Configure macOS Platform SSO (Jamf Pro)

1. (Optional) To prevent the Prisma Agent embedded browser from appearing momentarily during single sign-on, configure the Agent Settings in Strata Cloud Manager as follows:

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
   2. Add or update an existing agent setting.
   3. In the App Configuration section, select Show Advanced OptionsAuthentication and enable Use Single Sign-on (Mac).

   4. Save and push your configuration updates.
2. Configure a platform SSO configuration profile for Microsoft Entra ID using Jamf Pro.

   1. Fill in the General configuration profile information.
   2. Select the Single Sign-On Extensions payload and Add a single sign-on extension with the following properties:

      • Payload Type = SSO
      • Extension Identifier = com.microsoft.CompanyPortalMac.ssoextension
      • Team Identifier = UBF8T346G9
      • Sign-on Type = Redirect
      • URLs: Specify all the URLs listed here that macOS should redirect to the Company Portal app for authentication.
      • Use Platform SSO = Enabled
      • Custom Configuration: Add com.paloaltonetworks. to the AppPrefixAllowList key in the PLIST file. For example:

        <?xml version="1.0" encoding="UTF-8"?>
        <plist version="1.0">
        <dict>
            <key>AppPrefixAllowList</key>
            <string>[existing_strings],com.paloaltonetworks.</string>
            <key>browser_sso_interaction_enabled</key>
            <integer>1</integer>
            <key>disable_explicit_app_prompt</key>
            <integer>1</integer>
        </dict>
        </plist>

3. Deploy the configuration profile.

   Assign the completed SSO extension profile to the appropriate computer or computer groups that should receive Platform SSO functionality. Ensure that the profile deployment scope includes all devices where Prisma Agent will use seamless authentication.
4. If not done already, Configure the Jamf policy for Prisma Agent deployment.
5. Verify the configuration.

   After deploying the SSO extension profile, test the configuration by having a user log into their macOS device and observe the Prisma Agent authentication behavior. The agent should connect automatically without prompting for credentials.

   Check the agent logs to confirm that SSO token retrieval is successful and that authentication completes using the Platform SSO mechanism. If authentication fails, verify that the AppPrefixAllowList includes the correct Palo Alto Networks application identifier and that the SSO extension is properly communicating with your identity provider.