How JAMF Pro Handles Single Sign-On

When configured for SSO, JAMF Pro optionally redirects users authenticating at the console to external identity providers such as Okta, Azure, and Google Identity. JAMF offers detailed documentation on configuring JAMF Pro instances for integration with identity providers. A simplified workflow when SSO is configured, would-be JAMF Pro users redirect from JAMF Pro to their IDP login portal and authenticate with the IDP. The IDP informs JAMF Pro of user attributes such as account names, emails, and groups that apply to the authenticating principal and the server uses this information to create a logon session. This allows external IDPs to employ enhanced authentication requirements that may not be natively supported in JAMF Pro such as conditional access policies (CAPs), multi-factor authentication (MFA), device compliance checks, and more.

The two SSO protocols JAMF Pro supports are OpenID Connect (OIDC) and Security Assertion Markup Language (SAML). Setting up OIDC configurations requires a JAMF Pro cloud-hosted instance integrated with a JAMF Account organization that serves as an identity broker to external identity providers. The OIDC configurations, such as the IDP URL and domain to associate with SSO accounts, are stored in settings configured under JAMF Account. The SSO setting on a JAMF Pro server is then configured to use OIDC and, optionally, to allow bypass for local logon or to use a failover URL when the IDP is not available. OIDC configuration can also be set up to use SAML for actions such as enrollments.

JAMF recommends using OIDC SSO over SAML SSO, when possible, to ensure compatibility with future platform changes. When configuring SAML SSO, all settings are managed within JAMF Pro, which allows configuring SSO for on-site JAMF Pro tenants in addition to JAMF cloud-hosted subscriptions. SAML has no requirement for JAMF Account integration.