Mac OS and Azure AD LDAP Authentication

SebC 56 Reputation points
2020-08-10T17:30:36.227+00:00

Another forum that moved from very useful social.microsoft.com to this unfriendly Q&A site, pity!

But whatever.

There was a thread years ago about this:

https://social.msdn.microsoft.com/Forums/en-US/a06c8321-8aab-49c5-b0bc-59d9e84807bd/how-to-configure-ldap-authentication-for-mac-os-and-azure-ad?forum=WindowsAzureAD

Anybody has any info on current situation? (before I waste time to find myself that ie it does not work)

I could join my machines to local AD (which might be the case in the end), but while moving with all Windows machines to AAD/Intune, I would like to do the same with Macs (I am not yet in position to do Intune, as I do not have enough time for testing)
But at least authentication could be from AAD

Thanks

Seb

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,562 questions

11 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. SebC 56 Reputation points
    2021-05-14T13:51:17.877+00:00

    There seems to be no answer

    Or if somebody knows they keep quiet

    0 comments
  2. Matt van Vuuren 1 Reputation point
    2021-06-09T17:18:16.993+00:00

    This can be accomplished by using one of the following third-party vendors:

    • MOSYLE
    • JAMF
    • KANDJI
    • FLEETSMITH

    They have each a tool that you will install on the macOS allowing you to log into the macOS with Azure AD credentials.

    0 comments
  3. SebC 56 Reputation points
    2021-06-10T06:39:43.22+00:00

    Sure, they all chargeable.

    As stated in second post: I am about to move away (management decision) from Jams, so will not be looking into it again...

    That was then, since Jamf is long gone.

    Will wait for MS to do it themselves (as it will happen sooner or later)

    For now AD join works perfectly fine

    0 comments
  4. Truong, Bon (CIV) 1 Reputation point
    2021-06-17T18:12:35.077+00:00

    New to this thread but would love to know myself.
    Can we use MacOS's Directory Utility to achieve something like this? I also saw something called NoMad https://nomad.menu/ but that might be for on-premise. NoMad Login is now bought out by JAMF Connect which use to be open source.

    Maybe this can work in a hybrid environment with on-premise AD that syncs with AAD?

    0 comments
  5. Steffen Greve 1 Reputation point
    2021-12-01T17:06:58.67+00:00

    With your devices registered in ASM/ABM (Apple School/Business Manager) and synced to Intune you set up an enrollment program token that configures the Setup Assistant with Modern Authentication (ADE Automated Device Enrollment (formerly DEP)).

    When you login with Azure AD credential your macOS device will be created in azure ad but it will not be (binded - no need), when you are finished with Setup Assistant on the device, you will be at the desktop where after a short while all your Policies will be applied (PPPC,System extensions/Device Feature/ Device restriction/ wifi / certificate / Azure SSO extension and etc)
    Within the Setup Assistant you will be asked to create a local admin user.
    When Company portal has been installed you log into CP and log in with your Azure AD credentials, your credentials will be saved in keychain and can be used for SSO login.
    If you created Office and Outlook and Onedrive preference files that corresponds to the {{userprincipalname}} that variable will be translated to the current logged on users userprincipalname and Office/Outlook/Onedrive will do single sign in on your device. Outlook will register your license with Office 365 and OneDrive and Teams will ask you to press on the username you want to use to sign in and use SSO to handle the password.

    All in all, you do not need to bind you macOS with azure AD when using Intune and Azure SSO extension and defince {{userprincipalname}} in your prerefence files.