This guide applies to Mac computers
This article goes over configuring Passport to use Mac login. If you’re using MFA, or want to configure Web Login, please see Configure Passport with Microsoft Entra ID - Web Login.
About Passport with Microsoft Entra ID Mac Login
Passport with Microsoft Entra ID Mac Login enables users to log into Mac computers using their Microsoft Entra ID credentials through a standard username/password interface. This method is ideal for environments without multi-factor authentication requirements.How It Works
Passport integrates with your Microsoft Entra ID tenant to authenticate users at the macOS login screen using standard username and password fields. When users enter their Entra ID credentials, Passport verifies them against your tenant and creates or updates the local Mac user account.Prerequisites
- Access to a Microsoft Entra ID admin user account to grant the Passport app the proper permissions
Create the App Registration
1
Sign in to Microsoft Entra admin center
Sign in to the Microsoft Entra admin center using a Global Administrator account.
2
Navigate to Identity
Open the portal menu and then select Identity.
3
Access App registrations
On the Identity menu, under Applications, select App registrations.
4
Start new registration
On the App registrations page, select + New registration on the menu.
5
Configure application details
On the register an application dialog, enter a name for the new application (such as “Iru Passport Mac Login”).
6
Set account type
Choose Accounts in this organizational directory only.
7
Configure redirect URI
In the Redirect URI section, in the Select a platform drop-down, choose Web.
8
Enter redirect URI
In the URI field, enter the following:
https://localhost.redirect.9
Complete registration
Click Register.
Configure Application Details
1
Prepare secure document
Open a secure text document where the values for this OIDC app can be temporarily stored. You will need these details when you configure the Passport Library Item.
2
Copy Application ID
On the Overview page, copy the Application (client) ID to a temporary secure text document.
3
Access endpoints
While still on the Overview page, click Endpoints.
4
Copy metadata document
Copy OpenID Connect metadata document(identity provider URL) to a temporary secure text document.
5
Access Authentication settings
On the left, select Authentication.
6
Enable mobile and desktop flows
Set Enable the following mobile and desktop flows to Yes.
7
Save authentication settings
Click Save.
8
Access Token configuration
On the left, select Token configuration.
9
Add optional claim
Click Add optional claim.
10
Configure token type
For the Token type, select ID.
11
Select claim
For the Claim, select preferred_username.
12
Add the claim
Click Add.
13
Add groups claim
While still on the Token configuration page, click Add groups claim.
14
Select groups
Select All groups.
Entra ID SAML only supports up to 150 security groups. If you have more than 150 security groups, you should not use All groups, but rather select specific groups. You can read more in Microsoft’s Configure group claims for applications by using Microsoft Entra ID article.
15
Add groups claim
Click Add.
Configure API Permissions
1
Access API Permissions
Select API Permissions.
2
Add permission
Click Add a permission.
3
Select Microsoft Graph
Click Microsoft Graph.
4
Select delegated permissions
Select Delegated permissions.
5
Expand OpenID permissions
Confirm that the OpenId permissions section is expanded. If the OpenID permissions section isn’t expanded, click the icon next to the OpenId permissions section to expand it.
6
Select email permission
Select email.
7
Select profile permission
Select profile.
8
Search for User.Read permission
In the Select permissions field, enter User.Read.
9
Confirm User.Read selection
In the User section, confirm that User.Read is already selected. If User.Read isn’t selected, select it.
10
Add permissions
Click Add permissions.
11
Grant admin consent
While still on the API permissions page, select Grant admin consent for <your_tenant_name>.
12
Confirm admin consent
Select Yes.
Assign Users and Groups
By default, when you create a new App registration, the “Assignment required?” attribute is set to “No”. However, if your Passport Enterprise app is set to require assignment, you will need to follow these steps to assign users in order to be able to use your Passport app.
1
Access Enterprise Applications
In the Identity navigation menu on the left, open Applications and select Enterprise Applications.
2
Select your Passport app
In the All applications list, select Iru Passport Mac Login or whatever name you named the App registration in the previous section.
3
4
Access Properties
Under Manage, select Properties.
5
Add logo (optional)
Optionally, add a logo to your Enterprise App.
6
Check assignment requirement
Inspect the Assignment required? setting. If it is set to “No,” then you can skip the rest of this section. All users in Entra ID will be able to use the Passport app.
7
Configure visibility
Confirm that the Visible to users? setting is set toggled to “No”; otherwise, users will see it in their portal. The Passport app is only useful as a replacement for the macOS login window.
8
Save properties
Click Save.
Assign Users and Groups (If Required)
If the Assignment required? setting is set to “Yes,” proceed with the following steps.
1
Access Users and Groups
Under Manage, select Users and Groups.
2
3
Add user or group
On the menu, select + Add user/group.
4
5
Select users and groups
On the Add Assignment dialog, select the link under Users and groups.
6
Choose users and groups
A list of users and security groups is displayed. You can search for a specific user or group or select multiple users and groups that appear in the list.
7
Confirm selection
After you have selected your users and groups, select Select.
8
9
If you see the message below, it means that a free tier is being used. You can only add users (not groups) to the Passport Enterprise App.
10
.png?fit=max&auto=format&n=2JN9EXN6FEm5sMxP&q=85&s=4bd38e97502d55069ffba70303e5f94b)
11
Complete assignment
Select Assign to finish the assignment of users and groups to the app.
12
13
Verify assignment
Confirm that the users and groups you added appear in the Users and groups list.
14
15
Review configuration
With this portion of the Entra ID configuration complete, review the remaining sections of this article for your Microsoft Entra ID environment.
Microsoft Entra ID Conditional Access Considerations
Microsoft Entra ID Conditional Access is included with Microsoft Entra ID Premium or better. Be sure to turn off both per-user MFA and Security defaults before you turn on Microsoft Entra ID Conditional Access policies.
- Assignments: Target resources: Cloud apps: All cloud apps or Select apps
- Access controls: Grant: Grant access: Require multifactor authentication
Add the Cloud App Exclusion
Exclude the Enterprise app you use for Iru Passport for each applicable policy.1
Access Protection settings
In the Microsoft Entra admin center, open the portal menu and then select Protection.
2
Navigate to Conditional Access
On the Protection menu, select Conditional Access.
3
Access Policies
On the Conditional Access page, select Policies.
4
Review policies
Confirm that the portal displays each policy with a Policy Name and a State (among other information).
5
6
Select active policy
Select a policy that has the State of On.
7
Check target resources
If the Target resources section displays No target resources selected, then return to the previous step and select the next policy.
8
9
Access target resources
Otherwise, click the link under Target resources.
10
Exclude cloud apps
Click Exclude.
11
12
Review excluded apps
Review the list of excluded cloud apps (there may be no excluded cloud apps). If the Enterprise app for Iru Passport is already excluded, you can return to step 3 and proceed to the next policy.
13
Select excluded cloud apps
Click the text link under Select excluded cloud apps.
14
15
Search for Passport app
In the Search field, enter the name of the Enterprise app you use for Iru Passport. Note that the search doesn’t just search for any part of the name; you need to enter at least the start of the name.
16
Select Passport app
Select the checkbox for your Enterprise app for Iru Passport from the search results.
17
Confirm selection
At the bottom of the Select excluded cloud apps blade, click Select.
18
19
Verify exclusion
Confirm that the Enterprise app was added to the list of excluded apps.
20
21
Save policy
In the lower-left corner of the page, click Save.
22
Repeat for other policies
Go back to step 3 and repeat for the next policy until you have examined or updated every Conditional Access policy.
User Account Provisioning via Passport
If you use Specify per identity provider group option in the Passport Library Item, use the Entra ID group ObjectID in the Identity provider group field.
1
Access Groups
Sign in to the Microsoft Entra admin center. In the Identity navigation menu on the left, open Groups and select All groups.
2
Select group
Select the group that you want to use.
3
4
Copy Object ID
Copy the Object Id for that group.
5
6
Configure Passport Library Item
In the Iru Endpoint Passport Library Item, in the User Provisioning section, paste the value from the previous section into the Identity provider group field.
7
8
Repeat for additional groups
Repeat the previous steps for each additional Entra ID group you want to use.
9
Save configuration
In the Passport Library Item, click Save.
- If you set the default account type to standard user, only add administrator account types in the Identity provider groups. Unless otherwise specified as administrators in your Identity provider groups, all users will be created as standard users by default.
- If you set the default account type to administrators, only add standard account types in the Identity provider groups. All users will be created as administrators by default unless otherwise specified as standard users in your Identity provider groups.