Tutorial: Azure Active Directory Single Sign-On (SSO) Integration with Jamf Pro - Microsoft Entra (2023)

In this tutorial, you'll learn how to integrate Jamf Pro with Azure Active Directory (Azure AD). When you integrate Jamf Pro with Azure AD, you can:

• Use Azure AD to control who has access to Jamf Pro.
• Automatically signs users into Jamf Pro using their Azure AD account.
• Manage your account in one central place: the Azure portal.

prerequisites

To get started, you need the following items:

• Azure AD subscription. If you don't have a subscription, you can getfree account.
• A Jamf Pro subscription with single sign-on (SSO) enabled.

scene description

In this tutorial, you will configure and test Azure AD SSO in a test environment.

• Jamf Pro supportSP initiatedandIdP initiatedsign in.

Add Jamf Pro from the library

To configure the integration of Jamf Pro with Azure AD, you need to add Jamf Pro from the gallery to the list of managed SaaS apps.

1. Sign in to the Azure portal with your work or school account or your personal Microsoft account.
2. In the left pane, selectAzure Active DirectoryServe.
3. goEnterprise application, and selectall applications.
4. To add a new application, select thenew application.
5. insideadd from gallerysection, enterJamf Proin the search box.
6. chooseJamf ProFrom the resulting panel, then Add Application. Wait a few seconds for the application to be added to your tenant.

Alternatively, you can useEnterprise Application Configuration Wizard.In this wizard, you can add the application to the tenant, add users/groups to the application, assign roles, and complete the SSO configuration.Learn more about the Microsoft 365 wizard.

Configure and test SSO for Jamf Pro in Azure AD

Configure and test Azure AD SSO with Jamf Pro using a test user named B.Simon. For SSO to work, you need to have a link relationship between the Azure AD user and the related user in Jamf Pro.

In this section, you will configure and test Azure AD SSO using Jamf Pro.

1. Configure SSO in Azure ADso that your users can use this functionality.
   1. Create an Azure AD test userTest Azure AD SSO with B.Simon account.
   2. Assign an Azure AD test userThis allows B.Simon to use SSO in Azure AD.
2. Configure SSO in Jamf ProConfigure SSO settings on the application side.
   1. Create a Jamf Pro test userHave a copy of B.Simon in Jamf Pro that is linked to the user's Azure AD representation.
3. Test the SSO configurationVerify that the configuration is valid.

Configure SSO in Azure AD

In this section, you will enable Azure AD SSO in the Azure portal.

1. In the Azure portal,Jamf ProApplication Integration page, findmanagesection and selectsign in.

2. existChoose a single sign-on methodpage, selectSAML.

3. existSet up single sign-on using SAMLpage, select the pencil iconBasic SAML configurationEdit settings.

   

4. existBasic SAML configurationsection, if you want to configure the applicationIdP initiatedmode, enter values ​​for the following fields:

   a. insideidentifiertext box, enter the URL using the following formula:https://.jamfcloud.com/saml/metadata

   b.insidereply urltext box, enter the URL using the following formula:https://.jamfcloud.com/saml/SSO

5. chooseSet additional URLs.if you want to configure the applicationSP initiatedmode, inLogin URLtext box, enter the URL using the following formula:https://.jamfcloud.com

   notes

   These values ​​are not real. Update these values ​​with the actual Identifier, Reply URL, and Login URL. You will start fromsign insection in the Jamf Pro portal, which is explained later in this tutorial. You can extract the actual subdomain value from the identifier value and use that subdomain information as your login URL and reply URL. You can also refer to the formula shown in the figureBasic SAML configurationsection in the Azure portal.

   See Also

   Join a Windows Server VM to an Azure AD Domain Services managed domainTutorial #3: Experiment and Train a Model Using Features (Preview) - Azure ML Managed Feature Store - BasicsAzure AD Connect: Single Sign-On with SAML 2.0 Identity Provider - Azure - Microsoft Entra

6. existSet up single sign-on using SAMLpage, go toSAML Signing Certificatesection, selectcopycopy buttonApp syndication metadata URL, and save it to your computer.

   

Create an Azure AD test user

In this section, you will create a test user named B.Simon in the Azure portal.

1. In the left pane of the Azure portal, selectAzure Active Directory, chooseuser, and selectall users.
2. choosenew userat the top of the screen.
3. insideuserproperties, follow these steps:
   1. insideNamefield, enterSimon.
   2. insideusernamefield, enter [name]@[company domain].[extension]. For example,B.Simon@contoso.com.
   3. chooseshow passwordcheckbox, then make a note of thepasswordBox.
   4. choosecreate.

Assign an Azure AD test user

In this section, you give B.Simon access to Jamf Pro.

1. In the Azure portal, selectEnterprise application, and selectall applications.
2. In the list of applications, chooseJamf Pro.
3. On the app's overview page, find themanagesection and selectusers and groups.
4. chooseAdd user, and selectusers and groupsinsideadd homeworkdialog box.
5. insideusers and groupsdialog box, selectSimonfrom the list of users, then choosechoosebutton at the bottom of the screen.
6. If you wish to assign a role to a user, you can do so from thechoose a rolefall. If no roles have been set for this application, you will see the Default Access role selected.
7. insideadd homeworkdialog box, selectdistributebutton.

Configure SSO in Jamf Pro

1. For automatic configuration in Jamf Pro, installMy App Secure Login Browser Extensionby choosinginstall extension.

   

2. After adding the extension to your browser, selectSet up Jamf Pro.When the Jamf Pro application opens, provide administrator credentials to log in. The browser extension will automatically configure the application and perform steps 3 through 7 automatically.

   

3. To set up Jamf Pro manually, open a new web browser window and log in to your Jamf Pro company site as an administrator. Then, perform the following steps.

4. choosesettings iconfrom the top right corner of the page.

   

5. choosesign in.

   

6. existsign inpage, follow the steps below.

   

   a. chooseedit.

   b. to chooseEnable single sign-on authenticationcheckbox.

   c. chooseblueas an optionidentity providerdrop-down menu.

   d. copyentity numbervalue and paste it inIdentifier (Entity ID)fields inBasic SAML configurationsection in the Azure portal.

   notes

   value in usefields to complete the login URL and reply URLBasic SAML configurationsection in the Azure portal.

   e. chooseMetadata URLfromIdentity Provider Metadata Sourcedrop-down menu. In the field that appears, paste theApp Federation metadata URLsValues ​​copied from the Azure portal.

   F. (Optional) Edit the token expiration value or select Disable SAML Token Expiration.

7. On the same page, scroll down touser mappingpart. Then, perform the following steps.

   

   a. chooseName IDoptionsIdentity Provider User Mapping.By default, this option is set toName ID, but you can define custom properties.

   b. to choosee-mailforJamf Pro User Mapping. Jamf Pro maps the SAML attributes sent by the IdP, first by the user and then by the group. When a user tries to access Jamf Pro, Jamf Pro gets information about the user from the identity provider and matches it with all Jamf Pro user accounts. If an incoming user account is not found, Jamf Pro tries to match it by group name.

   c. paste valuehttp://schemas.microsoft.com/ws/2008/06/identity/claims/groupsinsideIdentity provider group attribute namesite.

   d. On the same page, scroll down toSafetysection and selectAllow users to bypass single sign-on authentication.So instead of being redirected to the identity provider login page for authentication, the user can log in directly to Jamf Pro. IdP-initiated SSO authentication and authorization occurs when a user attempts to access Jamf Pro through an identity provider.

   e. choosesave.

Create a Jamf Pro test user

In order for Azure AD users to log in to Jamf Pro, they must be provisioned to Jamf Pro. Configuration in Jamf Pro is a manual task.

To provide a user account, perform the following steps:

1. Log in to your Jamf Pro company site as an administrator.

2. chooseset upicon in the upper right corner of the page.

   

3. chooseJamf Pro User Accounts and Groups.

   

4. choosenew.

   

5. chooseCreate a standard account.

   

6. existnew accountdialog box, perform the following steps:

   

   a. insideusernamefield, enterBritta Simon, the full name of the test user.

   b. Select optionsaccess permission,privilege set, andaccess statusMatch your organization.

   c. insidefull namefield, enterBritta Simon.

   d.insideemail addressfield, enter the email address for Britta Simon's account.

   e. insidepasswordfield, enter the user's password.

   F. insideverify passwordfield, enter the user password again.

   g. choosesave.

Test the SSO configuration

In this section, you will test your Azure AD single sign-on configuration using the following options.

SP initiates:

• clicktest this appin the Azure portal. This will redirect you to the Jamf Pro Sign on URL where you can start the sign in process.

• Go directly to the Jamf Pro login URL and start the login process from there.

Initiated by IDPs:

• clicktest this appIn the Azure Portal, you should be automatically logged into the Jamf Pro that you set up SSO for

You can also test applications in any mode using Microsoft My Apps. When you click on the Jamf Pro tile in My Apps, if configured in SP mode, you will be redirected to the application login page to start the login process, if configured in IDP mode, you should be automatically logged in to Jamf Pro you set up SSO. For more information on My Apps , seeAbout my application.

Next step

Once Jamf Pro is configured, you can enforce session controls, protecting your organization's sensitive data from exfiltration and exfiltration in real time. Session control extends from conditional access.Learn how to enforce session control with Microsoft Defender for Cloud Apps.