Using NinjaOne to Configure Platform Single Sign-on (SSO) on macOS

Topic

This article explains how to set up Platform SSO for your Apple macOS devices with Microsoft Entra ID using NinjaOne. It also walks through the registration process so that the end user can see when their device is enrolled in NinjaOne Mobile Device Management (MDM).

Environment

• NinjaOne MDM
• Apple macOS
• Microsoft Entra

Description

Platform SSO is a technology developed by Apple for macOS that allows identity providers (IdPs) to manage SSO to their enterprise apps based on the user's local login to the device itself. Find more information about this product on the developer site: Platform Single Sign-on for macOS - Apple Support (external link).

Depending on the specific implementation, Platform SSO can allow for different types of functionality. Currently, local user accounts on a macOS device receive a notification to authenticate and register for Platform SSO. Technicians can optionally configure the policy to allow subsequent local user accounts to be created by authenticating with the IdP in the local device login window.

Index

• Pre-requisites
• Platform SSO with Microsoft Entra ID
  • 1. Deploy the Intune Company Portal app to NinjaOne devices
  • 2. Set up the Platform SSO Extension MDM profile in NinjaOne
  • 3. Registering with Platform SSO on the device using a Secure Enclave key
  • 4. (Optional) Skip the Required Privacy Notice for Microsoft AutoUpdater
  • 5. (Optional) Allow Other Users to Log in With Their Entra ID Credentials
• Additional Resources

Pre-requisites

To configure Platform SSO, you must meet certain requirements regardless of the IdP and MDM, though the exact steps may vary by implementation.

1. The IdP (such as Microsoft or Okta) must support the Platform SSO protocol.
2. The macOS device must be enrolled in MDM.
3. The relevant Platform SSO Extension (a native macOS app) must be deployed to the device.
4. The Platform SSO Extension MDM profile must be deployed to the device.

Platform SSO supports three authentication methods for users. The IdP used for authentication must also support these same methods; otherwise, only a subset of these methods may be available for a particular IdP.

• Secure Enclave-backed key: In most cases, this is the preferred and most secure authentication method when using Platform SSO with an IdP that supports it. With this authentication method, the user creates a local password for the device. Once Platform SSO is registered, the device generates a hardware-bound cryptographic key that is used for SSO with any websites and apps that are federated with the IdP for authentication.
  • As the authentication key is bound to the physical device and is never known to the end user, this allows for a password-free and phishing-resistant authentication method to enterprise apps. With this approach, the local device password effectively serves as a device personal identification number (PIN) for accessing only the physical device.
• Smartcard: A smartcard or hard token, is used to log in to macOS locally. Once logged in, the same smart card is used for SSO to any apps federated with the IdP.
• Passcode: The user's IdP password is synced with the local device password. This password is used to SSO into any apps that are federated with the IdP for authentication.
  • While this provides an added convenience for the end user, as the local device password becomes the same as their IdP password, it also creates an added phishing risk. If a malicious third party were to learn the IdP passcode, they could potentially access both the physical device and any enterprise apps federated with the IdP. For this reason, we recommend leveraging a Secure Enclave-backed key when a single user primarily uses devices.

Platform SSO with Microsoft Entra ID

Microsoft Entra ID supports Platform SSO and all three end-user authentication options.

Users will generally see the initial system notification after both the NinjaOne agent and Microsoft company portal apps are installed on the device, which may take several minutes following the initial MDM enrollment. If the registration notification does not appear, log out of the device locally and then log back in to initiate it.

1. Deploy the Intune Company Portal app to NinjaOne devices

For Platform SSO with Microsoft Entra ID, Microsoft uses the Company Portal app to broker SSO functionality. The Company Portal app can be downloaded from Microsoft here (downloadable package file).

Once downloaded, you can use the following steps to deploy it to your macOS devices enrolled in NinjaOne MDM:

1. Within NinjaOne, navigate to Administration → Library → Automation.
2. Click Add and select Installation.

3. On the Install Application dialog, configure the following settings, and then select Submit.
   • Name: Enter a name such as "Intune Company Portal."
   • Operating System: "Mac."
   • Installer: Leave the drop-down menu at the default Upload File option and click Choose installer file. Upload the Company Portal PKG installer.

4. Verify that the configuration passes review and appears in the Automation Library. It may take a few minutes for the installation to validate.
5. Add the automation to your macOS policy. Navigate to Administration → Policies → Agent Policies, and create a new policy or edit your existing policy. If you need instructions for creating a new policy, refer to NinjaOne Policies: Create and Manage a Policy.
6. Select the Scheduled Automations tab and click Add a Scheduled Automation.

7. Give the scheduled automation a name, and choose to run the automation that you uploaded previously in Step 3. Choose an appropriate schedule, such as Run Once Immediately.

8. Click Add. Then, save the policy.

The Company Portal app should deploy to all managed macOS devices per your configured schedule.

2. Set up the Platform SSO Extension MDM profile in NinjaOne

You can copy the mobileconfig file at the end of this section and paste it directly into a Custom Payload in a macOS NinjaOne policy to configure Platform SSO with Entra ID.

Consider the following configurable fields:

• AuthenticationMethod: Lines 13–14. Set to one of the following depending on your desired experience:
  • UserSecureEnclaveKey
  • Password
  • SmartCard
• AccountDisplayName: Lines 15–16. This name is displayed to end users during the Platform SSO registration process.
• EnableCreateUserAtLogin: Lines 19–20. If set to "true," new local user accounts will be created automatically after authenticating with Entra ID at the local login screen.
• NewUserAuthorizationMode: Lines 21–22. If creating new users is allowed, set this to one of the following to determine the permission level of the user accounts:
  • Standard
  • Admin
• UserAuthorizationMode: Lines 23–24. This supports the same values as NewUserAuthorizationMode. The permission applies to an account each time the user authenticates.
• TokenToUserMapping: Lines 25–31. If new local users are to be created automatically, this dictionary defines the values from the IdP for the local Account Name and Full Name.
• AccountName: Lines 28–29. The string value listed in the template represents the first name of the assigned owner of the device (example: preferred_username).
• FullName: Lines 30–31. The string values listed in the template represent the first and last names of the assigned owner of the device (example: name).

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>ScreenLockedBehavior</key>
            <string>DoNotHandle</string>
            <key>RegistrationToken</key>
            <string>${device.id}</string>
            <key>PlatformSSO</key>
            <dict>
                <key>AuthenticationMethod</key>
                <string>UserSecureEnclaveKey</string>
                <key>AccountDisplayName</key>
                <string>Entra ID</string>
                <key>EnableAuthorization</key>
                <true />
                <key>EnableCreateUserAtLogin</key>
                <false />
                <key>NewUserAuthorizationMode</key>
                <string>Standard</string>
                <key>UserAuthorizationMode</key>
                <string>Standard</string>
                <key>TokenToUserMapping</key>
                <dict>
                    <key>AccountName</key>
                    <string>preferred_username</string>
                    <key>FullName</key>
                    <string>name</string>
                </dict>
                <key>UseSharedDeviceKeys</key>
                <true />
            </dict>
            <key>ExtensionData</key>
            <dict>
                <key>AppPrefixAllowList</key>
                <string>com.microsoft.,com.apple.</string>
                <key>browser_sso_interaction_needed</key>
                <integer>1</integer>
                <key>disable_explicit_app_prompt</key>
                <integer>1</integer>
            </dict>
            <key>TeamIdentifier</key>
            <string>UBF8T346G9</string>
            <key>ExtensionIdentifier</key>
            <string>com.microsoft.CompanyPortalMac.ssoextension</string>
            <key>Type</key>
            <string>Redirect</string>
            <key>URLs</key>
            <array>
                <string>https://login.microsoftonline.com</string>
                <string>https://login.microsoft.com</string>
                <string>https://sts.windows.net</string>
                <string>https://login.partner.microsoftonline.cn</string>
                <string>https://login.chinacloudapi.cn</string>
                <string>https://login.microsoftonline.us</string>
                <string>https://login-us.microsoftonline.com</string>
            </array>
            <key>PayloadIdentifier</key>
            <string>56DD5560-5BFF-41E5-8197-939FB3374BA3</string>
            <key>PayloadType</key>
            <string>com.apple.extensiblesso</string>
            <key>PayloadUUID</key>
            <string>56DD5560-5BFF-41E5-8197-939FB3374BA3</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Microsoft PSSO</string>
    <key>PayloadIdentifier</key>
    <string>Microsoft.PSSO-EAE14F52-5119-4CF3-AACE-EA485054A4FD</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>EAE14F52-5119-4CF3-AACE-EA485054A4FD</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

3. Registering with Platform SSO on the device using a Secure Enclave key

To begin this step of the process, the macOS device must be enrolled in NinjaOne MDM. For instructions to do so, refer to NinjaOne MDM: Enrolling macOS Devices.

If you use Automated Device Enrollment (ADE) to enroll the macOS device in NinjaOne MDM, you must set up a local user account and log in to the device. After enrollment, the NinjaOne Agent will automatically deploy, and the Company Portal app will be installed based on your configured automation schedule (Step 1.6 of this article). This may take a few minutes.

Once the MDM profile and Company Portal app have both completed installation, the device's user will receive a notification to register for Platform SSO. If ignored, they will see this notification periodically recur.

The following steps outline the instructions that the user must perform on their device:

1. Click Register. In the dialog, click Continue and follow the prompts to enter the local device administrator credentials.
2. Authenticate with the Entra ID credentials. If required, you may be asked for a second factor of authentication.
3. If Platform SSO is configured to use a Secure Enclave key, you will be asked to allow the Company Portal to use a Passkey. Click Open System Settings, and then activate the passkey as shown in the image.

This completes the Platform SSO registration. The user should now be able to use SSO to authenticate any Microsoft Entra ID login prompt automatically. This authentication will be tied to the local account on the macOS device. When they log in to the local account, it will authorize the subsequent SSO based on the Secure Enclave key.

4. (Optional) Skip the Required Privacy Notice for Microsoft AutoUpdater

Normally, when the Company Portal installs, it also installs the Microsoft AutoUpdater and displays a Require Privacy Notice that the user must acknowledge.

By deploying the following Custom Payload, you can skip the display of this notice. If you are already deploying a Custom Payload to configure Microsoft AutoUpdate, you can include the AcknowledgedDataCollectionPolicy key, with the value set to the string RequiredDataOnly on Lines 8–9:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
	<dict>
		<key>PayloadContent</key>
		<array>
			<dict>
				<key>AcknowledgedDataCollectionPolicy</key>
				<string>RequiredDataOnly</string>
				<key>PayloadType</key>
				<string>com.microsoft.autoupdate2</string>
				<key>PayloadDisplayName</key>
				<string>Microsoft AutoUpdate Settings</string>
				<key>PayloadIdentifier</key>
				<string>0F4CE0C7-22AD-454C-B9FE-FF025EED58EF</string>
				<key>PayloadUUID</key>
				<string>0F4CE0C7-22AD-454C-B9FE-FF025EED58EF</string>
				<key>PayloadVersion</key>
				<integer>1</integer>
			</dict>
		</array>
		<key>PayloadDisplayName</key>
		<string>Microsoft AutoUpdate Settings</string>
		<key>PayloadIdentifier</key>
		<string>CB4A399D-1CCF-458C-A192-AD1066F7E7B6</string>
		<key>PayloadUUID</key>
		<string>CB4A399D-1CCF-458C-A192-AD1066F7E7B6</string>
		<key>PayloadType</key>
		<string>Configuration</string>
		<key>PayloadVersion</key>
		<integer>1</integer>	
	</dict>
</plist>

5. (Optional) Allow Other Users to Log in With Their Entra ID Credentials

If the Platform SSO MDM profile is configured with EnableCreateUserAtLogin set to "true," then other users will be able to log in to the device using their Entra ID credentials.

From the login page, choose to log in with an "Other…” user, and then enter the Entra ID username and password directly into the fields. The local user account will automatically get created, with the account name and display name populated from the lookup values in the TokenToUserMapping dictionary from the MDM profile.

Notes

• The user will be able to use SSO for Entra ID authentication prompts immediately, but they will still be prompted to complete the Platform SSO registration process. They should complete this once to remove the notifications. Depending on the value of NewUserAuthorizationMode, the account will be created as a standard account or an administrator.
• When screen sharing from another device, ensure you've set When Mirroring or sharing the display to Allow Notifications, or you won't see the dialog that prompts you to register Entra ID.

Additional Resources

Refer to the following resources to learn more about SSO and other identity management services in NinjaOne: Identity Authentication and Management: Resource Catalog.