Apple Platform Deployment
- Welcome
- Intro to Apple platform deployment
- What’s new
-
-
- Accessibility payload settings
- Active Directory Certificate payload settings
- AirPlay payload settings
- AirPlay Security payload settings
- AirPrint payload settings
- App Lock payload settings
- Associated Domains payload settings
- Automated Certificate Management Environment (ACME) payload settings
- Autonomous Single App Mode payload settings
- Calendar payload settings
- Mobile payload settings
- Mobile Private Network payload settings
- Certificate Preference payload settings
- Certificate Revocation payload settings
- Certificate Transparency payload settings
- Certificates payload settings
- Conference Room Display payload settings
- Contacts payload settings
- Content Caching payload settings
- Directory Service payload settings
- DNS Proxy payload settings
- DNS Settings payload settings
- Dock payload settings
- Domains payload settings
- Energy Saver payload settings
- Exchange ActiveSync (EAS) payload settings
- Exchange Web Services (EWS) payload settings
- Extensible Single Sign-on payload settings
- Extensible Single Sign-on Kerberos payload settings
- Extensions payload settings
- FileVault payload settings
- Finder payload settings
- Firewall payload settings
- Fonts payload settings
- Global HTTP Proxy payload settings
- Google Accounts payload settings
- Home Screen Layout payload settings
- Identification payload settings
- Identity Preference payload settings
- Kernel Extension Policy payload settings
- LDAP payload settings
- Lights Out Management payload settings
- Lock Screen Message payload settings
- Login Window payload settings
- Managed Login Items payload settings
- Mail payload settings
- Network Usage Rules payload settings
- Notifications payload settings
- Parental Controls payload settings
- Passcode payload settings
- Printing payload settings
- Privacy Preferences Policy Control payload settings
- Relay payload settings
- SCEP payload settings
- Security payload settings
- Set-up Assistant payload settings
- Single Sign-on payload settings
- Smart Card payload settings
- Subscribed Calendars payload settings
- System Extensions payload settings
- System Migration payload settings
- Time Machine payload settings
- TV Remote payload settings
- Web Clips payload settings
- Web Content Filter payload settings
- Xsan payload settings
-
- Declarative app configuration settings
- Authentication credentials and identity asset settings
- Calendar declarative settings
- Certificates declarative configuration
- Contacts declarative configuration
- Exchange declarative configuration
- Google Accounts declarative configuration
- LDAP declarative configuration
- Legacy interactive profile declarative configuration
- Legacy profile declarative configuration
- Mail declarative configuration
- Passcode declarative configuration
- Passkey Attestation declarative configuration
- Screen Sharing declarative configuration
- Service configuration files declarative configuration
- Software Update declarative configuration
- Subscribed Calendars declarative configuration
- Glossary
- Document revision history
- Copyright
![](https://help.apple.com/assets/664256E0F9FFA26F690A0B01/664256E3F9FFA26F690A0B07/en_AU/312766e3df7f57c1f549da2dab216b36.png)
Enrolment Single Sign-on for iPhone and iPad
Enrollment Single Sign-on (Enrollment SSO) is designed to make the account-driven enrolment flows faster and easier by reducing the number of sign-ins required during enrolment into a mobile device management (MDM) solution. You do this for your organisation by installing an identity app and then using it to handle repeated authentication during — and after — the enrolment process.
Enrolment SSO works with all SSO technologies, including OAuth 2.0. To use Enrolment SSO, an identity provider (IdP) creates an app with an Extensible SSO extension and obtains the relevant entitlement, then publishes the app in the App Store as either a public app or an unlisted one. During the enrolment flow in Settings, the user can then download and use this app to sign in. After a user signs in and is enrolled in MDM, the app remains installed as a managed app to facilitate additional authentications. Your MDM solution must support:
Service discovery for Enrolment SSO, which tells the device which app to download during the enrolment process
Enrolment SSO on the sign-in page
Authentication and federation with an IdP
Managed Apple ID authentication
IdPs must support Managed Apple ID federation with Apple School Manager, Apple Business Manager or Apple Business Essentials, and provide an app with SSO support that can be deployed using an MDM solution.
Apple supports two authentication methods, one with Managed Apple IDs and the other with MDM. Both can be used by users.
When the administrator’s IdP or MDM solutions support this feature, the administrator can provision Managed Apple IDs through Apple School Manager, Apple Business Manager or Apple Business Essentials and configure the feature within their third-party MDM solution. Then, when a user enters their email address in Settings, they’re prompted to download the preferred identity app, which can then handle the sign-in to enrol into MDM.