macOS + Intune with Platform SSO

Last time I was asked to implement Platform SSO for macOS devices which will be working together with Microsoft Intune.

As we know, Microsoft is working on that and progress about that can be checked on that page: In development – Microsoft Intune | Microsoft Learn


IMPORTANT UPDATE

I did a mistake in Team Identifier. Now in the post is proper. Please by aware about this change.

I’m sorry for my mistake.


But it is already working properly and in this post, I will show you – how to implement that feature!

First requirement is to deploy proper version of Company Portal. You can do that via the package or via the… script. For me, option with scripts works perfectly and it is always the latest version with auto update enabled.

If you want to read more about this script – you can check this link to see how to implement it:

https://github.com/microsoft/shell-intune-samples/tree/master/macOS/Apps/Company%20Portal?wt.mc_id=WDIT-MVP-5005003

macOS + Intune with Platform SSO

When Company Porta is configured, you need to configure a proper Settings Catalog with options:

SectionSetting/Option
Authentication
Extensible Single Sign On (SSO)Configure an app extension that enables single sign-on (SSO) for devices.
Authentication Method (Deprecated)Password
Screen Locked BehaviorDo Not Handle
Registration Token{{DEVICEREGISTRATION}}
Platform SSO
Account Display NameYour display Name
Authentication MethodPassword
Enable AuthorizationEnabled
Enable Create User at LoginEnabled
New User Authorization ModeStandard
Use Shared Device KeysEnabled
User Authorization ModeStandard
Team IdentifierUBF8T346G9
Extension Identifiercom.microsoft.CompanyPortalMac.ssoextension
TypeRedirect
URLshttps://login.microsoftonline.com
https://login.microsoft.com
https://sts.windows.net
https://login.partner.microsoftonline.cn
https://login.chinacloudapi.cn
https://login.microsoftonline.us
https://login-us.microsoftonline.com

That settings works fine for me:

macOS + Intune with Platform SSO

Now you need to assign that Configuration profile to the ADE devices… and wait for the popup on the end-user device. Sometimes – user need to open Company Portal application and the popup appear.

macOS + Intune with Platform SSO

Next step is to select proper account:

macOS + Intune with Platform SSO

Wait for the next steps…

macOS + Intune with Platform SSO

Provide a password for the Entra ID account:

macOS + Intune with Platform SSO

And finally – end-user should see that:

macOS + Intune with Platform SSO

Happy testing!

Platform SSO works as excepted!

Jakub Piesik

Jakub Piesik

Microsoft 365 Consultant

I’m writing not only about Intune and Windows 365. I’m writing about everything what I leared previously and want to share with you!

#security #microsoft365 #intune #windows365 #powershell #automation 🙂