Modern enterprise macOS environments have rapidly transitioned away from traditional Active Directory binding in favor of cloud-native Identity Providers (IdPs) like Microsoft Entra ID (formerly Azure AD). While local account synchronization tools like Jamf Connect or Apple’s Platform SSO handle the initial desktop login, users are still frequently interrupted by secondary authentication prompts when launching Microsoft 365 applications (Word, Excel), opening corporate intranet sites in Safari, or accessing company VPNs. To provide a truly seamless, passwordless experience across the entire operating system, Apple introduced the Extensible Enterprise SSO (XSSO) framework. By deploying Microsoft’s official Enterprise SSO plug-in via MDM, organizations can achieve true Single Sign-On (SSO) on macOS, where a single Entra ID authentication token securely unlocks all native applications and web browsers.
The Architecture of the Enterprise SSO Plug-in
Historically, macOS applications operated in complete isolation. If you logged into Microsoft Teams, the authentication token generated by that application was sequestered in its own secure enclave, inaccessible to Microsoft Outlook or Safari. Users were forced to authenticate repeatedly.
The Extensible Enterprise SSO framework fundamentally alters this security model. Built natively into macOS 10.15 (Catalina) and later, the XSSO framework allows an Identity Provider to install an operating system-level daemon (the plug-in).
Microsoft’s implementation of this daemon (the Microsoft Enterprise SSO plug-in) acts as a centralized Primary Refresh Token (PRT) broker. When a user authenticates to a supported application (like the Company Portal or any MSAL-enabled application), the plug-in securely caches a master Entra ID token in the macOS system keychain. Subsequently, when the user launches Safari to access portal.office.com, Safari recognizes the presence of the XSSO framework, intercepts the authentication request, and silently requests a fresh, scoped access token from the Microsoft plug-in. The user is logged in instantly without seeing a password prompt or an MFA challenge.
Prerequisites for Deployment
Before attempting to deploy the plug-in, ensure your environment meets the strict architectural requirements:
- macOS Version: Target devices must be running macOS 10.15 or later (macOS 13+ recommended for optimal Safari integration).
- MDM Solution: You must utilize an Apple-certified Mobile Device Management (MDM) solution, such as Microsoft Intune, Jamf Pro, or Kandji. The plug-in cannot be configured manually by a user; it must be pushed via a signed MDM configuration profile.
- Company Portal: The Microsoft Intune Company Portal application must be installed on the Mac. The Company Portal actually contains the binary for the SSO plug-in; the MDM profile simply instructs macOS to activate it.
Configuring the SSO Profile in Microsoft Intune
To deploy the plug-in utilizing Microsoft Intune, you must author an Extensible Single Sign-On configuration profile.
- Navigate to the Microsoft Intune admin center (intune.microsoft.com).
- Go to Devices > macOS > Configuration profiles > Create profile.
- Select Templates as the profile type, and choose Features.
- In the profile configuration, expand the Single sign-on app extension section.
- Configure the primary parameters:
- SSO app extension type: Select Microsoft Entra ID.
- App bundle ID:
com.microsoft.CompanyPortalMac.ssoextension(This tells macOS exactly which binary to execute for token brokerage).
Advanced Configuration with Custom Key/Value Pairs
To optimize the user experience, you should inject additional configuration keys into the MDM payload. These keys dictate how the plug-in interacts with non-Microsoft applications.
Under Additional configuration, add the following critical String values:
- Key:
Enable_SSO_On_All_ManagedApps| Type:Integer| Value:1(This allows any application deployed by your MDM to request tokens from the plug-in). - Key:
browser_sso_interaction_enabled| Type:Integer| Value:1(This enables the Safari browser extension required for web-based SSO).
Finally, under URLs, you must explicitly define the cloud endpoints that are authorized to trigger the SSO extension. Enter the standard Entra ID endpoints:
https://login.microsoftonline.comhttps://login.microsoft.comhttps://sts.windows.net
The End-User Experience
Upon assigning the profile to your macOS devices, the MDM syncs the configuration. The next time the user launches a Microsoft application (or any application utilizing the Microsoft Authentication Library), they will be prompted to authenticate. They will input their Entra ID credentials and satisfy any Conditional Access/MFA requirements.
This single authentication event caches the Primary Refresh Token. From that moment forward, any subsequent application launch (Teams, Word, OneDrive) or Safari navigation to a corporate federated resource will occur instantaneously in the background, fulfilling the promise of a frictionless, Zero Trust Mac deployment.