Configure an SSO Extension Policy for iOS

When using an identity provider (IdP) other than JumpCloud, a SSO Extension policy uses Apple's Extensible Single Sign-On to allow users on managed iOS devices to seamlessly access their resources without requiring them to re-authenticate.


The information used to supply the policy template should be available from your IdP’s Knowledge Base, with instructions on how to properly configure the SSO Extension.


To create a SSO Extension policy for iOS:

  1. Log in to the JumpCloud Admin Portal.
  2. Go to DEVICE MANAGEMENT > Policy Management.
  3. In the All tab, click (+).
  4. On the New Policy panel, select the iOS tab.
  5. Select the SSO Extension policy from the list, then click configure.
  6. Under Settings, configure the Extension Type:
    1. Credential: via username and password (challenge and response authentication, like Kerberos)
    2. Redirect: via identity provider URL; modern authentication methods like OIDC, OAuth and SAML. Instead of loading a login page, the OS will redirect the request to the extension
  7. Extension Identifier: Enter the bundle identifier of the app extension that will perform single-sign on. Find this identifier by inspecting the app’s info.plist file.
  8. When Extension Type is set to Credential, you will see options for:
    1. Realm: Displayed only when Extension Type is set to Credential. Enter the capitalized realm name for the credential. This field is typically used for Kerberos extensions to identify the Kerberos realm. 
    2. Hosts: Enter the domains names or host names of sites or applications that can be authenticated through the extension. These names must be unique across all SSO extension profiles installed on the device.
  9. When Extension Type is set to Redirect, you will see:
    1. URLs: Specify the URL prefixes of identity providers on whose behalf the app extension will authenticate. Parameters and fragments are not permitted; URLs must begin with https:// or http:// and be unique across all SSO extension profiles installed on the device.
  10. Additional Settings: Specify one or more key-value pairs that you want to pass to the app extension to modify the app.
    1. For example, department: engineering or disableLogging: true
  11. (Optional) Select the Device Groups tab. Select one or more device groups where you’ll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
  12. (Optional) Select the Devices tab. Select one or more devices where you’ll apply this policy.


For this policy to take effect, you must specify a device or a device group.

  1. Click Save.


After you create and bind an iOS policy to a device, you do not need to activate the policy; the iOS policy is effective immediately.

Back to Top

Still Have Questions?

If you cannot find an answer to your question in our FAQ, you can always contact us.

Submit a Case