Skip to main content

​
Prerequisites

  1. Target computers with either macOS 13 or macOS 14 or later.
  2. Download the Company Portal App from Microsoft

​
Uploading the Company Portal App to Jamf Pro as a Package

After you have downloaded the Company Portal app from Microsoft, you must then upload the Company Portal app to a distribution point in Jamf Pro.
  1. In Jamf Pro, click Settings in the sidebar.
  2. In the Computer Management section, click Packages.
  3. Create a new package that includes the Company Portal app.
  4. Click Save.

​
Deploying the Company Portal App to Mac Computers

Now that you have uploaded the Company Portal app to Jamf Pro, you must deploy it to your users’ computers.
  1. In Jamf Pro, click Computers in the sidebar.
  2. Click Policies in the sidebar.
  3. Create a policy that deploys the Company Portal app to users.
  4. Use the General payload to configure the following settings:
    • For Trigger, select “Enrollment Complete” and “Recurring Check-in”.
    • For Execution Frequency, select “Once per computer”.
  5. Click the Packages payload, and then click Configure.
  6. Click Add for the package that includes the Company Portal app.
  7. Configure the settings for the package.
  8. Specify a distribution point for computers to download the package from.
  9. Click the Scope tab to specify which computers should install the Company Portal app.
  10. Click Save.

​
Deploying a Platform Single Sign-on Configuration Profile

You must deploy a configuration profile to your target computers to enable Platform Single Sign-on with Microsoft Entra ID.
  1. In Jamf Pro, click Computers in the sidebar.
  2. Click Configuration Profiles in the sidebar.
  3. Click New.
  4. Click the Single Sign-on Extensions payload.
  5. Click Add.
  6. Under Payload Type, select the SSO option.
  7. In the Extension Identifier field, enter the following value: com.microsoft.CompanyPortalMac.ssoextension
  8. In the Team Identifier field, enter the following value: UBF8T346G9
  9. Under Sign-on Type, select the Redirect option.
  10. Under URLs, enter the URLs that macOS should trigger a redirect to the Company Portal app for authentication. These should include the following:
    • login.microsoftonline.com
    • login.microsoft.com
    • sts.windows.net
    • login.partner.microsoftonline.cn
    • login.chinacloudapi.cn
    • login.microsoftonline.us
    • login-us.microsoftonline.com
  11. Use the toggle to include the Use Platform SSO setting.
  12. Under Authentication Method, select UserSecureEnclave.
  13. (Optional) Use the toggle to include the Shared Device Keys setting.
  14. Use the toggle to include the Display Account Name setting.
This value will be used in the notification that macOS uses as part of the registration process. Use a value that will make it clear to end users what credentials are required.
  1. Use the toggle to include the User Mapping setting, and then configure it with the following claims:
    • In the Full Name field, enter the following value: name
    • In the Account Name field, enter the following value: preferred_username
  2. Use the toggle to include the Account Authorization Type setting, then use the pop-up menu to select either Standard or Admin.
  3. Use the toggle to include the New User Account Type setting, then use the pop-up menu to select either Standard or Admin.
  4. Use the toggle to include the Authentication when screen is locked setting, and then select Do not handle.
  5. Click the Scope tab and configure the scope to target your test environment.

​
User Experience

  1. Once the device is enrolled into JAMF and TruU, you will see a pop-up notification to Register PSSO.
  2. Log in with your TruU PIN and click Continue.
  3. As per the instructions on the screen, go to System Preferences and enable the toggle for Company Portal.
    Image
  4. The PSSO is now enabled on your device. You can verify this in System Settings > Users & Groups > Network Account Server.