+23We're testing Platform SSO with Entra, we can get the Intune machine to login & create new accounts, but it seems to be removing admin rights on the accounts if they were previously enabled (like our local admin account). I recall jamf mentioned something about this being a potential issue - but I haven't found much on how to change the behavior. Does anybody have any recommendations?
Best answer by mschlosser
is the group an AD group or a group on the machine? Like, do I need to create a group on Entra for mac admins. THus far, we've been handling admin access via a script on the machine that elevate to admin for an hour and then removes itself from admin. Probably similar to the Privleges.app mentioned below, but using a couple python scripts.
the group is an AD group, it's not a user group on the machine. the com.jamf.connect.login domain has a key entitled OIDCAdmin and that key contains the AD group which contains all the AD accounts which should be promoted to admin on login or creation. if the account isn't in that group, they are always demoted; gives you a certain place to manage things, an advantage,
+11My current employer is using Jamf Connect for SSO, looking briefly at its config, we were able to set a group that it would pull from extra and if the account was in that group, it would be admin, if it were not; the account is demoted to standard user, even if it were admin prior. Unsure if PSSO has a similar feature, but hopefully it would. I'll be watching this three closely; I've always been curious about PSSO
I believe this is expected behavior when using Entra.
Note: The Groups option is not supported by Microsoft Entra ID at this time.
If you haven't, I would strongly recommend testing out the macOS Privileges application.
+23My current employer is using Jamf Connect for SSO, looking briefly at its config, we were able to set a group that it would pull from extra and if the account was in that group, it would be admin, if it were not; the account is demoted to standard user, even if it were admin prior. Unsure if PSSO has a similar feature, but hopefully it would. I'll be watching this three closely; I've always been curious about PSSO
is the group an AD group or a group on the machine? Like, do I need to create a group on Entra for mac admins. THus far, we've been handling admin access via a script on the machine that elevate to admin for an hour and then removes itself from admin. Probably similar to the Privleges.app mentioned below, but using a couple python scripts.
+11is the group an AD group or a group on the machine? Like, do I need to create a group on Entra for mac admins. THus far, we've been handling admin access via a script on the machine that elevate to admin for an hour and then removes itself from admin. Probably similar to the Privleges.app mentioned below, but using a couple python scripts.
the group is an AD group, it's not a user group on the machine. the com.jamf.connect.login domain has a key entitled OIDCAdmin and that key contains the AD group which contains all the AD accounts which should be promoted to admin on login or creation. if the account isn't in that group, they are always demoted; gives you a certain place to manage things, an advantage,
+23the group is an AD group, it's not a user group on the machine. the com.jamf.connect.login domain has a key entitled OIDCAdmin and that key contains the AD group which contains all the AD accounts which should be promoted to admin on login or creation. if the account isn't in that group, they are always demoted; gives you a certain place to manage things, an advantage,
Thank you for the info. Follow up- what about local admin accounts? do we just do away with them since they will be reverted to standard accounts?
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.