Configuring SSO Login for iOS

Single Sign-On (SSO) technology enables users to log in once and seamlessly access various applications. Especially for iOS devices, the integration of Microsoft SSO offers an efficient solution for combining user-friendliness and security. It not only simplifies everyday work through simplified logins, but also reduces security risks and IT effort. This guide serves as the basis for an SSO configuration with iOS and Microsoft SSO.

Requirements #

Two configurations and one app are required for this in Relution:

• App compliance
• Extensible Single Sign-On
• Microsoft Authenticator app via Apps and Books (VPP in the portal)

Configuration #

Both configurations are created under Devices → Policies in an iOS policy via Add Configuration. The Extensible Single Sign-On configuration is also available for devices enrolled via User Enrollment →.

App compliance #

In the App compliance configuration, the Microsoft Authenticator app → is added to the Required apps list. The app contains the extension com.microsoft.azureauthenticator.ssoextension required for Microsoft SSO.

Adding the app to the list on its own only checks whether it is installed; if it is missing, the device is considered noncompliant. The app is only installed if the checkbox in the Auto install column is selected (selected by default when an app is added). This requires device-based licenses for the app from Apps and Books. On supervised devices, the app is installed without user interaction. Further details are described in the App compliance → article.

Extensible Single Sign-On #

The following configuration points can be used as a minimally functional template for Microsoft SSO. Points not mentioned can be left as default. The final configuration must be adapted to the specific environment.

• Extension Identifier

  • com.microsoft.azureauthenticator.ssoextension

• Type

  • Redirect

• URLs

  • https://login.microsoftonline.us
  • https://login.microsoftonline.com
  • https://login-us.microsoftonline.com
  • https://login.microsoft.com
  • https://login.partner.microsoftonline.cn
  • https://sts.windows.net

In new configurations, Type is set to Credentials. The URLs field only appears after switching to Redirect and must then contain at least one entry. The Team Identifier field is not mandatory on iOS and can be left empty. Further settings of the Microsoft SSO extension can be stored as key-value pairs in the Extension data section if required; Microsoft describes the available keys in its documentation on the Enterprise SSO plug-in.

User Interaction #

Once the configuration is complete and assigned to the devices, users can log in to a Microsoft service in the browser, such as Outlook, or in a Microsoft app, such as Teams, and are then automatically logged in to all other compatible apps.