> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup Platform SSO in JAMF for macOS

## Prerequisites

1. Target computers with either macOS 13 or macOS 14 or later.
2. [Download the Company Portal App from Microsoft](https://learn.jamf.com/en-US/bundle/technical-articles/page/Platform_SSO_for_Microsoft_Entra_ID.html#task-1310)

## Uploading the Company Portal App to Jamf Pro as a Package

After you have downloaded the Company Portal app from Microsoft, you must then upload the Company Portal app to a distribution point in Jamf Pro.

1. In Jamf Pro, click **Settings** in the sidebar.
2. In the Computer Management section, click **Packages**.
3. Create a new package that includes the Company Portal app.
4. Click **Save**.

## Deploying the Company Portal App to Mac Computers

Now that you have uploaded the Company Portal app to Jamf Pro, you must deploy it to your users' computers.

1. In Jamf Pro, click **Computers** in the sidebar.
2. Click **Policies** in the sidebar.
3. Create a policy that deploys the Company Portal app to users.
4. Use the **General** payload to configure the following settings:
   * For **Trigger**, select "Enrollment Complete" and "Recurring Check-in".
   * For **Execution Frequency**, select "Once per computer".
5. Click the **Packages** payload, and then click **Configure**.
6. Click **Add** for the package that includes the Company Portal app.
7. Configure the settings for the package.
8. Specify a distribution point for computers to download the package from.
9. Click the **Scope** tab to specify which computers should install the Company Portal app.
10. Click **Save**.

## Deploying a Platform Single Sign-on Configuration Profile

You must deploy a configuration profile to your target computers to enable Platform Single Sign-on with Microsoft Entra ID.

1. In Jamf Pro, click **Computers** in the sidebar.
2. Click **Configuration Profiles** in the sidebar.
3. Click **New**.
4. Click the **Single Sign-on Extensions** payload.
5. Click **Add**.
6. Under **Payload Type**, select the **SSO** option.
7. In the **Extension Identifier** field, enter the following value: `com.microsoft.CompanyPortalMac.ssoextension`
8. In the **Team Identifier** field, enter the following value: `UBF8T346G9`
9. Under **Sign-on Type**, select the **Redirect** option.
10. Under **URLs**, enter the URLs that macOS should trigger a redirect to the Company Portal app for authentication. These should include the following:
    * login.microsoftonline.com
    * login.microsoft.com
    * sts.windows.net
    * login.partner.microsoftonline.cn
    * login.chinacloudapi.cn
    * login.microsoftonline.us
    * login-us.microsoftonline.com
11. Use the toggle to include the **Use Platform SSO** setting.
12. Under **Authentication Method**, select **UserSecureEnclave**.
13. (Optional) Use the toggle to include the **Shared Device Keys** setting.
14. Use the toggle to include the **Display Account Name** setting.

<Note>
  This value will be used in the notification that macOS uses as part of the registration process. Use a value that will make it clear to end users what credentials are required.
</Note>

15. Use the toggle to include the **User Mapping** setting, and then configure it with the following claims:
    * In the **Full Name** field, enter the following value: `name`
    * In the **Account Name** field, enter the following value: `preferred_username`
16. Use the toggle to include the **Account Authorization Type** setting, then use the pop-up menu to select either Standard or Admin.
17. Use the toggle to include the **New User Account Type** setting, then use the pop-up menu to select either Standard or Admin.
18. Use the toggle to include the **Authentication when screen is locked** setting, and then select **Do not handle**.
19. Click the **Scope** tab and configure the scope to target your test environment.

## User Experience

1. Once the device is enrolled into JAMF and TruU, you will see a pop-up notification to Register PSSO.
2. Log in with your TruU PIN and click **Continue**.
3. As per the instructions on the screen, go to **System Preferences** and enable the toggle for Company Portal.
   <Frame>
     <img src="https://mintcdn.com/truu-2/flBOQyGsHm50cU-k/images/image-158.png?fit=max&auto=format&n=flBOQyGsHm50cU-k&q=85&s=e5efb1b38ed002fa4f1b98aa97d8993e" alt="Image" width="640" height="633" data-path="images/image-158.png" />
   </Frame>
4. The PSSO is now enabled on your device. You can verify this in **System Settings > Users & Groups > Network Account Server**.