---
title: "Configuring Platform SSO with Microsoft Entra ID"
slug: "configuring-platform-sso-with-microsoft-entra-id"
updated: 2025-07-22T18:52:37Z
published: 2025-07-22T18:52:37Z
canonical: "support.kandji.io/configuring-platform-sso-with-microsoft-entra-id"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Platform SSO with Microsoft Entra ID

### What is Platform SSO?

Platform SSO is a capability that allows users to sign in to their Mac devices using a hardware-bound key, smart card, or their IdP password. This feature enhances the Microsoft Enterprise SSO plug-in for Apple devices, providing single sign-on for Microsoft Entra ID accounts on macOS 14 and later.

> [!WARNING]
> Platform SSO with Microsoft Entra ID is currently in Preview. For more information, see [Microsoft's macOS Platform Single Sign-on overview](https://learn.microsoft.com/en-us/entra/identity/devices/macos-psso).

### Add and Configure the Company Portal Auto App

To add this Library Item to your Kandji Library, follow the steps outlined in the [Library Overview](/kb/library-overview) article.

1. Assign to your desired [Blueprints](/v1/docs/getting-started-with-assignment-maps). ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0326PM@.png)
2. Set your **Installation Method** to Continuously Enforce.
3. Specify your **Version Enforcement** settings.
4. **Save** your Library Item.

### Add and Configure a Login Window Library Item

To add this Library Item to your Kandji Library, follow the steps outlined in the [Library Overview](/kb/library-overview) article.

1. Give your Login Window Library Item a **Name**.
2. Assign to your desired [Blueprints](/v1/docs/getting-started-with-assignment-maps).

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0302PM@2x.png)
3. Under **User Visibility**, set the radio button for Display username and password fields.
4. **Save** your Library Item.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0305PM.png)

### Add and Configure a Single Sign-on Extension Library Item

To add this Library Item to your Kandji Library, follow the steps outlined in the [Library Overview](/kb/library-overview) article.

1. Give the new Library Item a **Name**.
2. Select Mac as the **Install on** platform.
3. Assign to your desired [Blueprints](/v1/docs/getting-started-with-assignment-maps).

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0305PM@2x.png)
4. Under **Extension type**, select Redirect.
5. For the **Extension identifier**, enter com.microsoft.CompanyPortalMac.ssoextension
6. Paste UBF8T346G9 into the **Team identifier** text box.
7. Paste the following URLs into the **URLs** fields.
  - https://login.microsoftonline.com
  - https://login.microsoft.com
  - https://sts.windows.net
8. Optionally, if using sovereign cloud domains, you will need to include additional URLs.
  - https://login.partner.microsoftonline.cn
  - https://login.chinacloudapi.cn
  - https://login.microsoftonline.us
  - https://login-us.microsoftonline.com

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0305P.png)
9. Toggle the switch for **Platform SSO**.
10. Select your **Authentication Method**. For information on which method to use for your organization, refer to [Microsoft's support article](https://learn.microsoft.com/en-us/mem/intune/configuration/platform-sso-macos#step-1---decide-the-authentication-method).
11. Enable additional optional settings for macOS 15 and later as needed.
12. Set default permissions for **Existing Users**.
13. Set default permissions for **New Users**.
14. Check the box for **Shared Device Keys**.
15. Enable **Allow authorization (with identity provider account)**. This will allow users to interact with system authorization prompts using their Microsoft Entra ID credentials.
16. If you want to automatically create local accounts for users, enable **Allow creation of new users at login**. To create a local account, the device must be connected to the internet at the login screen with FileVault unlocked, and Kandji must have a valid Bootstrap token for that device.

**![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0315PM@2x.png)**
17. If checked, the device UDID and serial number will be included in Platform SSO attestations. Available in macOS 15.4 and later.
18. Enter an **Account display name**.
19. Specify the number of seconds after which to **Require full login**.
20. In the **Token mapping** fields, enter preferred_username for the AccountName, and name for the FullName.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0322PM@2x.png)
21. If desired, configure **Admin Groups**, **Additional Groups**, and **User Groups.**

> [!NOTE]
> Microsoft [currently only supports](https://learn.microsoft.com/en-us/mem/intune/configuration/platform-sso-macos#more-platform-sso-settings-you-can-configure) using static Standard and Admin values for new and existing users.
  - **Admin groups** are groups from Microsoft Entra ID that should have administrator access on the device. These groups are used to grant elevated permissions to specific users
  - **Additional groups** are custom groups you'd like to create in the device's local directory. These groups can be used to organize users and apply specific settings or permissions
  - **User groups** are particularly useful, allowing you to map specific macOS system rights to custom groups created in the local directory. For example, you can use user groups to grant 'sudo' access or manage printer permissions
22. **Save** your configuration