Activation profiles with linked identity providers are listed in in Jamf Security Cloud.
The Identity-based provisioning tab provides an overview of all identity provider connections in your portals and all their associated activation profiles, specifically:
It displays all linked Azure tenants, Okta Orgs, or Google Workspaces as configured in Identity Providers configuration and activation profiles that use them to authenticate users.
The third column contains Azure group IDs, Okta group names, or Google group email addresses when there are multiple activation profiles using the same tenant.
- The Use switch in the first column specifies whether an Activation Profile should be used for the "Sign in with ..." enrollment method.Note:
You can still use activation profiles not enabled for this function for enrollment when you set up a managed app configuration in your UEM solution.
- Enabling Identity-Based Provisioning
- If you have selected Microsoft Azure, Okta, or Google as your identity provider, toggle the Use switch on to activate single sign-on for an activation profile.
- Fine-Tuning the Configuration via Identity Provider Groups
- Selecting one activation profile as a default for "Sign in with ..." is sufficient for smaller configurations.
There are more complex scenarios, such as:
Several activation profiles sharing the same Azure tenant, Okta Org, or Google Workspace
More Jamf Security Cloud portals sharing the same Azure tenant, Okta Org, or Google Workspace
In such cases, you can indicate the most suitable activation profile to be fine-tuned based on the identity provider groups that the user signing in is a member of, or by the device's supported platforms. This information is made available by the identity provider when the user signs in.
You can also specify identity provider user groups for each activation profile, which is taken into account during the sign-in process. If an activation profile has an assigned group which the signing in user is a member of and the user's device has a platform that the activation profile supports, then that profile is selected.Note:For Azure you must specify Azure group IDs in Jamf Security Cloud. For Okta and Google, group names are supported.
Example:Assume three activation profiles, all configured to allow activation when a user logs in with their Azure credentials, are displayed in the following order in the list of profiles:
An activation profile not supported for user's device platform: This does not support the platform of the user's device.
Proxy with private access: This profile is bound to users with a specific Azure group ID. This is a 36 character string beginning with
a28d.Private access production: This profile is not locked to any specific Azure group.
Two things happen here:
The supported platforms take precedence and the first activation profile is not taken into account.
The group membership takes precedence.
The order of activation profiles is taken into account; that is, the first one with the mentioned user's group will be used for enrollment.
You can click Edit to add or remove Azure groups to or from an activation profile.
When configuring a profile, you will be notified of any potential conflicts with other profiles.