Extensible SSO on iOS and iPadOS for Microsoft Entra – Addigy

Extensible SSO can be used to provide single sign-on for Microsoft Entra accounts on iOS and iPadOS devices. After everything is deployed and the user signs in successfully, the extension is automatically used to sign in to any other supported app or website.

Requirements

MDM enabled on devices.
iOS and iPadOS 13.0 or later.
Apple Apps configured to deploy the Microsoft Authenticator app.

Microsoft Authenticator App

To use the Microsoft Enterprise SSO plug-in, devices must support and have the Microsoft Authenticator app installed. The Microsoft Authenticator app can be added to your policy using Apple Apps:

Select the policy.
Navigate to Software > Apple Apps.
Search Microsoft Authenticator.
Click the empty box to the left > Actions > Add to policy
Click Confirm.

Note: The Microsoft Authenticator app just needs to be installed on the device and does not need to be accessed by end-users.

Configuring the Extensible SSO Profile

The Extensible SSO profile provides SSO for IdP accounts across all applications/browsers that support the Apple Enterprise SSO feature. To configure and deploy the profile follow the steps below:

Within Catalog navigate to Device Settings.
On the upper right hand side of the page click New.
Scroll down and select Extensible SSO
Configure the profile using the values below:
1. Payload Name: Give the profile a name
2. Extension Identifier: com.microsoft.azureauthenticator.ssoextension
3. Team Identifier: Not required for iPhone and iPad. Leave this field blank.
4. URLs
  1. https://login.microsoftonline.com
  2. https://login.microsoft.com
  3. https://sts.windows.net
  4. https://login.partner.microsoftonline.cn
  5. https://login.chinacloudapi.cn
  6. https://login.microsoftonline.us
  7. https://login-us.microsoftonline.com
5. Extension Data: Microsoft
  1. App Allow List
    1. com.addigy.ios.SelfService
    2. com.google.chrome.ios(required if Chrome is used)
  2. App Prefix Allow List
    1. com.apple.
    2. com.addigy.
    3. com.microsoft.
    4. com.google.(required if Chrome is used)
  3. Browser SSO Interaction Enabled
    1. enabled
6. Scroll down to the bottom of the page and click Create Profile.
7. Navigate to your policy > Device Settings > locate your Extensible SSO profile > click the empty box on the left > click Add/Remove > Add to policy.

For more details you can visit Microsoft's documentation on Extensible SSO for iOS and iPadOS devices.

Note: You can test single sign-on by opening Safari in private mode and opening the https://portal.office.com site. No username and password are required.