Single Login

Overview

Single Login is a Jamf workflow for shared iPad and iPhone devices. A frontline worker signs in once on the device and is automatically signed in to every supporting app; at the end of the shift they sign out once and are signed out of all of those apps.

From your app's point of view, the workflow is simple. You do not need to initiate the sign-in or drive the sign-out; those happen elsewhere on the device. There are two items your app will need to support:

Login — when a session starts, sign in silently using the account that's already on the device.
Logout — when the session ends, clear your session and the user's data.

Both jobs are handled through the Microsoft Authentication Library (MSAL) in shared device mode. There is no Jamf SDK, API, or app to integrate with for this workflow.

How the workflow looks from your app

sequenceDiagram
    actor U as User
    participant B as Microsoft Enterprise SSO plug-in (broker)
    participant A as Your app

    Note over U,B: A device sign-in starts the session
    U->>B: Signs in once on the shared device
    B-->>B: Stores the account globally for all eligible apps

    rect rgb(232, 245, 233)
    Note over A,B: LOGIN — your app's job
    A->>B: acquireTokenSilent
    B-->>A: Access token (no prompt)
    A->>A: User is signed in
    end

    Note over U,B: A device sign-out ends the session
    U->>B: Signs out
    B-->>A: Account-change broadcast (Darwin notification)

    rect rgb(255, 235, 238)
    Note over A,B: LOGOUT — your app's job
    A->>B: getCurrentAccount
    B-->>A: Account cleared / changed
    A->>A: Clear session and cached data
    end

The two highlighted steps are the only places your app participates. The "device sign-in" and "device sign-out" events are produced by the rest of the Single Login workflow running on the device.

Required app support

MSAL sign-in with Microsoft Entra ID (login and logout). Adopt MSAL (version 1.1.0 or later) with Shared Device Mode enabled. Single Login runs on the Microsoft Enterprise SSO plug-in for Apple devices, built on Apple's Enterprise Single Sign-On framework. Your app's Entra client ID and authority live in its own MSAL configuration; the signed-in account carries the tenant.

That's the whole requirement. See Implementing Single Login for the code and the exact Microsoft prerequisites.

📘
Microsoft is the source of truth
Single Login is built on Microsoft Entra ID, MSAL, and the Microsoft Enterprise SSO plug-in. The requirements are defined by Microsoft, not Jamf. Before writing code you must register your app in Microsoft Entra ID (this is a Microsoft prerequisite — MSAL can't be initialized without the resulting client ID). Follow Microsoft's Shared device mode overview as the authoritative guide.

📘
Note
If your app doesn't use MSAL but already supports OAuth for Microsoft Entra ID via Apple's ASWebAuthenticationSession, it can still participate — the SSO plug-in intercepts OIDC and SAML requests for Microsoft endpoints. MSAL is the recommended path. See Microsoft's Applications that don't use MSAL.

What's next

Implementing Single Login — the MSAL login and logout implementation
Technology Partner Program — partner onboarding and Marketplace listing