Product Office Hours #5 - Jamf @ Jamf: How we Platform SSO *Q&A in thread*

Dang...what a lineup!!! 

A few primers for our chat tomorrow, from last year’s Jamf Nation User Conference:

• Platform SSO: The Next Frontier for Mac Authentication with Okta & Microsoft Entra
• In the Trenches: Platform SSO, Okta, Connect, and Network Relay at Jamf

I missed this one 😢

🗓️ I’ll be there.

Can’t wait for this session 👍

Good news, it’s on Thursday so you haven’t missed anything yet!

I believe a transcript is also generally shared afterward, but I am planning on going through a demo of our enrollment flow so you’ll want to be there for that!

Oh. You are absolutely right. Too late in Germany. See you tomorrow then. 

Yay, one of my favorite Jamf Dr. Emily’s!

I am trying to sign up for the Microsoft Single Sign-On for Mac preview that Adam Derrick mentioned.

I walked through filling out the first form to join the Microsoft Community and have a few questions.

On step 17 it asks “Which Security Advisors Programs are you interested in joining?” so I selected “Microsoft Entra Advisors”.  Is that the correct one for this preview?

After completely filling out the form, nothing happens.  Is it supposed to send me to a page to create a login or do I need to wait for somebody at Microsoft to approve this and send me an email?  And do I have to wait for that to happen before I fill out the second form?

Product Office Hours Q&A: Jamf at Jamf, How we Platform SSO 

Last week's Product Office Hours covered platform SSO, with Dr. K (Emily Kausalik) Manager, Client Platform Engineering, a.k.a. Jamf @ Jamf) and Adam Derrick (Solutions Engineer) walking through how Jamf's own IT team is rolling it out internally. Here's every question asked during the session, pulled from both the live Q&A and the chat. 

What's the biggest issue with PSSO and Entra on multi-user Mac setups? 
Authenticated Guest Mode is the recommended approach, though it's not perfect. If you need something else, XCreds (built by Tim Perfitt) works similarly to Jamf Connect and is a solid option for shared or lab machines, while PSSO handles your 1:1 devices. If you hit friction here, file feedback with AppleSeed for IT on what the ideal multi-user experience should look like. 

Why does the Secure Enclave flow have 2 sign-in prompts while Password Sync has 3? Secure Enclave key mode drops the one thing Password Sync still needs: an actual password to sync. In Simplified Setup, both modes authenticate the user to the IdP once in Setup Assistant to create the account and register the device. Password Sync then needs a local password value to keep in sync with FileVault and keychain, so the user gets prompted to set and confirm that password as extra steps, pushing the total to 3 prompts. Secure Enclave mode never needs a password value since auth moves to a hardware-backed key plus Touch ID after registration, so it stops at 2. 

If Entra doesn't handle the user-space MDM, do we have to re-enroll the system to get devices into user space? Confirmed, no re-enrollment or wipe needed. Enabling Platform SSO with Entra ID just requires the Company Portal app plus the PSSO configuration profile pushed via Jamf Pro. That registers the device into user space for Entra ID/Conditional Access, on top of the existing MDM enrollment. So it's re-registration with Company Portal, not a full unenroll/re-enroll cycle. 

Does the attended flow still show 3 prompts if you're on Password Sync? Yes, generally 3 prompts, though the timing can differ depending on the workflow (e.g., identity-first vs device first enrollment). 

Would you recommend keeping Jamf Connect when using PSSO with Secure Enclave? Yes. You can use it for privilege elevation, and it's also useful as an informational tool for end users to check hostname, OS version, battery health, and similar details using Custom Actions. 

Can Apple eventually let us unlock a Mac with a numeric PIN, like Windows Hello or iOS? Secure Enclave mode helps move in this direction for authentication generally. Specifically for unlocking FileVault, that's not there yet, but it's a highly requested feature. 

Can we use PSSO in full, not just the extension, alongside Jamf Connect, with Entra ID as the IdP? Yes, with one caveat: the two shouldn't both manage the same password or account. Jamf's guidance is to let Jamf Connect handle local password management and the login window, while Platform SSO runs in Secure Enclave Key mode (not password sync mode) against Entra ID for cloud and app SSO, using a hardware-backed key instead of a synced password. For this to work, Jamf Connect Menu must not have an IdP configured, since doing so makes it try to sync the local password itself, which conflicts with PSSO doing the same job. The one combination to avoid is Jamf Connect alongside PSSO password sync mode, which we explicitly call out as conflicting. 

Is there a way to avoid using Company Portal for PSSO registration? Microsoft is building a dedicated PSSO app for macOS (name still to be finalized), separate from Company Portal, and it's currently in preview. Company Portal will still be required if you're doing device compliance, since that's not what the new app is for. If you want to test it and give Microsoft feedback: join the Microsoft Advisory Community (required for preview access), sign up here, watch the tutorial (MSSO-for-macOS-enrollment-v6.mp4) or check the roadmap hub, and share feedback here. It's preview software, so don't deploy it to production machines yet. 

Having to use Company Portal alongside our own tools confuses our users, who think their Mac is enrolled in Intune rather than Jamf. Any plans to change that? Noted feedback. The thinking behind keeping the new PSSO app separate from Company Portal is partly to help situations like this, specifically for customers who aren't using Intune for management. 

Our network security software (Cisco Umbrella) is blocking SSO registration. Where can I find a list of sites that need a TLS inspection bypass? This is really a question for your identity provider, since it varies by IdP. For Microsoft specifically, they publish site lists and documentation you can check directly. 

Are there improvements coming to local password sync? When an Okta password changes, does the local password update automatically, or do users still need to manually sync it via PSSO or the Kerberos Okta extension? We don't require password rotation internally anymore, so this doesn't come up much for us. On timing: the sync check runs roughly every 4 hours, and re-authentication is required if there's been no IdP app auth in about 18 hours, so most users would get prompted to sync within a day. 

For PSSO Simplified Setup, how fast does a device's compliance status update in Entra? Generally 5 to 10 minutes, though it can drift a bit depending on your Entra/Intune setup. 

How do you convince a technical stakeholder or security team that a Windows Hello style PIN is a sufficient replacement for a traditional password? Security teams are usually already on board with this in principle. What they care about is enforcing strong authentication and pushing as much as possible toward biometrics, since physical presence at the device is arguably one of the most trustworthy signals available. Historically, syncing the local password to the IdP was just an easy way to inherit password complexity requirements. But if you've already got strong controls on how users reach cloud services elsewhere (e.g., trusted access governance), the local Mac password matters a lot less than it used to. Unfortuantely there are some compliance frameworks that haven't fully caught up to this yet, but the industry is heading that way. 

What happens if a failure occurs before account creation during enrollment? Is the process resilient, or does it require a full erase? This answer depends on when the failure happens and what PSSO enrollment workflow is being used (identity-first or device-first), but wiping and trying again is the safest bet.