---
title: "Configure Passport with Microsoft Entra ID - Mac Login"
slug: "configure-passport-with-microsoft-entra-id-mac-login"
updated: 2025-06-02T15:45:54Z
published: 2025-06-12T16:42:07Z
canonical: "support.kandji.io/configure-passport-with-microsoft-entra-id-mac-login"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Passport with Microsoft Entra ID - Mac Login

> [!NOTE]
> This article goes over configuring Passport to use Mac login. If you're using MFA, or want to configure Web Login, please see [Configure Passport with Microsoft Entra ID - Web Login](/v1/docs/configure-passport-with-microsoft-entra-id-web-login).

### Before you begin

You will need access to a Microsoft Entra ID admin user account to grant the Passport app the proper permissions.

### Create the App Registration

1. Sign in to the [Microsoft Entra admin center](http://entra.microsoft.com) using a Global Administrator account.
2. Open the portal menu and then select **Identity**.
3. On the **Identity** menu, under **Applications**, select **App registrations**.
4. On the **App registrations** page, select **+ New registration on the menu**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/kefcaoqi3a9cofvccrqtgwwgmehgnlxaka.png)
5. On the **register an application** dialog, enter a name for the new application (such as *Kandji Passport Mac Login*).
6. Choose **Accounts in this organizational directory only**.
7. In the **Redirect URI** section, in the **Select a platform** drop-down, choose **Web**.
8. In the URI field, enter the following, **https://localhost.redirect.**
9. Click **Register**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bqm_zrnllhd_wnz0upvogj7bgjbctxjh5a.png)
10. Open a secure text document where the values for this OIDC app can be temporarily stored. You will need these details when you [configure the Passport Library Item](/v1/docs/configure-the-passport-library-item).
11. On the **Overview** page, copy the **Application (client) ID** to a temporary secure text document.
12. While still on the Overview page, click **Endpoints**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/utw6vmawnqaonbhcgcrbc7mzqt77veowla.png)
13. Copy **OpenID Connect metadata document** (identity provider URL) to a temporary secure text document. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/zn6wti9awjurwd5surhllmbffavbxtrwfq.png)
14. On the left, select **Authentication**.
15. Set **Enable the following mobile and desktop flows** to Yes.
16. Click **Save**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/iwyuay0cau74jpekgnci9nypikk7ym2dtg.png)
17. On the left**,** select **Token configuration**.
18. Click **Add optional claim**.
19. For the Token type, select **ID**.
20. For the Claim, select **preferred_username**.
21. Click **Add**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/nxwyp97nvo9lfnssgglg_0ntxrg9u3trfw.png)
22. While still on the Token configuration page, click **Add groups claim**.
23. Select **All groups**.
  - Entra ID SAML only supports up to 150 security groups. If you have more than 150 security groups, you should not use **All groups**, but rather select specific groups. You can read more in Microsoft’s [Configure group claims for applications by using Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims) article.
24. Click **Add**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/5-ubk5khgjqt0g7xyoidhkoupdvvoqq31q.png)Once you complete the token configurations, you will see both optional claims. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ch5z_mdtrrzcgc3ewz7e6cbdngu5lfbhvg.png)
25. Select **API Permissions**.
26. Click **Add a permission**.
27. Click **Microsoft Graph**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/aczgx1zshwroej264md9udu0g8wltnnjoq.png)
28. Select **Delegated permissions**.
29. Confirm that the **OpenId permissions** section is expanded. If the OpenID permissions section isn't expanded, click the icon next to the OpenId permissions section to expand it.
30. Select **email**.
31. Select **profile**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/o6pdbohbh8htt4rcgofvxfhoxtbtl0pnxg.png)
32. In the **Select permissions** field, enter **User.Read**.
33. In the User section, confirm that **User.Read** is already selected. If **User.Read** isn't selected, select it.
34. Click **Add permissions**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/hj9miuf57szfrg8ri3ixorq5klrpxhbstq.png)
35. While still on the API permissions page, select **Grant admin consent for <your_tenant_name>**.
36. Select **Yes**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/vmuhqy4khuukozabccc7_k9dyawqfav7jg.png)You should see a notification similar to the one below, and you should see a "Granted for <your_tenant_name> ..." message in the Status column next to each permission. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/-fh2gh5fyaitjqtqrcjydy3ufllcapm3ja.png)
37. Continue to the next section**.**

### Assign Users and Groups

> [!NOTE]
> [](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/?WT.mc_id=APC-AzureADConditionalAccess)By default, when you create a new App registration, the "Assignment required?" attribute is set to "No". However, if your Passport Enterprise app is set to require assignment, you will need to follow these steps to assign users in order to be able to use your Passport app.

1. In the Identity navigation menu on the left, open **Applications** and select **Enterprise Applications**.
2. In the All applications list, select **Kandji Passport Mac Login** or whatever name you named the App registration in the previous section. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/wsfsg8ireduwhwfdsvoupxcbalumdexd-w.png)
3. Under **Manage**, select **Properties**.
4. *Optionally,* add a logo to your Enterprise App.
5. Inspect the **Assignment required?** setting. If it is set to "No," then you can skip the rest of this section. All users in Entra ID will be able to use the Passport app.
6. Confirm that the **Visible to users?** setting is set toggled to "No"; otherwise, users will see it in their portal. The Passport app is only useful as a replacement for the macOS login window.
7. Click **Save**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/syn70do46rdenh9d_ev3rcnrkxzduogjug.png)
8. If the **Assignment required?** setting is set to "Yes," proceed with steps 9-16.
9. Under **Manage**, select **Users and Groups**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/jauom-z0acgphtsu21_6bdzsnxux_ooayg.png)
10. On the menu, select + **Add user/group**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ruuoaf_fccyusbowgklaw_gb4od6yicc-w.png)
11. On the **Add Assignment** dialog, select the link under **Users and groups**.
12. A list of users and security groups is displayed. You can search for a specific user or group or select multiple users and groups that appear in the list.
13. After you have selected your users and groups, select **Select**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/kwmcvssnbmswvafmmurbep9qyxqyxjtblq.png)If you see the message below, it means that a free tier is being used. You can only add users (not groups) to the Passport Enterprise App. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6jadr5z7fvl_2zn7roc9op1bm9hfjsq3tq(1).png)
14. Select **Assign** to finish the assignment of users and groups to the app. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/fk-itqxjaj-frz8io5lh4pg0jcnnyjcaqq.png)
15. Confirm that the users and groups you added appear in the **Users and groups** list. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/gjtfw_omr1puozyzse3vuwezqmekerxtpw.png)
16. With this portion of the Entra ID configuration complete, review the remaining sections of this article for your Microsoft Entra ID environment.

### Microsoft Entra ID Conditional Access Considerations

> [!WARNING]
> [Microsoft Entra ID Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/?WT.mc_id=APC-AzureADConditionalAccess) is included with Microsoft Entra ID Premium or better. Be sure to turn off both per-user MFA and Security defaults before you turn on Microsoft Entra ID Conditional Access policies.

**When using the** [**Mac Login Passport Configuration**](/v1/docs/configure-the-passport-library-item#authentication-configuration) **only:** If Entra ID is configured with a Microsoft Entra ID Conditional Access policy that specifies MFA as a requirement and specifies all or specific cloud apps, you'll need to exclude the Enterprise application that you use for Passport from that policy. Another way to describe such a policy is that the policy uses both of these criteria:

- Assignments: Target resources: Cloud apps: **All cloud apps or Select apps**
- Access controls: Grant: Grant access: **Require multifactor authentication**

Here's an example of a policy that you *don't* need to modify because it doesn't use both of the criteria above (specifically, although it has the grant of **Require multifactor authentication**, it doesn't have the assignment for Target resources.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/pt2sdyjwemct8rjytrbqbsxxigrxgzwmlg.png)Here's an example of a policy that you *do* need to modify to exclude the Enterprise application for Kandji Passport because the policy uses both criteria:![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/qjhvq8nl530hpkvyglqwvwmvie9xoi9ztw.png)

For you to exclude the Enterprise application, it needs to have a **Redirect URI value**, as seen in step 8 in the create the app registration section of this article.

#### Add the Cloud App Exclusion

Exclude the Enterprise app you use for Kandji Passport for each applicable policy.

1. In the [Microsoft Entra admin center](http://entra.microsoft.com), open the portal menu and then select **Protection**.
2. On the **Protection** menu, select **Conditional Access**.
3. On the **Conditional Access** page, select **Policies**.
4. Confirm that the portal displays each policy with a **Policy Name** and a **State** (among other information). ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/aztdnzwv5qqlj_js14g0dctygjo7uewcta.png)
5. Select a policy that has the **State** of **On**.
6. If the **Target resources section** displays **No target resources selected**, then return to the previous step and select the next policy. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/taklgvrtwdfih4q4bkv2butugl-voh2ima.png)Otherwise, click the link under **Target resources**.
7. Click **Exclude**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/hiiulua_dxe0gkwlitimfw3i-frlbrrlcw.png)
8. Review the list of excluded cloud apps (there may be no excluded cloud apps). If the Enterprise app for Kandji Passport is already excluded, you can return to step 3 and proceed to the next policy.
9. Click the text link under **Select excluded cloud apps**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/gdcxcnk88xvfftiekkwkf6phw7npokulqw.png)
10. In the **Search** field, enter the name of the Enterprise app you use for Kandji Passport. Note that the search doesn't just search for any part of the name; you need to enter at least the start of the name.
11. Select the checkbox for your Enterprise app for Kandji Passport from the search results.
12. At the bottom of the **Select excluded cloud apps** blade, click **Select**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/lvczyqqwny4sjdylbvcwfihidhkrk5ivla.png)
13. Confirm that the Enterprise app was added to the list of excluded apps. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/lz1pokjpdvzopfapjr4ynjihav7dno5rtq.png)
14. In the lower-left corner of the page, click **Save**.
15. Go back to step 3 and repeat for the next policy until you have examined or updated every Conditional Access policy.

### User Account Provisioning via Passport

> [!NOTE]
> If you use **Specify per identity provider group** option in the Passport Library Item, use the Entra ID group **ObjectID** in the **Identity provider group** field.

The number of security groups supported by Entra is 150 for SAML assertions In larger organizations, the number of groups where a user is a member might exceed the limit that Microsoft Entra ID applies before emitting groups claims in a token. Exceeding this limit will cause Microsoft Entra ID completely omit sending group claims in the token.

1. Sign in to the [Microsoft Entra admin center](http://entra.microsoft.com). In the Identity navigation menu on the left, open **Groups** and select **All groups**.
2. Select the group that you want to use. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/r8fljma5tnrvgk4ypydlsu5nhrhapvk4ya.png)
3. Copy the **Object Id** for that group. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/vtotk8rl8gadg2swdshhkmi5crswi-dstw.png)
4. In the Kandji Passport Library Item, in the User Provisioning section, paste the value from the previous section into the **Identity provider group** field. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/_vums3lo6hb0ytynefggsrk1nhnqpyjlgq.png)
5. Repeat the previous steps for each additional Entra ID group you want to use.
6. In the Passport Library Item, click **Save**.
7. Other Considerations
  - If you set the default account type to standard user, only add administrator account types in the Identity provider groups. Unless otherwise specified as administrators in your Identity provider groups, all users will be created as standard users by default.
  - If you set the default account type to administrators, only add standard account types in the Identity provider groups. All users will be created as administrators by default unless otherwise specified as standard users in your Identity provider groups.

### Microsoft Entra ID Troubleshooting

If you are experiencing issues with Entra ID Passport, please visit our [Passport Troubleshooting with Microsoft Entra ID (formerly Azure AD)](/v1/docs/passport-troubleshooting-with-microsoft-entra-id-formerly-azure-ad) support article to learn more about common troubleshooting steps.

### Next Steps

Please proceed to the [Configure the Passport Library Item support article](/v1/docs/configure-the-passport-library-item) to finalize your setup.