Creating an Application Registration to Call a Custom Scope

Jamf Connect Documentation
Solution
Application
Jamf Connect
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

With an existing application registration that exposes a custom API, an additional application registration can call that custom scope for use in a Conditional Access policy.

Requirements

  • Access to your organization's Microsoft Entra ID admin console.

  • An existing Entra ID application registration with a custom API.

  1. Log in your organization's Microsoft Entra admin center.
  2. Click Entra ID > App Registrations.
  3. Create a new app registration.

    Name this application Jamf Connect - OIDC Endpoint.

  4. Select Accounts in this organizational directory only under Supported account types.
  5. Select Public client/native (mobile & desktop) under Redirect URI.
  6. Enter https://127.0.0.1/jamfconnect in the Redirect URI field.
  7. Click Register.
  8. In the sidebar, click Authentication.
  9. Enable Allow public client flows.

    This feature enables Resource Owner Password Grant (ROPG) to validate passwords.

  10. In the sidebar, click API permissions.
  11. Click Grant admin consent for [domain] to read user information on behalf of the user.
  12. Click + Add a permission.
  13. Select the My APIs tab and click Jamf Connect - Conditional Access Policy API.
  14. Click Delegated permissions.
  15. Select the checkbox for jamfconnect.
  16. Click Add permissions.
  17. Click Grant admin consent for [domain] to grant permission to access the API on behalf of users.
  18. (Optional) Under App roles, add a role for Administrator and Standard.

    These roles allow you to define which users or groups should have administrator rights. See Login Window Settings for more information.

  19. Click Overview.
  20. Copy the Application (client) ID and the Directory (tenant) ID for later use in your Jamf Connect configuration.
  21. Click Entra ID > Enterprise Applications.
  22. Select the Jamf Connect - OIDC Endpoint application.
  23. Assign users and roles to the application.

The application can now call the custom scope and be targeted by Conditional Access policies for Jamf Connect.