Creating ADFS service principal names (SPNs)

To enable Integrated Windows Authentication (IWA) on ADFS, create service principal names (SPNs) to associate ADFS with a login account. SPNs allow clients to request authentication without having login account names.

About this task

If there are already SPNs for ADFS because IWA is already enabled, skip this procedure.

This procedure assumes that you use a single ADFS server. If you use multiple ADFS servers in a federation server farm, see the Microsoft document Manually Configure a Service Account for a Federation Server Farm.


  1. On the Active Directory domain controller, log in to the Windows domain as the Windows administrator.
  2. Run the following commands to create two SPNs, a fully-qualified name and a short name:
    setspn -s HTTP/<server><domain> <server>$
    setspn -s HTTP/<server> <server>$
    where <server> is the ADFS server, <domain> is the Active Directory domain in which the server is listed, and $ represents the local service account.
    Note: The HTTP/ portion of the SPN is correct even though HTTPS is used to access the service.
  3. Run the following command to verify that the SPNs are properly created:
    setspn -L <server>$


For example, if the ADFS server is adfs01 and the Active Directory domain is, use these commands to create and then verify the SPNs:
setspn -s HTTP/ adfs01$
setspn -s HTTP/adfs01 adfs01$
setspn -L adfs01$
If you use an LDAP browser to view the Active Directory, you see the computer ADFS01. The computer account name is ADFS01$ and the account record shows the new service principal names.