After you have determined the authentication method you want users to use and prepared the Company Portal app for distribution, you must deploy a configuration profile to your target computers to enable Platform Single Sign-on (Platform SSO) with Microsoft Entra ID.
Best Practice:
Using Platform SSO for Device Compliance Registration
If a device compliance integration is enabled in Jamf Pro, Platform SSO can be used to significantly streamline the device compliance registration process for end users. To do so, ensure the following conditions are met before proceeding with the steps in this workflow:
The Company Portal app must be deployed to target computers.
Target computers must be members of the Applicable group in the Device Compliance settings in Jamf Pro.
This will automatically register computers for device compliance after an end user registers with Entra ID Platform SSO.
Important:
If you intend to use Simplified Setup with Platform SSO with Microsoft for Entra ID, consider the following:
You must also add an Associated Domain payload to this profile. The payload does not need to be configured in any way, but must be present for Simplified Setup for Platform SSO to function properly.
You must enable the Enable registration during setup and Create first user during setup settings in this profile to activate Platform SSO during Setup Assistant.
You can also include the New user creation authentication method setting to determine the authentication method for new user creation. If this setting is not enabled, the system will use Password and Smart Card authentication by default.
Device compliance registration during Setup Assistant requires Jamf Pro 11.26.0 or later and a version of Microsoft Company Portal that supports Simplified Setup during enrollment. Verify support status with your identity provider to ensure full feature availability.
In Jamf Pro, click Computers in the sidebar.
Click Configuration profiles in the sidebar.
Click New .
Click the Single Sign-on extensions payload.
Click Add.
Under Payload type, select the SSO option.
In the Extension Identifier field, enter the following value:
com.microsoft.CompanyPortalMac.ssoextension
In the Team Identifier field, enter the following value:
UBF8T346G9
Under Sign-on Type, select the Redirect option.
Under URLs, enter the URLs that macOS should trigger a redirect to the Company Portal app for authentication. These should include the following:
Country specific URLs (for example, those ending in .cn and .us) are used to authenticate to national cloud instances and may be omitted if desired. For more information on national cloud instances, see National clouds from Microsoft.
Use the toggle to include the Use Platform SSO setting.
(Optional) Use the toggle to include the Shared Device Keys setting.
(Optional) Use the toggle to include the Create New User at Login setting.
Enabling this option allows any user with valid credentials on your Entra ID domain to create a new user account on their computer. A local macOS UNIX user account will be created with the user's Entra ID password. Users restricted to "passwordless" authentication in Entra ID cannot use this method.
(Optional) Use the toggle to include the Identity Provider Authorization setting.
Enabling this option allows the use of Entra ID credentials for events that require authorization prompts (e.g., use of the sudo command, unlocking certain preferences in System Settings, and installation of software). The user must also have administrator rights to complete authorization.
Use the toggle to include the Account Display Name setting.
This value will be used in notification that macOS uses as part of the registration process. Use a value that will be clear to end users what credentials are required (example: ACME Entra ID).
Use the toggle to include the User Mapping setting, and then enter claims in the Full Name and Account Name fields.
Note:
Avoid entering claims that pull special characters, such the @ symbol in an email address, that are not valid for macOS logins using Platform SSO. For the Account Name field, Jamf recommends com.apple.PlatformSSO.AccountShortName.
For a complete list of claims, see the Payload claims section in Microsoft's documentation.
(Optional) Use the toggle to include the Account Authorization Type setting, then use the pop-up menu to select either Standard or Admin.
This setting determines what privilege set is granted upon a successful authentication to Entra ID. For example, if you want users to be able to use their Entra ID credentials to install printers, you would need to select Admin.
Note:
The Groups option is not supported by Microsoft Entra ID at this time.
When configured, this setting will grant the specified privilege set to users each time the Platform SSO configuration profile is deployed or updated. If your organization is also using other privilege management solutions (e.g., privilege elevation with Jamf Connect), Jamf recommends leaving these settings unconfigured to avoid unexpected behaviors or conflicts between deployed settings.
(Optional) Use the toggle to include the New User Account Type setting, then use the pop-up menu to select either Standard or Admin.
Note:
The Groups option is not supported by Microsoft Entra ID at this time.
Use the toggle to include the Authentication when screen is locked setting, then select Do not handle.
(Optional) Use the toggle to include the Custom Configuration setting, then upload a PLIST file to allow required domains and to enable custom settings.
If you use Self Service, add the following domains to the AppPrefixAllowList key:
com.jamf.selfserviceplus must be added to the AppPrefixAllowList key or password sync will fail.
Add custom settings.
Microsoft Entra ID supports several additional configuration settings can be configured for Platform SSO via a custom PLIST file. The following example configuration profile contains settings to use Platform SSO for all apps created by Microsoft, all apps created by Apple, the Jamf Trust application, and Jamf Self Service for macOS:
Click the Scope tab and configure the scope to target your test environment.
The configuration profile is deployed immediately to computers in the scope. After the command processes, macOS displays a notification to end users prompting them to register with Microsoft Entra ID to enable Platform SSO, which then creates a shell record in Entra ID.