Skip to main content
Setup Kerberos SSO with Platform SSO in JAMF for macOS This guide builds on Setup Platform SSO in JAMF for macOS. Complete that setup first — Platform SSO must be deployed and the device registered before Kerberos tickets can be issued. Platform SSO (PSSO) registers the Mac with Microsoft Entra ID using a Secure Enclave key. Microsoft Entra Kerberos then issues the Kerberos Ticket-Granting Tickets (TGTs) automatically, and PSSO maps them into the native macOS Kerberos store. The ticket comes from Platform SSO and Entra Kerberos — not from a Kerberos extension profile. The optional Kerberos SSO extension profile described at the end only affects how those tickets are used for silent SSO; it does not create them.

​
Prerequisites

  • Platform SSO already deployed and the device registered, per Setup Platform SSO in JAMF for macOS.
  • Target computers running macOS 14.6 or later.
  • Microsoft Company Portal 5.2408.0 or later installed (2508 or later if you want to customize TGT mapping).
  • Microsoft Entra Kerberos (Cloud Kerberos trust) deployed in your tenant. This is the same configuration used for Windows Hello for Business Cloud Kerberos trust, and is what enables on-premises TGT issuance.
  • Your Entra Tenant ID (Microsoft Entra admin center, Overview), if you also need cloud Kerberos.
  • Your on-premises Active Directory realm / forest name in uppercase.
  • Network line of sight to a domain controller / KDC to use on-premises tickets, or a VPN/ZTNA path for remote Macs.
Note: Device Compliance is not required to obtain Kerberos tickets. Enable it only if you also want compliance status flowing to Entra Conditional Access.
Important: Verify your realm from a live ticket, not from assumption. The realm shown in Ticket Viewer or in the output of app-sso platform -s is authoritative. If it differs from what you expected, use the live value everywhere in the configuration below.

​
Confirming Kerberos tickets are issued

Once Platform SSO registration is complete, Microsoft Entra issues the TGT(s) automatically. No additional profile is required for the ticket itself.
  1. On a registered Mac, open Terminal and run: app-sso platform -s
  2. Confirm the device and user show as registered, and look for the on-premises TGT (tgt_ad). If your tenant has Cloud Kerberos configured, you will also see the cloud TGT for KERBEROS.MICROSOFTONLINE.COM, because the default TGT mapping covers both.
  3. You can also open Ticket Viewer to see the same tickets and their expiration times.
Note: klist is not the source of truth for Platform SSO. It may show empty while the ticket is valid, because PSSO places the TGT in a credential cache that plain klist does not read by default. Use klist -l or klist -A to list all caches, and trust app-sso platform -s and Ticket Viewer.

​
Validating on-premises access

The functional test is the real confirmation that Kerberos SSO works end to end.
  1. In Finder, choose Go, then Connect to Server, and enter an on-premises share using its real DNS name, for example: smb://server.your-domain.com
  2. The share should connect without prompting for a username or password.
  3. Alternatively, open an internal, Kerberos-protected site in Safari — you should be signed in automatically.
If a valid ticket is present but a resource still prompts for credentials, the cause is usually a host/realm mapping gap or browser configuration.
Note: The Kerberos SSO menu bar extra may report “Not signed in.” This is expected with Platform SSO and can be ignored. Validate using the functional test above rather than the menu bar.

​
Browser configuration

Browser support for Kerberos SSO is independent of the optional Kerberos extension profile.
  • Safari works by default, no configuration required.
  • Microsoft Edge: set AuthNegotiateDelegateAllowlist and AuthServerAllowlist to your on-premises Active Directory forest.
  • Google Chrome: set the same two policies.
  • Mozilla Firefox: set network.negotiate-auth.trusted-uris and network.automatic-ntlm-auth.trusted-uris.
Deploy these through Jamf Pro as managed app configuration or preference profiles.

​
(Optional) Kerberos SSO extension profile

Normally customers do not need this profile to obtain kerberos tickets, but in some cases you may need this if cloud trust is not setup or working properly. The native macOS Kerberos stack frequently resolves the ticket to on-premises servers on its own when DNS names map cleanly to the ticket realm. Deploy the Kerberos SSO extension profile only if:
  • On-premises resources use DNS names that do not map cleanly to the ticket realm (split DNS, multiple domains, CNAMEs or aliases, or resources under a different suffix than the realm).
  • You want deterministic, declared Kerberos SSO behavior instead of relying on native auto-resolution.
  • Specific applications query the SSO extension directly rather than the native Kerberos stack.
Skip it if SMB shares and the browsers you care about already connect silently without it.

​
Creating the profile in Jamf Pro

Create a separate configuration profile from your Platform SSO profile.
  1. In Jamf Pro, click Computers in the sidebar.
  2. Click Configuration Profiles, then click New.
  3. Add the Single Sign-on Extensions payload and configure it with the values below, replacing the domain and realm with your own.
  4. Click the Scope tab and scope the profile to the same computers and users that have the Platform SSO profile.
  5. Click Save.
  • Extension Identifier: com.apple.AppSSOKerberos.KerberosExtension
  • Payload Type: Kerberos
  • Realm: YOUR-DOMAIN.COM (uppercase; must match the live ticket exactly)
  • Hosts: your-domain.com and .your-domain.com (keep the leading dot on the second entry)
  • Use Platform SSO TGT (usePlatformSSOTGT): Enforce / true (consume the PSSO-issued TGT)
  • Kerberos requests only (performKerberosOnly): Enforce / true (skips password-expiry, external password change, and home-directory retrieval)
  • Platform SSO manual sign-on (allowPlatformSSOAuthFallback): Allow / true (lets users enter an on-premises username if their UPN differs)
  • Password change (allowPasswordChange): false (explicitly disables password change in the extension)
Note: Setting allowPasswordChange to false disables password change in the extension and in the Kerberos menu bar extra (the menu bar will report that password changes are disabled). The Change Password button in the Ticket Viewer app is native to macOS and cannot be removed by any profile — it is cosmetic and can be ignored.
Important: If a setting change does not take effect, an older Kerberos profile is usually overriding it, because macOS merges SSO extension data across all installed Kerberos profiles. Remove any older Kerberos profiles, confirm with profiles list, force a check-in with sudo jamf policy, then log out and back in (or reboot) to reload the extension.

​
Troubleshooting

  • app-sso platform -s shows null or “not registered”: Platform SSO registration did not complete. Re-trigger the registration notification and confirm Company Portal is installed and current.
  • klist is empty but Ticket Viewer shows the ticket: normal cache-context difference. Use klist -l or klist -A, and rely on app-sso platform -s.
  • Ticket is present but a resource still prompts: host/realm mapping gap (deploy the optional Kerberos extension profile with correct Hosts) or a browser allowlist that is not set.
  • Realm mismatch: the realm shown in Ticket Viewer is authoritative. Correct the Realm and Hosts to match it, including capitalization.
  • A setting will not stick: a leftover older profile is overriding it. Remove all but the current profile, re-push, and reboot.