You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/develop/apple-sso-plugin.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,19 +33,19 @@ Our first use of the Enterprise SSO plug-in is with our new [shared device mode]
33
33
34
34
The Microsoft Enterprise SSO plug-in for Apple devices offers the following benefits:
35
35
36
-
- Provides seamless SSO for Active Directory accounts across all applications that support Apple's Enterprise Single Sign-On feature.
36
+
- Provides SSO for Active Directory accounts across all applications that support Apple's Enterprise Single Sign-On feature.
37
37
- Delivered automatically in the Microsoft Authenticator and can be enabled by any mobile device management (MDM) solution.
38
38
39
39
Planned but not yet available in this preview release:
40
40
41
-
- Provides seamless SSO across Safari browsers and applications on the device.
41
+
- Provides SSO across Safari browsers and applications on the device.
42
42
43
43
## Requirements
44
44
45
-
To use Microsoft Enterprise SSO plug-in for Apple devices:
45
+
To use Microsoft Enterprise SSO plug-in for Apple devices:
46
46
47
47
- iOS 13.0 or higher must be installed on the device.
48
-
- A Microsoft application that provides the Microsoft Enterprise SSO plug-in for Apple devices must be installed on the device. For Public Preview, this includes the [Microsoft Authenticator app](../user-help/user-help-auth-app-overview.md).
48
+
- A Microsoft application that provides the Microsoft Enterprise SSO plug-in for Apple devices must be installed on the device. For Public Preview, these applications include the [Microsoft Authenticator app](../user-help/user-help-auth-app-overview.md).
49
49
- Device must be MDM-enrolled (for example, with Microsoft Intune).
50
50
- Configuration must be pushed to the device to enable the Microsoft Enterprise SSO plug-in for Apple devices on the device. This security constraint is required by Apple.
51
51
@@ -74,9 +74,9 @@ You can use Microsoft Intune as your MDM service to ease configuration of the Mi
74
74
75
75
## Using the SSO extension in your application
76
76
77
-
The Microsoft Authentication Library (MSAL) for Apple devices version 1.1.0 and higher supports the Microsoft Enterprise SSO plug-in for Apple devices.
77
+
The [Microsoft Authentication Library (MSAL) for Apple devices](https://github.com/AzureAD/microsoft-authentication-library-for-objc) version 1.1.0 and higher supports the Microsoft Enterprise SSO plug-in for Apple devices.
78
78
79
-
Using MSAL is all you need to experiment with the Enterprise SSO plug-in.
79
+
If you'd like to support shared device mode provided by the Microsoft Enterprise SSO plug-in for Apple devices, ensure your applications use the specified minimum required version of MSAL.
Copy file name to clipboardExpand all lines: articles/active-directory/develop/msal-ios-shared-devices.md
+7-5Lines changed: 7 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ ms.custom: aaddev
25
25
26
26
Firstline Workers such as retail associates, flight crew members, and field service workers often use a shared mobile device to perform their work. These shared devices can present security risks if your users share their passwords or PINs, intentionally or not, to access customer and business data on the shared device.
27
27
28
-
Shared device mode allows you to configure an iOS 13 or higher device so that it can be more easily and securely shared by multiple employees. Employees can sign in and access customer information quickly. When they're finished with their shift or task, they can sign out of the device and it's immediately ready for use by the next employee.
28
+
Shared device mode allows you to configure an iOS 13 or higher device to be more easily and securely shared by employees. Employees can sign in and access customer information quickly. When they're finished with their shift or task, they can sign out of the device and it's immediately ready for use by the next employee.
29
29
30
30
Shared device mode also provides Microsoft identity-backed management of the device.
31
31
@@ -37,7 +37,7 @@ To create a shared device mode app, developers and cloud device admins work toge
37
37
38
38
1.**Application developers** write a single-account app (multiple-account apps are not supported in shared device mode) and write code to handle things like shared device sign-out.
39
39
40
-
1.**Device administrators** prepare the device to be shared by using a mobile device management (MDM) provider like Microsoft Intune to manage the devices in their organization. The MDM pushes the Microsoft Authenticator app to the devices and turns on "Shared Mode" for each device through a profile update to the device. This Shared Mode setting is what changes the behavior of the supported apps on the device. This configuration from the MDM provider sets the Shared Device mode for the device and enables the [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md) which is required for Shared Device mode.
40
+
1.**Device administrators** prepare the device to be shared by using a mobile device management (MDM) provider like Microsoft Intune to manage the devices in their organization. The MDM pushes the Microsoft Authenticator app to the devices and turns on "Shared Mode" for each device through a profile update to the device. This Shared Mode setting is what changes the behavior of the supported apps on the device. This configuration from the MDM provider sets the shared device mode for the device and enables the [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md) which is required for shared device mode.
41
41
42
42
1.[**Required during Public Preview only**] A user with [Cloud Device Administrator](../users-groups-roles/directory-assign-admin-roles.md#cloud-device-administrator) role must then launch the [Microsoft Authenticator app](../user-help/user-help-auth-app-overview.md) and join their device to the organization.
43
43
@@ -54,7 +54,7 @@ The following sections help you update your application to support shared device
54
54
>
55
55
> In the future, Intune will include the ability to turn on the Microsoft Enterprise SSO plug-in for Apple devices and enable shared device mode. The following steps are required only for this Public Preview.
56
56
57
-
Your device needs to be configured to support shared device mode. It have iOS 13+ installed and be MDM-enrolled. MDM configuration also needs to enable [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md). To learn more about SSO extensions, see the [Apple video](https://developer.apple.com/videos/play/tech-talks/301/).
57
+
Your device needs to be configured to support shared device mode. It must have iOS 13+ installed and be MDM-enrolled. MDM configuration also needs to enable [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md). To learn more about SSO extensions, see the [Apple video](https://developer.apple.com/videos/play/tech-talks/301/).
58
58
59
59
1. In the Intune Configuration Portal, tell the device to enable the [Microsoft Enterprise SSO plug-in for Apple devices](apple-sso-plugin.md) with the following configuration:
60
60
@@ -88,7 +88,7 @@ On a user change, you should ensure both the previous user's data is cleared and
88
88
89
89
### Detect shared device mode
90
90
91
-
Detecting shared device mode is important for your application. Many applications will require a change in their user experience (UX) when the application is used on a shared device. For example, your application might have a "Sign-Up" feature which isn't appropriate for a Firstline Worker that likely already has an account. You may also want to add extra security to your application's handling of data if it's in shared device mode.
91
+
Detecting shared device mode is important for your application. Many applications will require a change in their user experience (UX) when the application is used on a shared device. For example, your application might have a "Sign-Up" feature, which isn't appropriate for a Firstline Worker because they likely already have an account. You may also want to add extra security to your application's handling of data if it's in shared device mode.
92
92
93
93
Use the `getDeviceInformationWithParameters:completionBlock:` API in the `MSALPublicClientApplication` to determine if an app is running on a device in shared device mode.
94
94
@@ -223,4 +223,6 @@ signoutParameters.signoutFromBrowser = YES; // Only needed for Public Preview.
223
223
224
224
## Next steps
225
225
226
-
To see shared device mode in action, you can find our [iOS sample app](https://github.com/Azure-Samples/ms-identity-mobile-apple-swift-objc) on GitHub that shows how to run a Firstline Worker app on a shared-mode iOS device.
226
+
To see shared device mode in action, the following code sample on GitHub includes an example of running a Firstline Worker app on an iOS device in shared device mode:
227
+
228
+
[MSAL iOS Swift Microsoft Graph API Sample](https://github.com/Azure-Samples/ms-identity-mobile-apple-swift-objc)
0 commit comments