Taking Platform SSO to the Next Level: Create New Users At Login
Discover how the advancements in Platform SSO are reshaping user management and security in enterprise settings. Read further to explore this significant leap forward for Mac integration in the corporate world.
In my previous exploration, we delved deep into the world of Apple Identity Services and Platform Single Sign-On (PSSO). If you haven't had the chance to read it yet, I highly recommend starting there for a solid foundation:
Building on that knowledge, this new post takes a crucial step forward. Platform Single Sign-On (SSO) on macOS has evolved, offering groundbreaking capabilities that are particularly beneficial for enterprises utilizing shared devices. This advancement enhances the integration of corporate identities into the macOS ecosystem, streamlining both the user experience and device management. Here are some key features and their implications:
So, let's dive into the transformative world of macOS user roles and privileges, redefined by platform SSO.
The Core Challenges
Admin Rights: A fundamental challenge in integrating Macs into enterprise environments has been the automatic assignment of full administrative rights to the primary user who enrolls the device. This situation presents a significant security risk, as it grants more control than necessary for most users. In a corporate setting, where control and security are paramount, this default setting can lead to a range of issues, from accidental system misconfigurations to potential internal security breaches.
Comparative Analysis with Windows Platforms: Contrasting this with the Windows platform, where user privilege management is more granular and controlled, highlights the disparity. In Windows environments, IT administrators typically have the flexibility to assign varying levels of access rights to different users. This system allows for a more nuanced approach to security and user management, where users receive only the permissions necessary for their role. This level of control is crucial in enterprise settings, as it reduces the risk of security incidents and ensures a more stable and manageable IT environment.
But We Always Had Workarounds
Before the advent of more sophisticated solutions like Platform SSO, IT administrators managing Macs in enterprise environments had to rely on various workarounds to mitigate the risks associated with primary users gaining full administrative rights. These workarounds, while creative, often came with their own set of limitations and were only partially effective.
User Role Restructuring: One common approach was to manually change the primary user's role from an administrator to a standard user after the initial setup.
Scripted Solutions: Some MDM admins turned to scripting. Scripts were written and deployed to automatically adjust user privileges post-enrollment. While this automated part of the process, it still didn't offer the granularity and flexibility needed for diverse enterprise environments.
Third-party Management Tools: Another strategy involved the use of third-party Mac management tools. These tools provided more control over user accounts and privileges but often at the cost of additional complexity and expense. They also introduced a dependency on external software, which might not always align with the organization's IT policies or standards.
Policy Enforcement via Network Controls: In some cases, network-level controls and policies were implemented to restrict what administrative users could do, especially regarding network resources and critical systems. This approach was more about containment than prevention, as it did nothing to change the user's actual privileges on the Mac itself.
Each of these workarounds had its drawbacks. They were often seen as stop-gap solutions – measures that could reduce risks but not eliminate them. They also added layers of complexity and management overhead, detracting from the user experience and efficiency.
Alright! Enlighten Me
In my previous article, we discussed and explored how platform SSO presents a more integrated and streamlined approach, overcoming many of these historical challenges. The steps are in the link below:
Perhaps the most significant advancement is the ability of Platform SSO to support the on-demand creation of local accounts at the login window. When a new user authenticates using credentials from their organization's IdP, macOS can now automatically create a new local user account. This feature is a game-changer for organizations that use shared devices, as it:
Enhances Security: Each user accesses the device with their unique credentials, ensuring that activity and access are individualized and traceable.
Improves User Experience: New users can quickly get started without needing pre-configured accounts, making it ideal for environments where device sharing is common.
Reduces IT Overhead: Automating the user creation process significantly reduces the workload on IT teams, eliminating the need for manual account setup for each new user.
To achieve this, certain requirements need to be in place for the local account creation to happen.
UseSharedDeviceKeys: It's enabled by using a shared device key that allows the device to maintain a trusted connection to the Entra ID, independent of a specific user.
Connectivity with the Identity ProviderThe Mac must be able to establish a connection with your Entra ID. This connection is vital for authenticating user credentials and ensuring that the user is authorized to access the device.
Device State - Login Window with FileVault Unlocked: The device needs to be at the login window, and FileVault should be unlocked. This state ensures that the device is secure but ready to set up a new user account upon successful authentication.
MDM Support for Bootstrap Tokens: The MDM system must support Bootstrap Tokens. Bootstrap Tokens play a critical role in enabling a seamless and secure user experience, especially in scenarios involving the creation of new user accounts on macOS devices.
User Authentication: With these conditions met, users can then authenticate using their Entra ID username and password, or a SmartCard.
Assignment of User Permissions: Post-authentication, user permissions are assigned based on Identity Provider groups.
Defining Access Levels through MDM Profiles: Intune profiles profile plays a pivotal role in defining the access level of the newly created account. It can specify whether the user receives standard user permissions, administrator privileges, or permissions based on their group membership in Entra ID.
Local Account Creation with PSSO
Demo Time
Allow network users to log in at login windowusing configuration profile from Intune:
Login Screen is now enabled for allowing network users to log in to the Mac.
Currently there is only one user account available in Users & Groups
Current user logout and new user attempts log-in
("Tanush" is my son's name 😊)
Login successful and Setup Assistant is launched
User needs to go through Setup Assistant screens. There is no option to bypass this.
And once the device is released from Setup Assistant screens, the Platform SSO kicks in and user is prompted the register the device.
Device Registration
Next, User registration
Based on Authorization Group in Settings Catalog, user is created as "Standard User"
Platform SSO token
Conclusion
The enhancements in Platform SSO for macOS, particularly for shared devices, mark a significant stride in enterprise technology. By enabling on-demand local account creation at login, Apple addresses a critical need for tighter security and streamlined user management. This feature not only simplifies the Mac integration into enterprise environments but also underscores the commitment to evolving user and administrative needs.
As we wrap up this year, I'm excited about these developments and look forward to seeing how they'll improve our workflows and security.
That's all for now! I'd love to hear your thoughts and experiences with these new features. Your feedback not only enriches our shared knowledge but also helps in shaping our tech community. Here's to a year of great strides in technology, and to all of you, a fantastic year ahead!
Somesh Pathak
