Microsoft Enterprise SSO plug-in for Apple devices

n_lecchi
New Contributor III

I'm testing this MS plug-in for SSO

It works fine with Safari, but I'm not able to use it with Desktop-Apps like Office 365 ones.

Anyone have experience in SSO in Office 365 apps?

32 REPLIES 32

Tribruin
Contributor III
Contributor III

I have added all the O365 apps to the AppAllowList custom setting. Here is my custom setting PLIST that i add to the SSO Profile:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>AppAllowList</key>
    <string>com.microsoft.Outlook,com.microsoft.teams,com.microsoft.OneDrive,com.microsoft.Word,com.microsoft.Excel,com.microsoft.Powerpoint,com.microsoft.onenote.mac,com.jamfsoftware.selfservice.mac</string>
    <key>browser_sso_interaction_enabled</key>
    <integer>1</integer>
    <key>disable_explicit_app_prompt</key>
    <integer>1</integer>
</dict>
</plist>

I don't think OneDrive is working yet, but it seems like all the other Apps pickup on the SSO credentials.

What will be the plist name ? 

n_lecchi
New Contributor III

RBlount, does it work well for you? In my tests, Office apps still require authentication.

nelsoni
Contributor II

I tested the plist in my environment, it does in fact work, but the results are not consistent. A mac with a fresh setup worked out of the box but my daily driver was inconsistent.

jmariani
Contributor

Does one need to be signed into the Intune Company Portal for this to get applied properly?

Tribruin
Contributor III
Contributor III

I find it hit or miss. Some apps seem to work better than other (Teams & Jamf Self Service seem to pick up the user better than the other Microsoft Apps.)

Is seems that when I was testing it a few months ago, it seemed to work better. I don't know if Apple changed something or Microsoft did.

I guess that is why Microsoft still considers it to be in Beta Preview.

n_lecchi
New Contributor III
Does one need to be signed into the Intune Company Portal for this to get applied properly?

yes you need to log-in Intune company portal, too

vinu_thankachan
New Contributor III

I am also testing the Company portal SSO-E It's working with safari, office 0365 apps, and Skype for Business. Currently, Microsoft EDGE is not supporting SSO.

n_lecchi
New Contributor III

Hi Vinu, I am surprised you SSO works Office 365. For me it works only for Safari. When i launch word, excel or PP, it require me another authentication for license.
Can you share configuration you are usings?

I am also testing the Company portal SSO-E It's working with safari, office 0365 apps

Hobbs155
Contributor

Are you using Hybrid or pure Azure? We have been trying to just get it to work but we have failed.
azure-ad-and-seemless-single-sign-on

n_lecchi
New Contributor III

My Azure is in Hybrid but it does not matter. SSO works with Company Portal Authentication. I enroll the Mac with a test user different to the Azure one, than I authenticate in Company Portal that generate a token for SSO that in my case works but only with Safari and WebApps. Desktop Office Apps require another authentication for assign license. I need to solve this part.

Are you using Hybrid or pure Azure

nelsoni
Contributor II

To clarify, from my testing I have found that the Mac does not need to be enrolled into Intune for it to work, just that the company portal is installed. The SSO will work from there.

n_lecchi
New Contributor III

Yes, it's right

To clarify, from my testing I have found that the Mac does not need to be enrolled into Intune for it to work, just that the company portal is installed. The SSO will work from there.

n_lecchi
New Contributor III

Can anyone who managed authenticateìion with SSO into the Office 365 app share the correct configuration?

ali_fadavinia
New Contributor II

We are experiencing the same issue as the original poster.

If any one has any tips? what we are seeing it works with Safari and MS Teams only but not Office apps: Outlook, Excel and OneDrive,etc.

@ vinu.thankachan Could you tell us or share some more info how did you fix it and get that working please?

vinu_thankachan
New Contributor III

Hi ,
Sharing my configuration
54584e54698043478a3bc26a52741b2d
cebf1dbd663a422dae86a5b2a12ae472

n_lecchi
New Contributor III

@ vinu.thankachan: this configuration enable you to single sign on in office? I seem strange: Are you sure you have not authentication in keychain?

ali_fadavinia
New Contributor II

Thanks for providing the info Vinu,

We have exactly the same configuration, as I said it works fine with Teams and Safari but not Office Apps

Karl941
New Contributor III

I confirm as well, Safari and Teams are fine but not other MS office Apps.

ali_fadavinia
New Contributor II

One thing I thought to throw it here, ask and clarify with everyone: @Karl941 @n.lecchi @vinu.thankachan

1) How are you all installing office? 2) Are you using the app store, or are you installing via .pkg? 3) Do you think it matters? but Teams is installed for us through the Office .pkg; if it was a .pkg issue, then it shouldn't work for any of the apps.

What are your thoughts?

n_lecchi
New Contributor III

I think it doesn't matter. The app installation can take place via .pkg or the App Store but activation takes place via the web, so the user must be authenticated on the O365 portal to do so.

The question is, can you pass SSO in any way? According to my test no, and the MS documentation seems to copy it. So I'm surprised someone can do it and I can't figure out how.

Karl941
New Contributor III

@ali.fadavinia I have seen in the past slightly differences from deploying through PKG or Appstore push. So to validate, I did a test with Word from Appstore deploy and It's the same results as PKG, no matter the installation type, the app. is prompting to authenticate and don't transit through SSOEx. like Teams does
@vinu.thankachan Can you confirm it works (or not) for you if the Keychain and cookies are cleared ? Thanks.

vinu_thankachan
New Contributor III

Sharing my experiance with Ms teams When I open teams for the first time, I get a prompt to choose the account. once I chose the account , Teams loads automatically 8290cfb7014948d4a8f46e1b01407e9e

8044b367041e497f8bcdc32e8c14cc41

b6e421f8767341d98c9a21dfc6ce57ab

Karl941
New Contributor III

@vinu.thankachan Thanks, however what we would like to validate it's the other MS apps (like Word, PPT or Excel), are you prompted from these ones or not?

GabeShack
Valued Contributor II

@pbowden Wondering if you had any info on this or if there is someone else from Microsoft who could comment on this thread?

Gabe Shackney
Princeton Public Schools

Gabe Shackney
Princeton Public Schools

Scott_Conway
New Contributor II

Did anyone ever figure this out? We are getting the same experience. SSO extension is configured and works with Microsoft websites, but the individual Office apps do not pick up the credentials, hence forcing us to sign into the apps manually. Teams is the only app that is close (it shows us the account selection, same as the screenshot above from @vinu.thankachan )

GabeShack
Valued Contributor II

Ive started playing with this microsoft SSO as well.  Im looking to get the Adobe Creative Cloud app to recognize it too.

My overall goal would be when our students or faculty login to a machine for the first time, they setup the managed Apple ID for iCloud that we have using federated accounts which is the first thing that prompts for a microsoft login.  Im hoping to utilize that login to provide all the credentials for the rest of the apps.  So during the initial setup assistant, having it use this Microsoft SSO piece to have one login to rule them all!

Im trying to get the bundle ID of the setup assistant and I guess what the url is that apple is using for the login for federated apple ID with microsoft.  I did notice that the Microsoft Apps all register though.  I'm using the installer from macadmins.software and using some forced settings with a config profile for our Microsoft apps though.  Im hoping if i can trigger the sso window during that iCloud setup, that we would not need to use any other logins after that.

 

Gabe Shackney
Princeton Public Schools

GabeShack
Valued Contributor II

So I got this to work using com.apple.SetupAssistant in the plist and then the iCloud login allowed me to use the sso plug in.  Its not quite right though because underneath the SSO initial login, is the normal federated login, so its making us type it twice.  After that though when I went into the machine, Safari was already logged in and Zoom was already logged in, however Word still asked for a login name/email and didn't show the drop down list.  Once I typed the email address in though it didn't prompt for a password, just had the drop down list with the account already there.

Also I'm trying to get adobe creative cloud to use this, but I think their app isn't built correctly since I can see the Microsoft SSO plugin version pop for a split second before it triggers the normal federated login.

Gabe Shackney
Princeton Public Schools

Jamftechelp
New Contributor II

The attached plist is working SSO for Word, PPT, Excel, Outlook, Safari, Teams, and zscaler but it's not working for Chrome, Firefox, and Edge when I signed in Company Portal App.

Does anyone suggest how to achieve SSO for chrome, Firefox, and Edge?

 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>AppAllowList</key> 
 <string>com.microsoft.Outlook,com.microsoft.teams,com.microsoft.OneDrive,com.microsoft.Word,com.microsoft.Excel,com.microsoft.Powerpoint,com.microsoft.onenote.mac,com.zscaler.Zscaler,</string>
    <key>browser_sso_interaction_enabled</key>
    <integer>1</integer>
    <key>disable_explicit_app_prompt</key>
    <integer>1</integer>
</dict>
</plist>

 

n_lecchi
New Contributor III

What is the name of this .plist?

thanks

R_C
New Contributor III

Im having issues with SSO and Safari.

When trying to access myapplications.azure.us it just will not redirect to login.microsoftonline.us and just sits on a white page.

If I go directly to login.microsoftonline.us in Safari then the SSO appears to work and login without issue.

I also tested with the plist above to no avail.

Test system is macOS 11.6.

Anyone else experience similar issues?

Scott_Conway
New Contributor II

We have also been unable to get any version of the plist working for the SSO on the apps themselves.  We had opened a ticket with Microsoft about this and they mentioned that there is a known bug with Azure tokens and the Mac office apps, but the details were a little hazy.  They claimed a fix was on the way in October, but I don't have the fullest confidence.

The only place SSO is working for us is on the Microsoft websites.