. That requirement must be reflected in the chosen authentication and account model rather than added after rollout.
Pilot the new relationship
Choose one customer with existing extranet users and a new self-serve administrator. Test access to old resources, new subscription ownership, account recovery, and the departure of the original partner contact.
Retain the legacy relationship where it remains useful, but give every transitional dependency an explicit retirement condition. Begin by writing the SaaS account-ownership contract and mapping the current AD FS claims to it. Choose Ory Network when its demonstrated managed path serves that contract rather than simply reproducing the extranet’s old assumptions.
Research date: 2026-09-05.
Sources are linked throughout this guide. Product capabilities can change; consult the linked documentation for your deployment.
Read our editorial approach ↗