Configure a seamless SSO Okta FastPass experience on macOS devices

Depending on your configuration, end users will have a seamless or non-seamless Okta FastPass experience:

• Seamless: End users don’t see additional Okta Verify browser prompts. Okta Verify silently signs in the user or prompts the user for Touch ID when they access an org or application that requires access.

• Non-seamless (default): End users are required to click an extra browser prompt before they sign in through Okta Verify. For example:



or

You can provide end users on managed devices with a seamless single sign-on (SSO) experience by creating an SSO extension profile that automatically forwards requests from a browser or app to Okta Verify.

Before you begin

Verify that:

• The device is managed
• The device is running macOS Catalina or later
• You are using the Safari browser
• You are familiar with these documents:
  • Jamf Pro: Computer Configuration Profiles
  • Apple:
    • Extensible Single Sign-On MDM payload settings for Apple devices
    • Introducing Extensible Enterprise SSO

Start this procedure

1. Create an SSO extension profile in your mobile device management (MDM) software, to optimize the end-user experience on Safari and Native apps.

See Create an SSO extension profile in Jamf Pro.

2. Optional. Configure Okta FastPass, to optimize the passwordless authentication experience for end users on Chrome.

   See Configure Okta FastPass .

   The following table details when an Okta FastPass experience is supported:

   Browser or app	Devices that are managed + SSO extension is configured	Devices that are managed + SSO is not configured	Devices that are not managed
   Safari	Yes	No	No
   Chrome and Firefox	Yes* Note: Okta FastPass can be triggered silently or it can require the end user to click a browser prompt. To allow end users to prevent the Open Okta Verify prompt, see Allow end users to prevent the Open Okta Verify prompt.
   Native apps that redirect to the default browser for authentication (for example, Slack, Zoom, and Box).	Yes, depending on the default browser of the device (see the previous table rows).
   Native apps that use embedded WebView (for example, Apple WKWebView, or Office 365).	Yes	No	No

   * Okta Verify must be running in the background for a seamless end-user experience.

Create an SSO extension profile in Jamf Pro

1. In Jamf Pro, go to Computers > Configuration Profiles.
2. Click + New.
3. Click the Options tab.
4. Scroll down, and then click Single Sign-On Extensions.
5. Click +Add.
6. On the Single Sign-on Extensions page, enter the following:
   1. Extension Identifier: Enter com.okta.mobile.auth-service-extension.
   2. Team Identifier: Enter B7F62B65BN.
   3. Sign-On Type: Select Credential.
   4. Realm: Enter Okta Device.
   5. Hosts: Enter your Okta org domain. For example, acme.okta.com.

   If you implement a custom URL domain in your org, click + Add, and then enter your custom URL domain. Do not include the protocol scheme (for example, don't include https://). When complete, you'll have two domains:

   • org.example.com
   • id.example.com

7. Click Save.

Related topics

• Configure a seamless SSO Okta FastPass experience for iOS devices