Configuring Addigy Identity with Microsoft Entra lets end users log into their macOS devices using their existing Entra credentials — no separate local password to manage or reset. See the Addigy Identity Overview for more on what Addigy Identity does.
Note: Identity currently supports Microsoft Entra cloud-only implementations and select Hybrid configurations, including Hybrid identity with Password Hash Synchronization (PHS) or Pass-Through Authentication (PTA). Microsoft Entra Federation Services (formerly ADFS) is not supported. See What Is Hybrid Identity With Microsoft Entra ID? for details on supported Hybrid configurations.
How to Enable Addigy Identity
- Navigate to Account > Integrations > Addigy Add-ons.
- Click Addigy Identity and toggle on Enabled in the top right. Once enabled, you'll see a green outline and checkmark.
How to Select Entra as Your Identity Provider
- Navigate to Policies > Integrations & Settings > Identity.
- Select Microsoft.
- The Tenant ID, Client ID, and Client Secret fields appear — you'll fill these in once you've registered an application in Entra (below).
Note: The Client Secret is only required if your Microsoft Entra application is registered as "Web."
How to Register an Application in Microsoft Entra
Note: This application requires
user.readpermissions for Addigy Identity to work properly.
- Navigate to the Microsoft Entra portal homepage.
- Select App Registrations.
- Select New Registration in the top left.
- Choose a name for the app registration.
- Choose the Supported account types option that best fits your organization.
- Choose either Web (required to use MFA) or Public Client/Native, and add the following Redirect URI:
https://login.microsoftonline.com/common/oauth2/nativeclient - Select Register.
- You'll be redirected to the application's home page, where you can see its Client ID and Tenant ID. Note both — you'll need them later.
- Select API Permissions from the left navigation, then select Grant admin consent for [exampledomain].ad.
Note: If Conditional Access is configured, verify that the Device.Read.All permission is also granted admin consent — device registration can fail without it. - If you registered the application as "Web," generate a client secret in the Certificates & Secrets section, and note its expiration date since it will need to be renewed. Don't generate a client secret if you registered as "Public client/native."
Note: Use the client secret's VALUE, not its Secret ID.
How to Finalize Addigy Identity Configuration
- Back in Addigy, enter the Tenant ID, Client ID, and Client Secret (if your Entra application is registered as "Web").
How to Customize Addigy Identity
Enable or disable the available settings to customize how Addigy Identity behaves.
See the Addigy Identity Overview for how each setting affects the end-user experience.
Collect User Attribute Data
Enable this setting to collect user attribute data.
To configure which attributes are collected, see Addigy Identity User Attributes for Entra.
Login Window Theme
Customize the login window's theme by uploading a background image and logo.
Scroll to the bottom of the page and click Save Changes. Once saved and the policy deploys, Addigy Identity installs on end-user devices. After the user reboots their device, they can authenticate seamlessly with their organizational email and password. See Addigy Identity End User Experience for how this appears to end users.
Branding the Sign-In Page
Microsoft lets you customize the sign-in form's logo and colors to match your organization's branding. See Microsoft's article on Branding your Entra sign-in page. Any changes made in your Microsoft Entra settings are also reflected in Addigy Identity's sign-in web view.
Frequently Asked Questions
Do I need a client secret for my application registration?
Only if you registered the application as "Web." If you registered it as "Public client/native," you should not generate or use a client secret.
Is Microsoft Entra Federation Services (ADFS) supported?
No. Addigy Identity supports Entra cloud-only implementations and select Hybrid configurations (Password Hash Synchronization or Pass-Through Authentication), but not Federation Services.
My device registration is failing with Conditional Access enabled — what should I check?
Confirm that the Device.Read.All permission has been granted admin consent in API Permissions, in addition to the required user.read permission. Device registration can fail if this permission isn't granted.