Configuring SAML Token Attributes from Microsoft Entra ID

Jamf Trusted Access Solution Guide for Business
Solution
Application
Content Type
Technical Documentation
Solution Guide
Utilities & Services
ft:locale
en-US

Requirements

You must create an app registration for Jamf Pro in Entra ID.

For information, see the Tutorial: Microsoft Entra SSO integration with Jamf Pro documentation from Microsoft.

  1. In Entra ID, click Microsoft Entra ID.
  2. Navigate to your Jamf Pro SSO enterprise application.
  3. Click the Single sign-on in the left sidebar.
  4. In User Attributes & Claims, click Edit.
  5. Click Add new claim.

    For more information about SAML token claims in Entra ID, see the Customize SAML token claims documentation from Microsoft.

  6. Add new claims that match the account name and account full name values needed for an enrollment customization. Consider the following examples:
    Claim NameValueDescription

    http://schemas.microsoft.com/identity/claims/displayname

    		user.displayname

    This claim value passes a user's first and last name and can be mapped to a user's macOS local account full name.

    Note:This attribute is included by default in SAML tokens sent from Entra ID.
    <AttributeStatement>
  <Attribute Name="http://schemas.microsoft.com/identity/claims/displayname">
    <AttributeValue>Samantha Johnson</AttributeValue>
  </Attribute>
</AttributeStatement>
    usernameuser.givenname and user.surnameThis custom attribute value uses the join() claim transformation to combine two claims into a single value. This claim name can be mapped to a user's macOS local account name.
    <AttributeStatement>
  <Attribute Name="username">
    <AttributeValue>samantha.johnson</AttributeValue>
  </Attribute>
</AttributeStatement>

    NameID

    		emailAddress

    The NameID in this example is formatted as an email address. Jamf Connect will automatically use all characters preceeding the "@" symbol of the email as a macOS local account name.

    Note:This attribute is included by default in SAML tokens sent from Entra ID, but its value may vary by environment.
    <Subject>
  <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">samantha.johnson@yourorganization.com</NameID>
  <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
    <SubjectConfirmationData InResponseTo="ac3669a99a4djj832f59919a9gcifi"
                                 NotOnOrAfter="2020-12-23T18:06:08.719Z"
                                 Recipient="https://trial.jamfcloud.com/saml/SSO" />
  </SubjectConfirmation>
</Subject>
  7. Click Save.

Your SAML tokens now include the required values to configure the Account Name and Account Full Name fields of an enrollment customization in Jamf Pro.

For confirmation, use a SAML decoder to examine the contents of a SAML token for user claims.