Skip to main content
This guide applies to Mac computers

​
About Passport with Microsoft Entra ID Web Login

Passport with Microsoft Entra ID Web Login signs users in through a web view of your organization’s Microsoft Entra ID sign-in page, so Conditional Access and MFA can run at login. For Mac Login (username and password at the Mac login window without that web view), use Configure Passport with Microsoft Entra ID - Mac Login.

Important Entra ID Passport Update

Starting June 15, 2026, Microsoft Entra ID handles Conditional Access for Passport sign-in differently. Existing Passport Web Login deployments need updates only in some cases. See Required changes before June 15, 2026. Microsoft explains the change in this documentation.If you are setting up Passport for the first time, continue from the beginning of this article. The setup instructions already include these updates where they apply.

​
How It Works

Passport integrates with your Microsoft Entra ID tenant at the macOS login screen. In Web Login mode, users complete Entra ID sign-in (including MFA when required) in that web view before the local Mac session is created or updated.

​
Prerequisites

  • Access to a Microsoft Entra ID admin account that can grant the Passport app the correct permissions.
  • For MFA settings in Microsoft Entra ID, see Microsoft’s MFA configuration guide.

​
Create the App Registration

1

Sign in to Microsoft Entra admin center

Sign in to the Microsoft Entra admin center using a Global Administrator account.
2

Access App registrations

In the sidebar, under the Entra ID category, select App registrations.
3

Start new registration

On App registrations, select + New registration on the menu.
Microsoft Entra ID App registrations with New registration for Passport
4

Set application name

Enter a name for the new application (such as Iru Passport Web Login).
5

Set supported account types

Under Supported account types, open the drop-down and select Single tenant only (the option also shows your tenant name, for example Single tenant only - Accuhive). Passport should be single-tenant in your organization only. See Register an application in Microsoft Entra ID.
6

Set Redirect URI platform

In the Redirect URI section, open the Select a platform drop-down and choose Public client/native (mobile & desktop).
7

Enter redirect URI

In the URI field, enter https://localhost. You will use this redirect URI when you configure the Passport Library Item.
https://localhost
For more information about redirect URI restrictions, platform types, and best practices, see Microsoft’s redirect URI documentation.
8

Complete registration

Click Register.
Microsoft Entra ID New registration form showing name, supported account types, and redirect URI for Passport

​
Collecting Configuration Details

Open a secure text document where the values for this OIDC app can be temporarily stored. You will need these details when you configure the Passport Library Item.

​
Overview Pane

Copy the application (client) ID from the app’s overview. You will need it for the Passport Library Item.
1

Open the Overview pane

In the left menu, select Overview to open that pane.
2

Copy Application ID

Copy the Application (client) ID to your secure document.
Microsoft Entra ID Overview pane showing Application (client) ID for Passport

​
Endpoints Pane

Copy the OpenID Connect metadata URL from Endpoints; this is the identity provider URL Passport uses to discover sign-in and token endpoints.
1

Open the Endpoints pane

In the top menu, select Endpoints to open that pane.
Microsoft Entra ID App registration with Endpoints pane for Passport
2

Copy Identity provider URL

Copy the OpenID Connect metadata document (identity provider URL) to your secure document.
3

Close Endpoints

Click the X at the top right to close the Endpoints pane.
Microsoft Entra ID Endpoints pane showing copy option and close button for Passport

​
Authentication (Preview) pane

Enable public client flows so the Mac app can complete the sign-in flow without a client secret.
1

Open the Authentication (Preview) pane

In the left menu, select Authentication (Preview) to open that pane.
2

Open Settings

Select the Settings tab.
3

Enable public client flows

Set Allow public client flows to Enabled.
4

Save authentication settings

Click Save.
Microsoft Entra ID Authentication settings showing Allow public client flows enabled for Passport

​
Token Configuration Pane

Add the required claims so the token includes the username and group membership Passport needs.
1

Open the Token configuration pane

In the left menu, select Token configuration to open that pane.
2

Add optional claim

Click Add optional claim.
3

Select token type

For the Token type, select ID.
4

Select claim

For the Claim, select preferred_username.
5

Add the claim

Click Add.
Microsoft Entra ID Token configuration showing preferred_username optional claim and Add button for Passport
6

Add groups claim

Click Add groups claim.
7

Select groups

Select All groups.
Entra ID SAML only supports up to 150 security groups. If you have more than 150 security groups, you should not use All groups, but rather select specific groups. You can read more in Microsoft’s Configure group claims for applications by using Microsoft Entra ID article.
8

Confirm groups claim

Click Add.
Microsoft Entra ID Token configuration Add groups claim for Passport
Once you complete the token configurations, you will see both optional claims.

​
API Permissions

Add the Microsoft Graph permissions Passport needs (email, profile, User.Read) and grant admin consent so users can sign in.
1

Open the API permissions pane

In the left menu, select API permissions to open that pane.
2

Add permission

Click Add a permission.
Microsoft Entra ID API permissions pane showing Add a permission for Passport
3

Select Microsoft Graph

Click Microsoft Graph.
Microsoft Entra ID Request API permissions showing Microsoft Graph for Passport
4

Select Delegated permissions

Select Delegated permissions.
5

Expand OpenID permissions

Confirm that the OpenID permissions section is expanded. If it isn’t, click the icon next to it to expand it.
6

Select email and profile permissions

Select email and profile.
Microsoft Entra ID Request API permissions showing Delegated permissions for Passport
7

Search for User.Read

In the Select permissions search field, enter User.Read.
8

Confirm User.Read selection

In the User section, confirm that User.Read is already selected. If it isn’t, select it.
9

Add permissions

Click Add permissions.
Microsoft Entra ID API permissions showing User.Read for Passport
10

Grant admin consent

Select Grant admin consent for [your tenant].
11

Confirm admin consent

Select Yes.
Microsoft Entra ID API permissions Add permissions for Passport
12

Verify permission status

Confirm that there is a Granted for [your tenant] message in the Status column for each permission.
Microsoft Entra ID API permissions Status column Granted for tenant for Passport

​
Assign Users and Groups

Configure who can use the Passport app and whether it appears in the user portal. By default, all users in Entra ID can use the app; the steps below cover the Properties settings and assigning users or users and groups when required.
1

Access Enterprise Applications

In the Entra ID navigation menu on the left, select Enterprise Apps.
2

Select Passport application

In the All applications list, select Iru Passport Web Login or whatever name you gave the App registration in the previous section.
Microsoft Entra ID Enterprise apps for Passport
3

Open the Properties pane

In the left menu, under the Manage category, select Properties to open that pane.
4

Add logo (optional)

Optionally, add a logo to your Enterprise App.
5

Check assignment requirement

Inspect the Assignment required? setting:
  • No: You will not need to assign users or users and groups.
  • Yes: You will need to assign users or users and groups.
6

Configure visibility

Set Visible to users? to No.If it is Yes, users will see the app in their portal. The Passport app is only useful as a replacement for the macOS login window.
7

Save properties

Click Save.
Microsoft Entra ID Properties pane showing Assignment required and Visible to users for Passport
If Assignment required? is set to No, you can go directly to User Account Provisioning via Passport. If it is set to Yes, continue with the steps below.

​
Assignment Required

If your Passport Enterprise application has Assignment required? set to Yes, follow the steps below to assign users or users and groups.
1

Open the Users and groups pane

In the left menu, under the Manage category, select Users and groups to open that pane.
2

Add user or group

On the menu, select + Add user/group.
Microsoft Entra ID Users and groups pane under Manage for Passport
3

Select users and groups

On the Add Assignment page, under the Users or Users and groups heading, select the None selected link to choose who can use the app.
Depending on your Microsoft Entra ID plan, you may only be able to assign users, not groups. In that case, the heading shows Users and group assignment is not available.
Microsoft Entra ID Add Assignment page showing Users and groups with None selected link for Passport
4

Choose users or users and groups

A list of users or users and security groups is displayed. You can search for a specific user or group, or select multiple users or users and groups that appear in the list.
5

Confirm selection

After you have selected your users or users and groups, select Select.
Microsoft Entra ID Select users or users and groups for Passport
6

Complete assignment

Select Assign to finish the assignment of users or users and groups to the app.
Microsoft Entra ID Assign users or groups for Passport
7

Verify assignment

Confirm that the users or users and groups you added appear in the Users and groups list.
Microsoft Entra ID Users and groups list showing assigned users or groups for Passport
With this portion of the Entra ID configuration complete, review the remaining sections of this article for your Microsoft Entra ID environment.

​
Microsoft Entra ID Conditional Access Considerations

Microsoft Entra ID Conditional Access is included with Microsoft Entra ID Premium or better. Be sure to turn off both per-user MFA and Security defaults before you turn on Microsoft Entra ID Conditional Access policies.
Complete the steps below to register Passport - CA Policy API, add its scope to your Passport app, and exclude that app from applicable policies. Skip this section if you do not use Conditional Access. When you finish, add the scope under Additional scopes (optional) in Authentication Mode on the Iru Endpoint tab.Passport Web Login completes Conditional Access challenges such as MFA in the Passport web view at login.

​
Create the Passport - CA Policy API application

Create this application registration so Passport can request a scope beyond baseline scopes.
1

Open App registrations

Sign in to the Microsoft Entra admin center and open Entra ID > App registrations.
2

Register the application

Select + New registration. Enter Passport - CA Policy API as the name, under Supported account types select Single tenant only, and leave Redirect URI empty. Select Register.
3

Grant admin consent for Microsoft Graph

Open API permissions. If admin consent is not already granted, select Grant admin consent for [your tenant].
4

Expose an API

Open Expose an API in the left navigation.
5

Add a scope

Select + Add a scope.
6

Set Application ID URI

Review the Application ID URI. Entra ID suggests a default value (for example, api://cca588ed-dfe6-4fb4-b695-abfa23b6475a). The default is fine. Select Save and continue. You do not need to copy this URI; copy the scope URI in Copy the scope URI below.
7

Configure the Passport scope

For Scope name, enter Passport without spaces or special characters. Leave Who can consent at the default. Enter a display name and description in the Admin consent fields, then select Add scope.
Microsoft Entra ID Expose an API scope list showing the Passport scope URI and Enabled state
8

Copy the scope URI

Next to the scope URI in the Scopes list (for example, api://cca588ed-dfe6-4fb4-b695-abfa23b6475a/Passport), select Copy. Save it for Add Additional scopes in Authentication Mode on the Iru Endpoint tab.

​
Add the custom scope to your Passport app registration

1

Open your Passport app registration

If you aren’t already signed in, sign in to the Microsoft Entra admin center and open Entra ID > App registrations. Open the application you use for Passport Web Login.
2

Add API permission

Open API permissions and select + Add a permission.
3

Select Passport - CA Policy API

Open the APIs my organization uses tab and select Passport - CA Policy API.
4

Add the Passport delegated permission

Select Delegated permissions, select the Passport permission, then select Add permissions.
5

Grant admin consent

Select Grant admin consent for [your tenant].
Microsoft Entra ID API permissions for Passport showing Microsoft Graph and Passport - CA Policy API delegated permissions

​
Exclude Passport - CA Policy API from All resources policies

Exclude Passport - CA Policy API from each policy scoped to All resources so password verification and synchronization continue to work.
1

Open Conditional Access

In the Microsoft Entra admin center, open Protection > Conditional Access > Policies.
2

Open a policy scoped to All resources

Select each policy scoped to All resources, then open Target resources.
3

Exclude Passport - CA Policy API

Open the Exclude tab, select Select resources, then select Passport - CA Policy API. Select Select, then Save.
Microsoft Entra ID Conditional Access policy Exclude tab showing Passport - CA Policy API selected under Select specific resources
4

Repeat for each All resources policy

Repeat these steps for every Conditional Access policy scoped to All resources.
If Save fails, confirm that Passport - CA Policy API does not allow public client flows. If the app has a redirect URI configured, remove it and try again.

​
User Account Provisioning via Passport

If you want Passport to set each user’s Mac account type from Entra ID security group membership, collect each group’s Object ID in the Microsoft Entra admin center using the steps in this section. You will use those values under User provisioning on the Passport Library Item Iru Endpoint tab. For more detail on this mode, see User provisioning in Configure the Passport Library Item.
1

Access Groups

Sign in to the Microsoft Entra admin center. In the Identity navigation menu on the left, open Groups and select All groups.
2

Select group

Select the group that you want to use.
Microsoft Entra ID Groups for Passport user provisioning
3

Copy Object ID

Copy the Object ID for that group.
Microsoft Entra ID Groups list showing Object ID for Passport
4

Repeat for additional Entra ID groups

For each additional Entra ID group you want to use, repeat Select group and Copy Object ID. Keep the Object ID values in a secure document until you enter them on the Iru Endpoint tab.
Configure Authentication mode and User provisioning in the Passport Library Item on the Iru Endpoint tab.

​
Required Changes Before June 15, 2026

On June 15, 2026, Microsoft Entra ID starts enforcing Conditional Access more broadly for policies that target All resources (formerly All cloud apps) and include resource exclusions. Sign-ins that request only baseline scopes, including openid, profile, email, and User.Read, will be subject to those policies. Passport Web Login requests those scopes as a public client. If you already use Passport Web Login, you need the steps below only when you want password verification and synchronization to work without MFA being enforced through Conditional Access on policies scoped to All resources (you exempt Passport from MFA instead of having users complete MFA during web sign-in). If users complete MFA in the Entra ID web view, you generally do not need the custom scope, Step 3, or the Additional scopes Library Item update; your tenant may still need the path under If you do not use Conditional Access policies. If you skip required updates, sign-in and password sync can break once the change reaches your tenant. If you are configuring Passport Web Login for the first time using this article, the Microsoft Entra ID and Iru Endpoint tabs above already include these updates where they apply. Read Enforcement for baseline scopes in Conditional Access for more detail.

​
If you skip these updates

If you do not prepare before June 15, 2026:
  • New users might not be able to sign in with Passport.
  • Existing users might need to switch to local login after a reboot or logout.
  • Password sync and state management can stop working.
  • Microsoft Entra ID might record extra failed sign-in events.

​
If you do not use Conditional Access policies

If you do not use Conditional Access, or you want the old behavior across your tenant while you test:
1

Register a placeholder application

Register a single-tenant application in Microsoft Entra ID to serve as the custom target resource for baseline scopes. No additional configuration is required during registration. See Create an application in Customize behavior.
2

Exclude the application from the relevant policy

In each Conditional Access policy where you need to retain legacy behavior, exclude the placeholder application from Target resources. See Exclude the application from the relevant policy in Microsoft’s documentation.
3

Select the application in Baseline scopes settings

Open Baseline scopes settings, select Customize behavior, select the placeholder application, then select Save. See Select the application in the Baseline scopes settings UX in Microsoft’s documentation.
4

No Passport Library Item changes required

You do not need to change your Passport Library Item in Iru Endpoint.
This Entra ID setting affects every application that requests baseline scopes, not just Passport.

​
If you use Conditional Access policies

If you use Conditional Access with Passport Web Login and want to exempt Passport from MFA as described above, complete the steps below before June 15, 2026.

​
Step 1 — Create the Passport - CA Policy API application

1

Open App registrations

Sign in to the Microsoft Entra admin center and open Entra ID > App registrations.
2

Register the application

Select + New registration. Enter Passport - CA Policy API as the name, under Supported account types select Single tenant only, and leave Redirect URI empty. Select Register.
3

Grant admin consent for Microsoft Graph

Open API permissions. If admin consent is not already granted, select Grant admin consent for [your tenant].
4

Expose an API

Open Expose an API in the left navigation.
5

Add a scope

Select + Add a scope.
6

Set Application ID URI

Review the Application ID URI. Entra ID suggests a default value (for example, api://cca588ed-dfe6-4fb4-b695-abfa23b6475a). The default is fine. Select Save and continue. You do not need to copy this URI; copy the scope URI in Copy the scope URI below.
7

Configure the Passport scope

For Scope name, enter Passport without spaces or special characters. Leave Who can consent at the default. Enter a display name and description in the Admin consent fields, then select Add scope.
Microsoft Entra ID Expose an API scope list showing the Passport scope URI and Enabled state
8

Copy the scope URI

Next to the scope URI in the Scopes list (for example, api://cca588ed-dfe6-4fb4-b695-abfa23b6475a/Passport), select Copy. Save it for step 4 below.

​
Step 2 — Add the custom scope to your Passport app registration

1

Open your Passport app registration

If you aren’t already signed in, sign in to the Microsoft Entra admin center and open Entra ID > App registrations. Open the application you use for Passport Web Login.
2

Add API permission

Open API permissions and select + Add a permission.
3

Select Passport - CA Policy API

Open the APIs my organization uses tab and select Passport - CA Policy API.
4

Add the Passport delegated permission

Select Delegated permissions, select the Passport permission, then select Add permissions.
5

Grant admin consent

Select Grant admin consent for [your tenant].
Microsoft Entra ID API permissions for Passport showing Microsoft Graph and Passport - CA Policy API delegated permissions

​
Step 3 — Exclude Passport - CA Policy API from All resources policies

Complete this step only when you use Web Login and want to exempt Passport from MFA through Conditional Access. Skip it if users complete MFA in the Entra ID web view at login. Policies scoped to All resources include sign-ins that use baseline scopes Passport requests at sign-in. Exclude Passport - CA Policy API so password verification and synchronization continue to work without an MFA requirement on those policies.
1

Open Conditional Access

In the Microsoft Entra admin center, open Protection > Conditional Access > Policies.
2

Open a policy scoped to All resources

Select each policy scoped to All resources, then open Target resources.
3

Exclude Passport - CA Policy API

Open the Exclude tab, select Select resources, then select Passport - CA Policy API. Select Select, then Save.
Microsoft Entra ID Conditional Access policy Exclude tab showing Passport - CA Policy API selected under Select specific resources
4

Repeat for each All resources policy

Repeat these steps for every Conditional Access policy scoped to All resources.
If Save fails, confirm that Passport - CA Policy API does not allow public client flows. If the app has a redirect URI configured, remove it and try again.

​
Step 4 — Update your Passport Library Item

Complete this step when you follow If you use Conditional Access policies because you exempt Web Login from MFA as described above.
1

Open the Passport Library Item

In Iru Endpoint, open Library and edit your Passport Library Item configured for Microsoft Entra ID Web Login.
2

Add the scope URI

On the Iru Endpoint tab, paste the scope URI from step 1 above into Additional scopes (optional), then select Save.
Passport Library Item Additional scopes field showing the Passport - CA Policy API scope URI
3

Repeat for other Passport Library Items

Repeat Add the scope URI for every Passport Library Item configured for Microsoft Entra ID Web Login.
After you finish these updates, test Passport sign-in on an enrolled Mac. If sign-in fails, see Passport Troubleshooting with Microsoft Entra ID (formerly Azure AD).

​
Microsoft Entra ID Troubleshooting

If Passport sign-in fails with Entra ID, see Passport Troubleshooting with Microsoft Entra ID (formerly Azure AD).