To provide the best user experience, you must understand how Passport interacts with other Library Items, Parameters, macOS Features & Applications
Library Items
Automated Device Enrollment
When using Passport, select Skip primary account creation under Primary account type. That way, when users arrive at the Passport login screen and log in using their IdP credentials, their Mac account will be provisioned.
If you do not skip account creation, users will create an account and then be prompted to migrate that account upon login, resulting in unnecessary steps.
Passcode
When using Passport, remove the Passcode library item from the Blueprint containing Passport. Your IdP should handle password requirements. If passcode requirements set by your IdP are less restrictive than those set by the Passcode library item, it will result in the user being unable to change their password because it doesn't meet the password requirements of the local Mac.
Login Window
The Login Window Library Item contains some items that are compatible with Passport.
Compatible Options
The Set lock message option on the Login Window Libray item is compatible with Passport.
The options listed in the Logged in users section of Login Window Libray item are compatible with Passport.
Incompatible Options
The items in the Menu Bar & User visibility sections of the Login Window Library Item are incompatible with Passport and should be unchecked.
The items in the Options sections of the Login Window Library Item are incompatible with Passport and should be unchecked.
Parameters
Enforce a Custom Policy Banner
If you are using the Enforce a custom policy banner parameter, disable it for any Blueprints containing the Passport library item.
Demote user accounts to Standard
Because Passport sets the User account type, combining this with the Demote user accounts to Standard Parameter will cause reboot loops as users are promoted and demoted. For this reason, you should disable the Demote user accounts to Standard Parameter on any Blueprints that use Passport.
Secure Wi-Fi Settings
Passport requires network connectivity to check user credentials against the IdP. When customizing the login window in Passport, show the network manager so users can join a Wi-Fi network as necessary. The network manager respects AirPort security settings in macOS. You can use the Secure Wi-Fi Settings parameter in Kandji to require local administrator credentials to change networks. If enabled, users will be prompted with a native authentication dialog at the Passport window when switching networks.
To ensure that users can always log in to their Mac computers, Passport will allow them to log in using their IdP credentials when there is no network connectivity.
macOS Features
Migration Assistant
Using Migration Assistant with Passport is not supported. If Migration Assistant was used with Passport, you can follow these steps to resolve the issue. When using migration assistant to migrate data from a device that is enrolled in Kandji, please remove Passport from the device that you are migrating from before attempting a migration. If Passport remains on the device and is migrated to the target device, users may get stuck at the Passport screen and won't be able to proceed.
If you need assistance remediating this situation, please reach out to support.
Managed Apple ID alias
In some situations, a user may be logged in to an Apple ID with an account name that matches the IdP account name. Much like Passport, an alias is created in the local directory to match this Apple ID account name. When the Apple ID matches the IdP account name, a collision can occur that will prevent the user from signing in with the IdP account name.
This collision happens only when the user signs out of the Apple ID. The sign-out process removes the alias for the Apple ID. Since this alias matches the account name used by Passport, it removes the alias for Passport as well.
To resolve this, the alias must be restored. This can be done manually using the Users & Groups pane in System Settings (or System Preferences), the Directory Utility app on the local computer, or by running a script via Kandji to update the account.
Mobile Accounts
Passport is compatible with local macOS accounts. Mobile accounts are unsupported. Before using Passport, convert existing mobile accounts to local accounts for successful account merging.
Applications
Privileges
Because Passport sets the User account type, combining this with the Privileges application will cause reboot loops as users are promoted and demoted. For this reason, you should the Privileges application to Blueprints that use Passport. If Privileges is already deployed, you should uninstall it from your devices before using Passport.