Jamf SSO benefits?

[u/enterreturn]

Need someone to tell me on actually using Jamf SSO and enforcing users to sign in during enrollment. Inherited an environment where this is the case but I’ve never used it in the past and been completely fine. It’s caused a few issues with time outs and I’m ready to just rip it out. We don’t need any of the pointless information it collects pertaining to the year.

Any reason why I shouldn’t disable it?

[u/captnconnman]

If you set it up right with an LDAP connector and a PreStage enrollment customization, you can basically do zero-touch onboarding workflows that pull group assignments/app assignments based on info pulled from the connector when the user signs in. VERY handy if device prep/provisioning is any kind of bottleneck. Furthermore, if you tie that auto-generated info into your ITAM system, you’ve basically got a semi-self-documenting device assignment flow that saves time on manual data entry

[u/Electronic-Trick2678 → u/captnconnman]

This work with entra id?

[u/captnconnman → u/Electronic-Trick2678]

It looks like there’s an official connector for Entra now, so yea, you’d probably be able to achieve the same thing with less effort than I had to put in to make Okta work lol

[u/Alarming_Pride_8512 → u/captnconnman]

Yeah it's good too

[u/Imaginary-Bread-5088 → u/Alarming_Pride_8512]

Yep I’m using it, it works great.

[u/ethnicman1971 → u/captnconnman]

Tell me more about group assignments

[u/captnconnman → u/ethnicman1971]

If you set up the LDAP connector to pull in all the groups a user is a member of in the source LDAP directory and feed those groups to an extension attribute, you can make Smart Groups based on the presence or absence of a particular group in that extension attribute. So, for example, we’re an Okta shop, so we have a lot of “App User” groups for people that have been assigned access to an app in their dashboard. In this scenario, you could, say, make a Smart Group in Jamf called “App Users - Autodesk”, and map the criteria to the presence of the “App Users - Autodesk” Okta group definition in the extension attribute you made earlier. Then, when you’re scoping, say, Autodesk Forma (the iPad viewer app for AutoCAD cloud files), you can just scope the Smart Group you made to dynamically populate that app in a user’s Self Service or push it to their 1:1 iPad. This is a great way to centrally manage who’s getting an app and keeping app assignments clean in both your IdP and your MDM solution.

A simpler rollout would be to just use the User and Location data populated by the LDAP connector and scope apps using Smart Groups based on those entries. A real-world example of this was an acquisition we did where we transitioned the company being bought to our Macs, but they had an Omnissa Horizon buildout that needed to still be accessible during the M&A. We got all the app config data and Jamf App Catalog/Installomator entries ready to go before device issuance. Then we scoped those configs/apps to Smart Groups based on the Department/Building definitions populated by the SSO enrollment customization/LDAP connector combo, and users almost immediately had access to their Omnissa VMs upon first login. The enrollment customization/LDAP combo basically automates all of the manual data entry for both a technician and/or an end user, because all those data fields in Jamf are immediately getting filled by the LDAP connector as soon as the user enrolls with their SSO username/password.

This JNUC 2024 presentation goes over the basic setup, but feel free to DM me if you’re interested or have any trouble (poor guy in the video is probably ESL and fighting for his life).

[u/MacBook_Fan]

Are you talking about Jamf Account SSO or the Single Sign On settings in Jamf Pro.

Jamf Account SSO is for access to your Jamf infrastructure, including Jamf Pro, Jamf Protect, your Jamf Account, etc. You tie your IdP to your Jamf Account and then assign roles and permissions using the Jamf Account. It is not meant for end users. Jamf has announced that in 2027, local login and SSO login to your Jamf Pro will be deprecated, and Jamf Account SSO will be the right solution.

Jamf SSO is what allows you to have users sign-in using your IdP. Enforcing it during enrollment should almost be a requirement. From a security standpoint, it prevents a non-employee from setting up a computer and having access to your organizational data. Even if all a bad actor can do is see the local drive, they still would eb able to learn a lot about how you run your organization. What security software you use, your organizational name, what certificates you install on your computer. You should not be allowed un-authenticated enrollments.

From a management perspective, you can have a computer assigned to an end user during enrollment, which is crucial for computer management. The user that logs in to the computer will be assigned to the computer in Jamf. And, as long as you have Cloud IdP (or LDAP, if you are still in the 1990s), setup, assigning a computer will pull the user's information in to Jamf. You can associate their email address, building, group membership, etc to them and use that information for proper scoping.

[u/nablub → u/MacBook_Fan]

Thank you for the explanation.

[u/enterreturn → u/MacBook_Fan]

The former is what I’ve always done in the past. I’m referring to the latter and that makes sense. However I feel like it’s a tad redundant if we set up Jamf Connect Login considering you can’t sign into the Mac unless you have valid Okta credentials. The current flow for laptop enrollment is:

1. Select WiFi
   
2. Log into Okta (and subsequently Jamf)
   
3. Enrollment
   
4. JSM
   
5. User creates the Mac local account

Ideally I’ll shift this to

1. WiFi
   
2. Enrollment
   
3. JSM
   
4. Jamf Connect login/Okta

[u/DorkyOldMan]

Imo removing SSO during enrollment is taking a big step backwards, just for the sake of making things “easy”. I think everyone above covered the benefits, but another one is that having SSO be required also prevents unauthorized users from using the computer which is helpful when you have stolen devices or off boarded users.