Apple Platform Deployment
- Welcome
- Intro to Apple platform deployment
- What’s new
-
-
- Declarative status reports
- Declarative app configuration
- Authentication credentials and identity asset declaration
- Background task management declarative
- Calendar declarative configuration
- Certificates declarative configuration
- Contacts declarative configuration
- Exchange declarative configuration
- Google Accounts declarative configuration
- LDAP declarative configuration
- Legacy interactive profile declarative configuration
- Legacy profile declarative configuration
- Mail declarative configuration
- Maths and Calculator app declarative configuration
- Passcode declarative configuration
- Passkey Attestation declarative configuration
- Safari extensions management declarative configuration
- Screen Sharing declarative configuration
- Service configuration files declarative configuration
- Software Update declarative configuration
- Software Update settings declarative configuration
- Storage management declarative configuration
- Subscribed Calendars declarative configuration
-
-
- Accessibility payload settings
- Active Directory Certificate payload settings
- AirPlay payload settings
- AirPlay Security payload settings
- AirPrint payload settings
- App Lock payload settings
- Associated Domains payload settings
- Automated Certificate Management Environment (ACME) payload settings
- Autonomous Single App Mode payload settings
- Calendar payload settings
- Mobile payload settings
- Mobile Private Network payload settings
- Certificate Preference payload settings
- Certificate Revocation payload settings
- Certificate Transparency payload settings
- Certificates payload settings
- Conference Room Display payload settings
- Contacts payload settings
- Content Caching payload settings
- Directory Service payload settings
- DNS Proxy payload settings
- DNS Settings payload settings
- Fonts payload settings
- Domains payload settings
- Energy Saver payload settings
- Exchange ActiveSync (EAS) payload settings
- Exchange Web Services (EWS) payload settings
- Extensible Single Sign-on payload settings
- Extensible Single Sign-on Kerberos payload settings
- Extensions payload settings
- FileVault payload settings
- Finder payload settings
- Firewall payload settings
- Fonts payload settings
- Global HTTP Proxy payload settings
- Google Accounts payload settings
- Home Screen Layout payload settings
- Identification payload settings
- Identity Preference payload settings
- Kernel Extension Policy payload settings
- LDAP payload settings
- Lights Out Management payload settings
- Lock Screen Message payload settings
- Login Window payload settings
- Managed Login Items payload settings
- Mail payload settings
- Network Usage Rules payload settings
- Notifications payload settings
- Parental Controls payload settings
- Passcode payload settings
- Printing payload settings
- Privacy Preferences Policy Control payload settings
- Relay payload settings
- SCEP payload settings
- Security payload settings
- Setup Assistant payload settings
- Single Sign-on payload settings
- Smart Card payload settings
- Subscribed Calendars payload settings
- System Extensions payload settings
- System Migration payload settings
- Time Machine payload specifics
- TV Remote payload settings
- Web Clips payload settings
- Web Content Filter payload settings
- LDAP payload settings
-
- Glossary
- Document revision history
- Copyright
Single Sign-on device management payload settings for Apple devices
You can configure single sign-on settings for users of an iPhone or iPad that enrols in a device management service. Use the Single Sign-on payload to define Kerberos account information when accessing servers or specified apps.
Single sign-on is a concept based on Kerberos, where authentication to services running on various servers is granted by a Kerberos Key Distribution Centre (KDC). This is based on a trust relationship between the servers and the account. Active Directory uses single sign-on to authenticate to additional servers that they trust. For more information, see Intro to Single Sign-on with Apple devices.
The Single Sign-on payload supports the following. For more information, see Payload information.
Supported payload identifier: com.apple.sso
Supported operating systems and channels: iOS, iPadOS.
Supported enrolment methods: User Enrolment, Device Enrolment, Automated Device Enrolment.
Duplicates allowed: False — only one Single Sign-on payload can be delivered to a device.
You can use the settings in the table below with the Single Sign-on payload.
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Account Name | Name of the user account — for example, Alex Hunter. | Yes | |||||||||
Principal Name | Kerberos principal name for the user account — for example, alexhunter@SERVER.betterbag.COM | Yes | |||||||||
Realm | The full Kerberos realm where the user’s account is located. | Yes | |||||||||
Renewal Certificate payload | The Certificates payload used to silently renew a Kerberos ticket. | No | |||||||||
URL patterns | URLs to be used with this account. Any URLs that don’t match the pattern won’t be contacted. | No | |||||||||
Specific apps | Apps that can take advantage of Single Sign-On can be listed here by their app identifier. | No | |||||||||
Note: Each device management service developer implements these settings differently. To learn how Single Sign-On settings are applied to your devices, consult your developer’s device management service documentation.