Extensible SSO for Microsoft Entra – Addigy

Addigy Identity and Extensible SSO can be leveraged to achieve directory connectivity without needing to bind user accounts to Active Directory.

For an in-depth explanation of the points discussed in this article, as well as a live demo, view our Webinar: Identity Management for macOS: Going Beyond Active Directory

Addigy Identity

Addigy Identity allows end-users to use their Identity Provider (IdP) credentials to create and authenticate into local accounts. To learn more about Addigy Identity, Addigy Identity's End User Experience, and how to configure Addigy Identity with Microsoft Entra view the articles below:

Once Addigy Identity has been configured in the policy you can move on to the step below.

Company Portal App

To use the Microsoft Enterprise SSO plug-in, devices must support and have the Intune Company Portal App installed. The Company Portal App can be added to your policy using Addigy's Prebuilt Apps:

Select the policy.
Navigate to Software > Prebuilt Apps.
Search MS Company Portal.
Click the empty box to the left > Actions > Add to policy
Set App Settings > Assign.

Note: The Company Portal App just needs to be installed on the device and does not need to be accessed by end-users.

Configuring the Extensible SSO Profile

The Extensible SSO profile provides SSO for IdP accounts across all applications/browsers that support the Apple Enterprise SSO feature. The profile extends SSO to applications that don’t yet use IdP libraries and to applications that use OAuth 2, OpenID, Connect, and SAML. To configure and deploy the profile follow the steps below:

Within Catalog navigate to Device Settings.
On the upper right hand side of the page click New.
Scroll down and select Extensible SSO
Configure the profile using the values below:
1. Payload Name: Give the profile a name
2. Extension Identifier: com.microsoft.CompanyPortalMac.ssoextension
3. SSO Type: Redirect
4. Team Identifier: UBF8T346G9
5. URLs
  1. https://login.microsoftonline.com
  2. https://login.microsoft.com
  3. https://sts.windows.net
  4. https://login.partner.microsoftonline.cn
  5. https://login.chinacloudapi.cn
  6. https://login.microsoftonline.de
  7. https://login.microsoftonline.us
  8. https://login-us.microsoftonline.com
6. Extension Data: Microsoft
  1. App Allow List
    1. com.apple.Safari
    2. com.addigy.MacManage
    3. com.microsoft.CompanyPortalMac
    4. com.google.Chrome(required if Chrome is used)
  2. App Prefix Allow List
    1. com.apple.
    2. com.addigy.
    3. com.microsoft.
    4. com.google.(required if Chrome is used)
  3. Browser SSO Interaction Enabled
    1. enabled
Scroll down to the bottom of the page and click Create Profile.
Navigate to your policy > Device Settings > locate your Extensible SSO profile > click the empty box on the left > click Add/Remove > Add to policy.

Once Addigy Identity, the Company Portal App, and the Extensible SSO profile have been configured and added to the policy users will be able to authenticate into their devices via their IdP provider with Addigy Identity. After signing into a Microsoft service via SSO, users will also be authenticated into their other Microsoft services.

A Note on Browser Support

Safari: Safari supports SSOe out of the box on macOS.
Firefox: Firefox needs to be on v132 or higher for native SSOe support.
Chrome: Chrome has an extension to support this function and it may need if you are using Chrome under v135 the extension can be found in this article. Starting with Chrome v135+ the SSOe support is native.