Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs

Jamf Pro can deliver the same Microsoft single sign-on experience as Intune. The Microsoft Enterprise SSO plug-in, which ships inside Company Portal, gives apps and browsers SSO and a device identity for Conditional Access; Platform SSO goes further and ties the Mac's own sign-in to Microsoft Entra ID. In this post I'll build both from Jamf Pro, explain how they interact with Jamf Device Compliance, and show how to verify them. The Intune build is covered in Platform SSO for macOS with Intune, so I won't repeat it.

How it works on a Jamf-managed Mac#

Apple only activates an SSO extension when an MDM pushes its configuration, so Jamf Pro supplies the profile and Company Portal supplies the extension. Microsoft publishes the values for "other MDM services". There are two levels:

• Enterprise SSO plug-in only: a Redirect-type extension for Microsoft's sign-in URLs. Apps built on the Microsoft Authentication Library (MSAL) and Safari get SSO, and the plug-in presents the device identity for device-based Conditional Access.
• Platform SSO: the same payload with Platform SSO enabled. The user registers the Mac with Entra ID from a macOS notification. Depending on the method, they then sign in to the Mac with their Entra password or a smart card, or keep their local password while a Secure Enclave key handles Entra sign-ins.

For Jamf customers this is more than a convenience. From August 2025, Microsoft's rollout makes the Secure Enclave the default store for device identity keys in new Entra registrations, and Microsoft states that managed devices using that storage must also be provisioned with Enterprise SSO or Platform SSO to report their device identity to Entra ID. Jamf also documents Platform SSO as the streamlined path to Device Compliance: if Company Portal is installed and the Mac is in the Device Compliance Applicable group, registering for Platform SSO registers it for compliance too.

Prerequisites#

• Company Portal installed first, as described in deploying Microsoft 365 apps and Company Portal with Jamf Pro. Scope the SSO profile to a smart group of Macs that report Company Portal.app.
• macOS 14 or later. Microsoft's minimum for Platform SSO is macOS 13, but the current Authentication Method setting used below applies to macOS 14 and later.
• Entra device settings that allow your users to join devices, as listed in the Intune guide's prerequisites.
• An authentication method: Secure Enclave key (local password unchanged, phishing-resistant, and knowledge of the local password satisfies multifactor requirements in Conditional Access), Password (the Entra password becomes the local password) or Smart card.
• No TLS inspection of Apple's app-site-association.cdn-apple.com and app-site-association.networking.apple and, for Platform SSO Macs, Microsoft's sign-in URLs.

Step-by-step: build the profile in Jamf Pro#

1. Go to Computers › Configuration Profiles and click New.
2. Select the Single Sign-On Extensions payload, click Add and choose payload type SSO.
3. Enter Extension Identifier com.microsoft.CompanyPortalMac.ssoextension, Team Identifier UBF8T346G9 and Sign-on Type Redirect.
4. Add the URLs https://login.microsoftonline.com, https://login.microsoft.com and https://sts.windows.net. Add the national cloud URLs (.us, .cn) only if you use those clouds. For plug-in only, skip to step 7.
5. Turn on Use Platform SSO and pick the Authentication Method. Turn on Shared Device Keys: Microsoft lists it as Enabled in its recommended Platform SSO settings, while Jamf marks it optional. Create New User at Login and Identity Provider Authorization are optional extras. Set an Account Display Name users will recognise (for example "Contoso Entra ID") and, under User Mapping, Account Name com.apple.PlatformSSO.AccountShortName and Full Name name.
6. Set Authentication when screen is locked to Do not handle. Leave Account Authorization Type and New User Account Type unset if another tool manages admin rights (Jamf Connect privilege elevation, for example): Jamf warns they're re-applied whenever the profile is deployed or updated, and Entra ID doesn't support the Groups option.
7. Under Custom Configuration, upload the plist below. If you use Self Service, com.jamf.management. and com.jamf.selfserviceplus. must be in AppPrefixAllowList or password sync fails.
8. Scope the profile to a test smart group and save. Users get a macOS notification asking them to register; registration creates the device record in Entra ID.

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>AppPrefixAllowList</key>
  <string>com.microsoft.,com.apple.,com.jamf.selfserviceplus.,com.jamf.trust.,com.jamf.management.,com.jamfsoftware.</string>
  <key>browser_sso_interaction_enabled</key>
  <integer>1</integer>
  <key>disable_explicit_app_prompt</key>
  <integer>1</integer>
</dict>
</plist>

Optional: register during Setup Assistant#

Jamf supports Simplified Setup, where new Macs register during Setup Assistant. All required payloads must sit in the same profile, with Enable registration during setup and Create first user during setup turned on; New user creation authentication method chooses how the first account signs in (Password and Smart Card if unset). Registering for Device Compliance during Setup Assistant needs Jamf Pro 11.26.0 or later and a Company Portal version that supports Simplified Setup.

Verify#

sudo profiles show -type configuration | grep -i "CompanyPortalMac.ssoextension"
app-sso platform -s

• The first command finds the extension in the installed profiles; the second should show a completed device and user registration with the login type you chose.
• The Mac appears under Devices in the Microsoft Entra admin center and, with Device Compliance, turns compliant once Jamf's Compliance smart group includes it.
• Browsers: Safari works natively. Chrome needs the Microsoft Single Sign On extension or Chrome 135 or later, Edge needs the user signed in to the browser profile, and Firefox needs its MicrosoftEntraSSO policy.
• A Microsoft 365 sign-in from the Mac shows the device ID in the Entra sign-in log, with no password prompt.

Troubleshooting the failures you'll meet#

The repair steps and AppSSO debug logging in the Intune Platform SSO guide are macOS-level, so they apply here too. If Conditional Access still blocks a registered Mac, see Jamf-managed Mac blocked by Conditional Access. Also running Jamf Connect? Test the combination first: both touch the login window and local password.

References#

• Microsoft Enterprise SSO plug-in for Apple devices (Microsoft Learn)
• Configure Platform SSO for macOS devices in Microsoft Intune (Microsoft Learn)
• Deploying macOS Platform SSO for Microsoft Entra ID with Jamf Pro (Jamf Learning Hub)
• Deploying a Platform Single Sign-on Configuration Profile (Jamf Learning Hub)