Jamf Setup & Single Login orchestration

Audience: Jamf administrators and partners setting up or testing the workflow end to end. App developers: you do not write code against anything on this page. If you're implementing app support, see Implementing Single Login.

This page describes the Jamf and Microsoft components that produce the sign-in and sign-out events a Single Login app reacts to. They run the workflow on the device and in Jamf Pro. They are not an API surface for partner apps.

Jamf Setup

Jamf Setup is a Jamf app that lets a user provision a shared device by signing in once. When configured for Single Login, it prompts for authentication and acquires the bearer token the Apple SSO extension uses to sign supporting apps in silently. It is the event that produces login in supporting apps. Read more about Jamf Setup.

Jamf Reset

Jamf Reset is a Jamf app that signs the user out, clears the authentication token, and returns the device to the pool. It is the event that produces logout in supporting apps. Read more about Jamf Reset.

Managed App Configuration (optional)

Managed App Configuration lets Jamf Pro configure managed apps over the air. In Single Login it is primarily used to configure Jamf Setup (which tenant and client to authenticate against), using the com.jamf.config.sso.* keys below.

<key>com.jamf.config.sso.login-type</key>
<string>AZURE</string>
<key>com.jamf.config.sso.client-id</key>
<string>APPLICATION-ID-HERE</string>
<key>com.jamf.config.sso.authority-uri</key>
<string>https://login.microsoftonline.com/TENANT-ID-HERE/</string>

A partner app does not need App Config for Single Login — the Microsoft broker handles tenant selection, and the app's client ID and authority live in its own MSAL configuration. App Config is only worth adopting if a partner wants admins to push configuration (for example, to let one App Store binary serve many customers); in that case the partner defines their own keys or reads Jamf variables.

Extension attributes and smart groups

Jamf Setup stores the role a user selects in a mobile device extension attribute, and smart groups use that value to scope configuration and apps. These are Jamf Pro configuration mechanisms; they require no change in any app.

Webhooks for single logout (optional)

Most apps detect logout client-side by observing the MSAL account-change broadcast. An app that relies on push notifications or background activity may need its backend to learn about logout before the app next launches. For those cases, Jamf Pro can send a webhook to a backend receiver when a device leaves the "logged in" smart group, so the server can end the session. A webhook receiver or middleware (such as JAWA) consumes the event. This is a server-to-server integration, not app code. Read more about Webhooks.

Setting up the workflow to test

Add Microsoft Authenticator, Jamf Setup, Jamf Reset, and the app to Jamf Pro.
Register the app in Microsoft Entra ID (tenant ID, client ID, redirect URI, roles) and enable Shared Device Mode.
Configure Jamf Setup (via Managed App Configuration) to target the correct tenant.
Sign in through Jamf Setup, then sign out through Jamf Reset, confirming the supporting app signs in and out correctly.

Full administrator steps are in the Guide for SSO with Jamf Setup.