Edit

Use the Microsoft Enterprise SSO plug-in on macOS devices

  • Article

The Microsoft Enterprise SSO plug-in is a feature in Microsoft Entra ID that provides single sign-on (SSO) features for Apple devices. This plug-in uses the Apple single sign-on app extension framework.

The SSO app extension provides single sign-on to apps and websites that use Microsoft Entra ID for authentication, including Microsoft 365 apps. It reduces the number of authentication prompts users get when using devices managed by Mobile Device Management (MDM), including any MDM that supports configuring SSO profiles.

This article applies to:

On macOS devices, you can configure SSO app extension settings in two places in Intune:

  • Device features template (this article) - This option configures only the SSO app extension and uses your MDM provider, like Intune, to deploy the settings to devices.

    Use this article if you only want to configure the SSO app extension settings and don't want to also configure Platform SSO.

  • Settings Catalog - This option configures Platform SSO and the SSO app extension together. You use Intune to deploy the settings to your devices.

    Use the settings catalog settings if you want to configure both the Platform SSO and SSO app extension settings. For more information, go to Configure platform SSO for macOS devices in Microsoft Intune.

For an overview of your SSO options on Apple devices, go to SSO overview and options for Apple devices in Microsoft Intune.

This article shows how to create an SSO app extension configuration policy for macOS Apple devices with Intune, Jamf Pro, and other MDM solutions.

If you want to configure Platform SSO and SSO app extension settings together, then go to Configure platform SSO for macOS devices in Microsoft Intune.

App support

For your apps to use the Microsoft Enterprise SSO plug-in, you have two options:

  • Option 1 - MSAL: Apps that support the Microsoft Authentication Library (MSAL) automatically take advantage of the Microsoft Enterprise SSO plug-in. For example, Microsoft 365 apps support MSAL. So, they automatically use the plug-in.

    If your organization creates its own apps, then your app developer can add a dependency to the MSAL. This dependency enables your app to use the Microsoft Enterprise SSO plug-in.

    For a sample tutorial, go to Tutorial: Sign in users and call Microsoft Graph from an iOS or macOS app.

  • Option 2 - AllowList: Apps that don't support or weren't developed with MSAL can use the SSO app extension. These apps include browsers like Safari and apps that use Safari web view APIs.

    For these non-MSAL apps, add the application bundle ID or prefix to the extension configuration in your Intune SSO app extension policy (in this article).

    For example, to allow a Microsoft app that doesn't support MSAL, add com.microsoft. to the AppPrefixAllowList property in your Intune policy. Be careful with the apps you allow, they can bypass interactive sign-in prompts for the signed in user.

    For more information, go to Microsoft Enterprise SSO plug-in for Apple devices - apps that don't use MSAL.

Prerequisites

To use the Microsoft Enterprise SSO plug-in on macOS devices:

  • The device is MDM managed by Intune.
  • The device must support the plug-in:
    • macOS 10.15 and newer
  • The Microsoft Company Portal app must be installed and configured on the device.
  • The Enterprise SSO plug-in requirements are configured, including the Apple network configuration URLs.

Microsoft Enterprise SSO plug-in vs. Kerberos SSO extension

When you use the SSO app extension, you use the SSO or Kerberos Payload Type for authentication. The SSO app extension is designed to improve the sign-in experience for apps and websites that use these authentication methods.

The Microsoft Enterprise SSO plug-in uses the SSO Payload Type with Redirect authentication. The SSO Redirect and Kerberos extension types can both be used on a device at the same time. Be sure to create separate device profiles for each extension type you plan to use on your devices.

To determine the correct SSO extension type for your scenario, use the following table:

Microsoft Enterprise SSO plug-in for Apple Devices Single sign-on app extension with Kerberos
Uses the Microsoft Entra ID SSO app extension type Uses the Kerberos SSO app extension type
Supports the following apps:
- Microsoft 365
- Apps, websites or services integrated with Microsoft Entra ID		 Supports the following apps:
- Apps, websites or services integrated with AD

For more information on the SSO app extension, go to SSO overview and options for Apple devices in Microsoft Intune.

Create a single sign-on app extension configuration policy

This section shows how to create an SSO app extension policy. For information on platform SSO, go to Configure platform SSO for macOS devices in Microsoft Intune.

In the Microsoft Intune admin center, create a device configuration profile. This profile includes the settings to configure the SSO app extension on devices.

  1. Sign in to the Microsoft Intune admin center.

  2. Select Devices > Configuration > Create > New policy.

  3. Enter the following properties:

    • Platform: Select macOS.
    • Profile type: Select Templates > Device features.

  4. Select Create:

    Screenshot that shows how to create a device features configuration profile for macOS in Intune.

  5. In Basics, enter the following properties:

    • Name: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name is macOS-SSO app extension.
    • Description: Enter a description for the policy. This setting is optional, but recommended.

  6. Select Next.

  7. In Configuration settings, select Single sign-on app extension, and configure the following properties:

    • SSO app extension type: Select Microsoft Entra ID:

      Screenshot that shows the SSO app extension type and Microsoft Entra ID for macOS in Intune

    • App bundle ID: Enter a list of bundle IDs for apps that don't support MSAL and are allowed to use SSO. For more information, go to Applications that don't use MSAL.

    • Additional configuration: To customize the end user experience, you can add the following properties. These properties are the default values used by the SSO app extension, but they can be customized for your organization needs:

      Key Type Description
      AppPrefixAllowList String Recommended value: com.microsoft.,com.apple.

      Enter a list of prefixes for apps that don't support MSAL and are allowed to use SSO. For example, enter com.microsoft.,com.apple. to allow all Microsoft and Apple apps.

      Be sure these apps meet the allowlist requirements.
      browser_sso_interaction_enabled Integer Recommended value: 1

      When set to 1, users can sign in from Safari browser, and from apps that don't support MSAL. Enabling this setting allows users to bootstrap the extension from Safari or other apps.
      disable_explicit_app_prompt Integer Recommended value: 1

      Some apps might incorrectly enforce end-user prompts at the protocol layer. If you see this problem, users are prompted to sign in, even though the Microsoft Enterprise SSO plug-in works for other apps.

      When set to 1 (one), you reduce these prompts.

      Tip

      For more information on these properties, and other properties you can configure, go to Microsoft Enterprise SSO plug-in for Apple devices.

      When you're done configuring the recommended settings, the settings look similar to the following values in your Intune configuration profile:

      Screenshot that shows the end user experience configuration options for the Enterprise SSO app extension plug-in on macOS devices in Microsoft Intune.

  8. Continue creating the profile, and assign the profile to the users or groups that receive these settings. For the specific steps, go to Create the profile.

    For guidance on assigning profiles, go to Assign user and device profiles.

When the policy is ready, you assign the policy to your users. Microsoft recommends you assign the policy when the device enrolls in Intune. But, it can be assigned at any time, including on existing devices. When the device checks in with the Intune service, it receives this profile. For more information, go to Policy refresh intervals.

To check that the profile deployed correctly, in the Intune admin center, go to Devices > Configuration > select the profile you created and generate a report:

Screenshot that shows the macOS device configuration profile deployment report in Microsoft Intune.

End user experience

End user flow chart when installing SSO app app extension on macOS devices in Microsoft Intune.

  • If you're not deploying the Company Portal app using an app policy, then users must install it manually. Users don't need to use the Company Portal app, it just needs to be installed on the device.

  • Users sign in to any supported app or website to bootstrap the extension. Bootstrap is the process of signing in for the first time, which sets up the extension.

  • After users sign in successfully, the extension is automatically used to sign in to any other supported app or website.

You can test single sign-on by opening Safari in private mode (opens Apple's web site) and opening the https://portal.office.com site. No username and password will be required.

Users signs in to app or website to bootstrap the SSO app extension on iOS/iPadOS and macOS devices in Microsoft Intune.

On macOS, when users sign in to a work or school app, they're prompted to opt in or out of SSO. They can select Don't ask me again to opt out of SSO and block future requests.

Users can also manage their SSO preferences in the Company Portal app for macOS. To edit preferences, go to the Company Portal app menu bar > Company Portal > Settings. They can select or deselect Don't ask me to sign in with single sign-on for this device.

Don't ask me to sign in with single sign-on for this device.

Tip

Learn more about how the SSO plug-in works and how to troubleshoot the Microsoft Enterprise SSO Extension with the SSO troubleshooting guide for Apple devices.