Enable macOS Platform SSO for Microsoft Entra ID with TruU in Jamf Pro

​

Prerequisites

1. Target computers with either macOS 13 or macOS 14 or later.
2. Download the Company Portal App from Microsoft

​

Platform SSO Requirements

• Target Macs running macOS 13 or later (macOS 14 or later recommended).
• Apple silicon or a T2-based Mac, required for the Secure Enclave key used by the authentication method.
• Devices enrolled in Jamf Pro via User-Approved MDM.
• Integrate Jamf Pro with Microsoft Intune for device ccompliance https://learn.microsoft.com/en-us/intune/device-security/compliance/jamf-entra-id
• Microsoft Entra ID configured as the identity provider (IdP).
• Microsoft Company Portal installed on the device (Extension Identifier com.microsoft.CompanyPortalMac.ssoextension, Team Identifier UBF8T346G9).
• TruU Mac Authenticator deployed and enrolled on the device.
• Network access from the device to the Microsoft/Entra sign-in endpoints listed in the URLs step below.
• Authentication method set to User Secure Enclave Key.
• Enable registration during setup turned on so Platform SSO activates during Setup Assistant.

​

Uploading the Company Portal App to Jamf Pro as a Package

1. In Jamf Pro, click Settings in the sidebar.
2. In the Computer Management section, click Packages.
3. Create a new package that includes the Company Portal app.
4. Click Save.

​

Deploying the Company Portal App to Mac Computers

1. In Jamf Pro, click Computers in the sidebar.
2. Click Policies in the sidebar.
3. Create a policy that deploys the Company Portal app to users.
4. Use the General payload to configure the following settings:
   • For Trigger, select “Enrollment Complete” and “Recurring Check-in”.
   • For Execution Frequency, select “Once per computer”.
5. Click the Packages payload, and then click Configure.
6. Click Add for the package that includes the Company Portal app.
7. Configure the settings for the package.
8. Specify a distribution point for computers to download the package from.
9. Click the Scope tab to specify which computers should install the Company Portal app.
10. Click Save.

​

Deploying a Platform Single Sign-on Configuration Profile

1. In Jamf Pro, click Computers in the sidebar.
2. Click Configuration Profiles in the sidebar.
3. Click New.
4. Click the Single Sign-on Extensions payload.
5. Click Add.
6. Under Payload Type, select the SSO option.
7. In the Extension Identifier field, enter the following value: com.microsoft.CompanyPortalMac.ssoextension
8. In the Team Identifier field, enter the following value: UBF8T346G9
9. Under Sign-on Type, select the Redirect option.
10. Under URLs, copy and paste all the following URLs:
    https://login.microsoftonline.com
    https://login.microsoft.com
    https://sts.windows.net
    
    If your environment needs to allow sovereign cloud domains, like Azure Government or Azure China 21Vianet, then also add the following URLs:
    https://login.partner.microsoftonline.cn
    https://login.chinacloudapi.cn
    https://login.microsoftonline.us
    https://login-us.microsoftonline.com
    
    These URL prefixes are the identity providers that do SSO app extensions. The URLs are required for redirect payloads and are ignored for credential payloads. For more information on these URLs, go to Microsoft Enterprise SSO plug-in for Apple devices.
11. Use the toggle to include the Use Platform SSO setting.
12. Under Authentication Method, select User Secure Enclave Key.
13. (Optional) Use the toggle to include the Shared Device Keys setting.
14. Use the toggle to include the Display Account Name setting. This value is used in the notification that macOS displays as part of the registration process — use a value that makes it clear to end users what credentials are required (for example, TruU Inc.).
15. Use the toggle to include the User Mapping setting, and then configure it with the following claims:
    • In the Full Name field, enter the following value: name
    • In the Account Name field, enter the following value: preferred_username
16. Use the toggle to include the Account Authorization Type setting, then use the pop-up menu to select either Standard or Admin.
17. Use the toggle to include the New User Account Type setting, then use the pop-up menu to select either Standard or Admin.
18. Use the toggle to include the Authentication when screen is locked setting, and then select Do not handle.
19. Use the toggle to include the Custom Configuration setting, and then upload a PLIST file (for example, PSSO.plist) containing the following key-value pairs:

    Key	Type	Value
    AppPrefixAllowList	String	com.microsoft.,com.apple.,com.jamf.selfserviceplus.,com.jamf.trust.,com.jamf.management.,com.jamfsoftware.
    browser_sso_interaction_enabled	Integer	1
    disable_explicit_app_prompt	Integer	1

20. Click the Scope tab and configure the scope to target your test environment.

​

User Experience

1. Once the device is enrolled into JAMF and TruU, you will see a pop-up notification to Register PSSO.
2. Log in with your TruU PIN and click Continue.
3. As per the instructions on the screen, go to System Preferences and enable the toggle for Company Portal.
4. The PSSO is now enabled on your device. You can verify this in System Settings > Users & Groups > Network Account Server.