Skip to main content

Microsoft Enterprise SSO plug-in for Apple devices

What the Enterprise SSO plug-in does

The Microsoft Enterprise SSO plug-in provides single sign-on for Microsoft Entra accounts on macOS, iOS, and iPadOS. It works with applications that support Apple's Enterprise SSO framework and can extend SSO to older applications that do not use current Microsoft identity libraries. See Microsoft Enterprise SSO plug-in for Apple devices for Microsoft's current requirements and options.

When to use it

Use this profile when FileWave-managed Apple devices need Microsoft Entra SSO across supported apps and websites. Users complete an initial sign-in to bootstrap the extension; later authentication can use the existing Microsoft session and the organization's Conditional Access and multi-factor authentication policies.

This Enterprise SSO extension is separate from Microsoft Entra Platform SSO for macOS. Use the related Platform SSO article when you need macOS login-window and local-account integration.

Deployment overview

Install the Microsoft app that contains the extension, deploy the Extensible Single Sign On profile from FileWave, allow the required Apple and Microsoft network endpoints, and test the complete sign-in flow on a pilot device.

Requirements

  • Install the app that contains Microsoft's Enterprise SSO extension:
  • Enroll the device in FileWave MDM. Microsoft supports the extension with both device enrollment and user enrollment; Automated Device Enrollment (ADE, formerly DEP) is not the only supported enrollment path.
  • Deploy an Extensible Single Sign On profile that enables the extension.
  • Allow the Apple CDN, Microsoft identity, and device-registration endpoints required for the deployed operating systems. Exclude the registration flow and Apple CDN endpoints from TLS break-and-inspect as documented by Microsoft.

On macOS, Company Portal supplies the Microsoft Enterprise SSO extension. Installing Company Portal does not require Intune to manage the device; FileWave can remain the MDM and deploy the profile. Users do not need to enroll the Mac in Intune for this workflow. Download the Company Portal installer package.

Deploy Microsoft Authenticator

Acquire Microsoft Authenticator through Apps and Books in Apple School Manager or Apple Business Manager, then sync and deploy it through FileWave like another managed App Store app.

Microsoft Authenticator acquisition screen with Device Assignable and Buy Licenses controls

Create the profile in FileWave Central

  1. Open Filesets in FileWave Central.
  2. Select New Desktop Fileset > Profile.
  3. Enter a clear profile name, such as Microsoft Enterprise SSO.
  4. Select the Single Sign-On Extensions payload.
  5. Enter in the following for specified payload:
    1. iOS settings:
      • Extension ID: com.microsoft.azureauthenticator.ssoextension
      • Team ID: This field isn't needed for iOS but you can use UBF8T346G9
    2. macOS settings:
      • Extension ID: com.microsoft.CompanyPortalMac.ssoextension
      • Team ID: UBF8T346G9
    3. Sign-On Type:
      • Type: Redirect
    4. URL identity providers:
      • https://login.microsoftonline.com
      • https://login.microsoft.com
      • https://sts.windows.net
      • https://login.partner.microsoftonline.cn
      • https://login.chinacloudapi.cn
      • https://login.microsoftonline.us
      • https://login-us.microsoftonline.com
    5. Optional Custom Configurations (Not required):
      • Enable SSO for all apps with specific bundle IDs or prefix IDs: Key:AppPrefixAllowList - Type:String - Value:com.microsoft., com.apple., or com.business.travelapp
      • Sign in with browser that don’t use MSAL and Safari: Key:browser_sso_interaction_enabled - Type:Number - Value:1
      • Disable OAuth 2 app prompts: Key:disable_explicit_app_prompt - Type:Number - Value:1

FileWave Profile Editor showing the Microsoft Enterprise SSO extension ID, team ID, redirect URLs, and custom configuration

Pilot the deployment

Deploy the profile and its extension-hosting app to a small pilot first: Microsoft Authenticator on iOS or iPadOS, and Company Portal on macOS. The app must be installed before you test the extension.

FileWave deployment containing the Microsoft Authenticator app and Microsoft Single Sign-On profile

Users sign in to any supported app or website to bootstrap the extension.

Bootstrap is the user's first Microsoft sign-in after deployment. That sign-in initializes the extension; supported apps and websites can then reuse the Microsoft session.

You can test single sign-on by opening Safari in private mode (opens Apple's web site) and opening the https://portal.office.com site. If configured successfully, no username and password will be required.

Related content

No comments to display

Back to top