Jamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors

Every local Jamf Pro admin account is another password to protect and to remember to disable. SAML single sign-on hands that job to Microsoft Entra ID, so MFA and Conditional Access apply to Jamf Pro admins and, optionally, to Self Service users. In this post I'll configure both sides, keep a safe way back in, and fix the AADSTS errors you're most likely to meet.

How it works#

Jamf Pro is the SAML service provider and Entra ID is the identity provider. The gallery app supports SP-initiated sign-in (browse to Jamf Pro and get redirected) and IdP-initiated sign-in (the Jamf Pro tile in My Apps). When the SAML assertion arrives, Jamf Pro looks for a Jamf Pro user account that matches the user; if none matches, it tries to match one of the user's groups to a Jamf Pro group.

That gives you the first troubleshooting rule: an AADSTS code means Entra ID refused to issue the assertion; a successful Entra sign-in followed by a Jamf Pro refusal is a mapping problem. Also note that provisioning users into Jamf Pro is manual, and that Jamf warns enabling SSO stops sign-in with standard and directory credentials, so plan failover access first.

Prerequisites#

• An Entra account with the Cloud Application Administrator or Application Administrator role, or ownership of the app.
• A Jamf Pro admin account that can edit Single Sign-On settings.
• Jamf Pro standard accounts or groups that will match your Entra users or groups.
• A break-glass plan: Jamf requires accounts that use the failover URL while SSO is enabled to have Read and Update privileges for SSO Settings.

Step 1: Add Jamf Pro from the Entra gallery#

1. In the Microsoft Entra admin center, go to Entra ID › Enterprise apps › New application, search for Jamf Pro and add it.
2. Open Single sign-on, choose SAML and edit Basic SAML Configuration:

These are patterns: copy the real Entity ID from Jamf Pro (Step 3) and build the other two from the same host name, exactly as Jamf Pro shows it.

3. Under Attributes & Claims, check the Unique User Identifier (Name ID): usually the UPN, which must equal the email address on the Jamf Pro account. To map groups, add a group claim.
4. In SAML Signing Certificate, copy the App Federation Metadata Url.

Step 2: Assign users and protect the app#

• Under Users and groups, assign the admin groups and, if Self Service will use SSO, the end-user groups.
• In Properties, keep Assignment required? set to Yes so only assigned users receive a token. This setting is behind AADSTS50105.
• Target the app with a Conditional Access policy that requires MFA, starting in report-only mode.

Step 3: Configure Single Sign-On in Jamf Pro#

1. In Jamf Pro, open Settings, select Single Sign-On (System section) and click Edit.
2. Select Enable SSO Authentication (Enable Single Sign-On Authentication in older versions). Where Jamf Pro offers the choice, select SAML authentication so admins and end users both sign in through Entra ID, then pick Entra ID's entry in the Identity Provider menu (Microsoft's tutorial shows it as Azure).
3. Copy the Entity ID into the Entra Identifier field.
4. Set Identity Provider Metadata Source to Metadata URL and paste the App Federation Metadata URL.
5. Leave Token Expiration Time Override disabled: Jamf describes it as an Okta option and warns that enabling it can cause login errors.
6. Under User Mapping, keep NameID for Identity Provider User Mapping and choose Email (or Username, whichever matches the NameID value) for Jamf Pro User Mapping. For groups, set Identity Provider Group Attribute Name to http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.
7. Under Single Sign-On Options for Jamf Pro, decide on Allow users to bypass the Single Sign-On authentication. With it on, users who browse straight to Jamf Pro get the local sign-in page instead of a redirect: handy during rollout, but it keeps password sign-in open, so consider turning it off once SSO is proven.
8. Copy the failover login URL, store it with your break-glass documentation, then Save.

Step 4: Self Service and enrollment#

The same Single Sign-On Options for Jamf Pro section controls the end-user services. Enable Single Sign-On for Self Service for macOS sends Self Service sign-ins to Entra ID and switches the login type under Settings › Self Service › macOS to Single Sign-On; Self Service+ uses the same settings. Enable Single Sign-On for User Authentication during Enrollment covers user-initiated and account-driven enrollment, for any identity provider user or only one group. Self Service users don't need Jamf Pro console accounts, but while Assignment required? is Yes they must be assigned to the enterprise app.

Verify#

1. From the enterprise app's Single sign-on page, run Test this application as a pilot admin, then try the My Apps tile. Test with an account that isn't a Global Administrator: Microsoft notes the assignment requirement doesn't apply to that role, so it can hide AADSTS50105.
2. In Monitoring & health › Sign-in logs, filter on the Jamf Pro app: status Success, MFA satisfied, expected policies on the Conditional Access tab.
3. In Jamf Pro, confirm users (and group-mapped users) land with the right privilege set.
4. Open the failover URL in a private window and confirm a local account can still sign in.

AADSTS errors and fixes#

For Conditional Access blocks, see AADSTS53000 vs AADSTS53003; for other codes, the AADSTS quick reference.

Tips & gotchas#

• Entra says success, Jamf Pro says no. Compare the NameID (the UPN by default; a browser SAML tracer shows the real value) with the Jamf Pro account's email or username.
• Certificate expiry. After rotating the SAML signing certificate, confirm Jamf Pro has the new one (re-save the metadata URL if needed) before the old one expires.
• Different integrations. SSO is separate from Entra ID as Jamf Pro's cloud identity provider and from Jamf Connect; the integration overview maps them all.

References#

• Configure Jamf Pro for single sign-on with Microsoft Entra ID (Microsoft Learn)
• Microsoft Entra authentication and authorization error codes (Microsoft Learn)
• Enabling SSO with SAML in Jamf Pro (Jamf Learning Hub)