I have created a AWS Managed Microsoft AD, and I have a Windows Server 2019 EC2 instance where I am trying to enable AD FS. I have joined the EC2 instance to the domain, installed AD tools, and am able to perform basic AD tasks using the default AD Admin user. So far so good.
However when I try to configure AD FS, I get stuck with this error
"The credential provided is not a domain administrator. Provide a credential that is a member of the Domain Admins group and try again."
To perform operational management of your directory, AWS has exclusive control of accounts with Enterprise Administrator and Domain Administrator privileges. This includes exclusive control of the AD administrator account.
So..... how could I possibly enable AD FS unless I had access to the AD administrator account?
You can't.
When you install ADFS it searches for available DC and writes a number of entries to AD.
To do this, it needs domain admin.
You don't need domain admin. to run ADFS. It can use a service account.