oeltayeb.com · Jamf + Intune Toolkit

Checklist

Platform SSO on Jamf-managed Macs checklist

Based on the article: Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs · 6 min read

Jamf Pro can deliver the same Microsoft single sign-on experience as Intune. The Microsoft Enterprise SSO plug-in, which ships inside Company Portal, gives apps and browsers SSO and a device identity for Conditional Access; Platform SSO goes further and ties the Mac's own sign-in to Microsoft Entra ID. In this post I'll build both from Jamf Pro, explain how they interact with Jamf Device Compliance, and show how to verify them. The Intune build is covered in Platform SSO for macOS with Intune, so I won't repeat it.

Before you start

  • Company Portal installed first, as described in deploying Microsoft 365 apps and Company Portal with Jamf Pro. Scope the SSO profile to a smart group of Macs that report Company Portal.app.
  • macOS 14 or later. Microsoft's minimum for Platform SSO is macOS 13, but the current Authentication Method setting used below applies to macOS 14 and later.
  • Entra device settings that allow your users to join devices, as listed in the Intune guide's prerequisites.
  • An authentication method: Secure Enclave key (local password unchanged, phishing-resistant, and knowledge of the local password satisfies multifactor requirements in Conditional Access), Password (the Entra password becomes the local password) or Smart card.
  • No TLS inspection of Apple's app-site-association.cdn-apple.com and app-site-association.networking.apple and, for Platform SSO Macs, Microsoft's sign-in URLs.

How it works on a Jamf-managed Mac

Apple only activates an SSO extension when an MDM pushes its configuration, so Jamf Pro supplies the profile and Company Portal supplies the extension.

  • Enterprise SSO plug-in only: a Redirect-type extension for Microsoft's sign-in URLs. Apps built on the Microsoft Authentication Library (MSAL) and Safari get SSO, and the plug-in presents the device identity for device-based Conditional Access.
  • Platform SSO: the same payload with Platform SSO enabled. The user registers the Mac with Entra ID from a macOS notification. Depending on the method, they then sign in to the Mac with their Entra password or a smart card, or keep their local password while a Secure Enclave key handles Entra sign-ins.

Note: Jamf notes that its troubleshooting support may be limited to the steps done in Jamf Pro; Entra ID issues go to Microsoft and Platform SSO itself to Apple. Knowing that split saves time when you open a case.

Checklist

  1. 1

    Optional: register during Setup Assistant

    Jamf supports Simplified Setup, where new Macs register during Setup Assistant. All required payloads must sit in the same profile, with Enable registration during setup and Create first user during setup turned on; New user creation authentication method chooses how the first account signs in (Password and Smart Card if unset).

Watch out: Configure the Microsoft extension in one profile only. If you already deployed a plug-in-only profile, replace it rather than adding a second one; duplicate SSO extension profiles produce the conflict errors listed in the Intune guide.

Verify

bash
sudo profiles show -type configuration | grep -i "CompanyPortalMac.ssoextension"
app-sso platform -s
  • The first command finds the extension in the installed profiles; the second should show a completed device and user registration with the login type you chose.
  • The Mac appears under Devices in the Microsoft Entra admin center and, with Device Compliance, turns compliant once Jamf's Compliance smart group includes it.
  • Browsers: Safari works natively. Chrome needs the Microsoft Single Sign On extension or Chrome 135 or later, Edge needs the user signed in to the browser profile, and Firefox needs its MicrosoftEntraSSO policy.
  • A Microsoft 365 sign-in from the Mac shows the device ID in the Entra sign-in log, with no password prompt.

Microsoft Learn references