> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable macOS Platform SSO for Microsoft Entra ID with TruU in Jamf Pro

## Prerequisites

1. Target computers with either macOS 13 or macOS 14 or later.
2. [Download the Company Portal App from Microsoft](https://learn.jamf.com/en-US/bundle/technical-articles/page/Platform_SSO_for_Microsoft_Entra_ID.html#task-1310)

## Platform SSO Requirements

Before you configure Platform SSO, make sure your environment meets the following requirements:

* Target Macs running **macOS 13 or later** (macOS 14 or later recommended).
* **Apple silicon or a T2-based Mac**, required for the Secure Enclave key used by the authentication method.
* Devices enrolled in **Jamf Pro** via **User-Approved MDM**.
* Integrate Jamf Pro with Microsoft Intune for device ccompliance [https://learn.microsoft.com/en-us/intune/device-security/compliance/jamf-entra-id](https://learn.microsoft.com/en-us/intune/device-security/compliance/jamf-entra-id)
* **Microsoft Entra ID** configured as the identity provider (IdP).
* **Microsoft Company Portal** installed on the device (Extension Identifier `com.microsoft.CompanyPortalMac.ssoextension`, Team Identifier `UBF8T346G9`).
* **TruU Mac Authenticator** deployed and enrolled on the device.
* Network access from the device to the Microsoft/Entra sign-in endpoints listed in the **URLs** step below.
* Authentication method set to **User Secure Enclave Key**.
* **Enable registration during setup** turned on so Platform SSO activates during Setup Assistant.

## Uploading the Company Portal App to Jamf Pro as a Package

After you have downloaded the Company Portal app from Microsoft, you must then upload the Company Portal app to a distribution point in Jamf Pro.

1. In Jamf Pro, click **Settings** in the sidebar.
2. In the Computer Management section, click **Packages**.
3. Create a new package that includes the Company Portal app.
4. Click **Save**.

## Deploying the Company Portal App to Mac Computers

Now that you have uploaded the Company Portal app to Jamf Pro, you must deploy it to your users' computers.

1. In Jamf Pro, click **Computers** in the sidebar.
2. Click **Policies** in the sidebar.
3. Create a policy that deploys the Company Portal app to users.
4. Use the **General** payload to configure the following settings:
   * For **Trigger**, select "Enrollment Complete" and "Recurring Check-in".
   * For **Execution Frequency**, select "Once per computer".
5. Click the **Packages** payload, and then click **Configure**.
6. Click **Add** for the package that includes the Company Portal app.
7. Configure the settings for the package.
8. Specify a distribution point for computers to download the package from.
9. Click the **Scope** tab to specify which computers should install the Company Portal app.
10. Click **Save**.

## Deploying a Platform Single Sign-on Configuration Profile

You must deploy a configuration profile to your target computers to enable Platform Single Sign-on with Microsoft Entra ID.

1. In Jamf Pro, click **Computers** in the sidebar.
2. Click **Configuration Profiles** in the sidebar.
3. Click **New**.
4. Click the **Single Sign-on Extensions** payload.
5. Click **Add**.
6. Under **Payload Type**, select the **SSO** option.
7. In the **Extension Identifier** field, enter the following value: `com.microsoft.CompanyPortalMac.ssoextension`
8. In the **Team Identifier** field, enter the following value: `UBF8T346G9`
9. Under **Sign-on Type**, select the **Redirect** option.
10. Under **URLs**, copy and paste all the following URLs:
    ```text theme={null}
    https://login.microsoftonline.com
    https://login.microsoft.com
    https://sts.windows.net
    ```
    If your environment needs to allow sovereign cloud domains, like Azure Government or Azure China 21Vianet, then also add the following URLs:
    ```text theme={null}
    https://login.partner.microsoftonline.cn
    https://login.chinacloudapi.cn
    https://login.microsoftonline.us
    https://login-us.microsoftonline.com
    ```
    These URL prefixes are the identity providers that do SSO app extensions. The URLs are required for redirect payloads and are ignored for credential payloads. For more information on these URLs, go to [Microsoft Enterprise SSO plug-in for Apple devices](https://learn.microsoft.com/en-us/entra/identity-platform/apple-sso-plugin).
11. Use the toggle to include the **Use Platform SSO** setting.
12. Under **Authentication Method**, select **User Secure Enclave Key**.
13. (Optional) Use the toggle to include the **Shared Device Keys** setting.
14. Use the toggle to include the **Display Account Name** setting. This value is used in the notification that macOS displays as part of the registration process — use a value that makes it clear to end users what credentials are required (for example, `TruU Inc.`).
15. Use the toggle to include the **User Mapping** setting, and then configure it with the following claims:
    * In the **Full Name** field, enter the following value: `name`
    * In the **Account Name** field, enter the following value: `preferred_username`
16. Use the toggle to include the **Account Authorization Type** setting, then use the pop-up menu to select either **Standard** or **Admin**.
17. Use the toggle to include the **New User Account Type** setting, then use the pop-up menu to select either **Standard** or **Admin**.
18. Use the toggle to include the **Authentication when screen is locked** setting, and then select **Do not handle**.
19. Use the toggle to include the **Custom Configuration** setting, and then upload a PLIST file (for example, `PSSO.plist`) containing the following key-value pairs:
    | Key                               | Type    | Value                                                                                                        |
    | --------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------ |
    | `AppPrefixAllowList`              | String  | `com.microsoft.,com.apple.,com.jamf.selfserviceplus.,com.jamf.trust.,com.jamf.management.,com.jamfsoftware.` |
    | `browser_sso_interaction_enabled` | Integer | `1`                                                                                                          |
    | `disable_explicit_app_prompt`     | Integer | `1`                                                                                                          |
20. Click the **Scope** tab and configure the scope to target your test environment.

## User Experience

1. Once the device is enrolled into JAMF and TruU, you will see a pop-up notification to Register PSSO.
2. Log in with your TruU PIN and click **Continue**.
3. As per the instructions on the screen, go to **System Preferences** and enable the toggle for Company Portal.
4. The PSSO is now enabled on your device. You can verify this in **System Settings > Users & Groups > Network Account Server**.