Microsoft Single Single-on (SSO) for Shared Android Devices

By enabling Microsoft SSO for shared Android devices, you can seamlessly sign your shift workers into mobile applications when they check out a shared device. This feature enables single sign-on into:

• Many first-party Microsoft apps, such as Microsoft Teams. A list of first-party Microsoft apps that support this mode of single sign-on can be found here.
• Any other application that supports Microsoft's Shared Device Mode using the Microsoft Authentication Library (MSAL).

When users check out a shared Android device through Workspace ONE Launcher, they are prompted to authenticate with Microsoft Entra ID. This authentication signs them into applications that support this feature. When the user logs out of Workspace ONE Launcher, Workspace ONE UEM automatically signs them out of these applications as well, ensuring a consistent and secure shared device environment.

This section provides a step-by-step instructions for configuring Microsoft Single Sign-On, also known as Microsoft SSO, for shared Android devices using Workspace ONE UEM. It supports both Entra-only and hybrid deployment models and covers all essential setup components—including prerequisites, identity configurations, Immutable ID mappings, custom claims, and enabling shared device sign-in.

Pre-requisites

The following are pre-requisites for enabling Microsoft Single Sign-on for shared Android devices:

• A Microsoft Entra tenant

• Workspace ONE UEM 2506*

• Managed Android devices must have:

  • Workspace ONE Intelligent Hub 25.03 or higher
  • Workspace ONE Launcher 24.11 or higher
  • Shared device with Workspace ONE Launcher

• Users that will check out the shared device must be provisioned to Workspace ONE UEM. Just-in-time (JIT) user provisioning is not supported with Microsoft SSO.

• Microsoft Authenticator must be installed and configured in Shared Device mode on the device. Please note that:

  • This will involve setting up the conditional access integration between Workspace ONE UEM and Microsoft. However, you are not required to enable conditional access policies for applications in Microsoft Intune. Shared Device Mode underpins both the Microsoft Conditional Access and Single Sign-on integrations, so they share this setup process in Workspace ONE UEM.
  • Workspace ONE Intelligence must be enabled for the Workspace ONE UEM environment as part of this process.

• You can integrate a single Entra ID tenant with multiple Workspace ONE UEM environments. Each Workspace ONE UEM Organization Group (OG) where you wish to configure the same Entra ID tenant for Microsoft SSO for Shared Devices must belong to a distinct Workspace ONE UEM environment. In other words, you can have one Entra ID tenant for multiple UEM environments, but you cannot have one Entra ID tenant for multiple OGs in a single UEM environment.

*This feature can also be enabled in Workspace ONE UEM 2410 environments on patch 12 and higher. For more assistance, please contact Workspace ONE support.

Setup

First, Determine the Microsoft SSO Configuration configuration will be used for Global Microsoft SSO. There are two high-level configurations for the Microsoft SSO feature. Which configuration is used depends on how users are provisioned to Workspace ONE UEM:

• Entra-Only- Users are provisioned to Workspace ONE UEM directly from Microsoft Entra ID. For example: Omnissa Identity Services can be used to provision users from Microsoft Entra ID to Workspace ONE UEM using the SCIM protocol.
• Hybrid- Users are provisioned from an on-premises or 3rd-party cloud directory to both Workspace ONE UEM and Microsoft Entra ID.

An Immutable ID is a user attribute that can be used to identify the user across all three systems: the originating directory, Workspace ONE UEM, and Microsoft Entra ID. It is also called the source anchor. The user attribute that will be used as the Immutable ID is defined when users are synced into Microsoft Entra ID. It is most commonly the mS-DS-ConsistencyGuid. For example, when provisioning users from an on-premises directory server to Microsoft Entra ID, the Microsoft Entra Connect application will choose the mS-DS-ConsistencyGuid by default as the Immutable ID. When users authenticate with Microsoft to check out a shared Android device, the Immutable ID is used by Workspace ONE UEM to identify the user.

You can check if an Immutable ID has been populated for your users in Microsoft Entra ID by:

1. Logging into the Microsoft Entra ID portal
2. Navigating to Users
3. Selecting a user account that was synced from the separate directory
4. Navigating to Properties > On-premises

Configure Microsoft Single Sign-on

In the Workspace ONE UEM Console, you will configure the Microsoft Single Sign-on integration in the Directory Services settings page. You will then enable MSAL Global Sign-on at specific Organization Groups in the Android Intelligent Hub settings page.

Navigate to Groups & Settings > All Settings > System > Enterprise Integration > Directory Services, and:

1. Enable Use Azure AD for Identity Services.

2. If you are using the Hybrid configuration:

   • Set the Immutable ID Mapping Attribute to the user property that is utilized as the Immutable ID when syncing users into Microsoft Entra ID.
   • Select the Mapping Attribute Data Type based on the attribute is of type Binary or String. If Immutable ID Mapping Attribute is set to mS-DS-ConsistencyGuid, set the type to Binary.

3. Enable Android Shared Device Checkout. You will be redirected to Microsoft Entra. Log in with an administrator account for your Microsoft Entra tenant and authorize Workspace ONE UEM to obtain information about your directory users. This will be necessary for Workspace ONE UEM to identify what user authenticated with Entra during device checkout. Once you complete the authorization flow, you will be redirected to the Workspace ONE UEM Console.

4. Switch to the browser tab for the Workspace ONE UEM Console.

5. Select Complete.

To verify that the application has been authorized successfully for your Microsoft Entra tenant:

1. Log into the Microsoft Entra ID Console.
2. Navigate to Enterprise Applications.
3. Confirm that Workspace ONE UEM MSAL SSO is listed.

Sync User Attributes(Hybrid Only)

After you set an Immutable ID Mapping Attribute in the Directory Services settings, a user attribute sync is required. This will pull the Immutable ID for users into Workspace ONE UEM.

Navigate to Groups & Settings > All Settings > System > Enterprise Integration > Directory Services > Users tab.

Under Advanced* select Sync Attributes.

Configure Custom Claims in MSFT Entra (Hybrid only)

For Hybrid configurations, administrators must configure Microsoft Entra ID to issue the custom Immutable ID claim to Workspace ONE UEM.

Add Immutable ID as a Custom Claim

Add Immutable ID as a custom claim for the Workspace ONE UEM MSAL SSO application in the Microsoft Entra admin center.

1. Log into the Microsoft Entra admin center.
2. Navigate to Enterprise Applications and select Workspace ONE UEM MSAL SSO
3. Open the Single Sign-On menu
4. Select Edit next to Attributes & Claims
5. Select Add New Claim
6. In the Manage Claim blade, set:
   • Name: on-premises-immutable-id
   • Source: Attribute
   • Source attribute: user.onpremisesimmutableid

Add Custom Signing Key to Service Principal

To issue custom claims like Immutable ID in a secure manner, add a custom signing key to the Workspace ONE UEM MSAL SSO service principal in your Microsoft Entra tenant. The custom signing key consists of a public key file, a private key file, and the password used to decrypt the private key file.

Omnissa provides a Powershell script that administrators can use to set the custom signing key. You may either:

• Provide the private and public key files (e.g. issued by an internal Certificate Authority)
• Use a self-signed custom signing key generated by the script

While running the script, you will be asked to authenticate with Microsoft Entra and authorize the Powershell script to make these changes. You will need to use an Entra administrator account that has the permissions required to modify Entra applications for your tenant (e.g. Application Administrator role).

For more information on custom signing keys, see Microsoft’s article on this topic.

Prepare to run the script

1. Download the Powershell script provided in the Omnissa Customer Connect Downloads. The script is named Set Custom Signing Key - Microsoft SSO. If you will be providing your own private-public key pair, download these as well.

2. Launch Powershell as an administrator.

3. In the Powershell console, switch to the directory where the script file is saved.

4. In the Microsoft Entra ID, copy:

   • The Microsoft Entra Tenant ID for your organization
   • The Object ID of the Workspace ONE UEM MSAL SSO service principal added to your Microsoft Entra tenant. To find this value:
     1. Log into the Microsoft Entra Admin Portal.
     2. Navigate to Enterprise applications.
     3. Select Workspace ONE UEM MSAL SSO.
     4. In the Overview tab, copy the Object ID.

If you are using a self-signed custom signing key generated by the script:

1. Copy the following command:

   ./setCustomSigningKey2.ps1 -CertFriendlyName "XXX" -Password "XXX" -TenantId "XXX" -ApplicationObjectId "XXX" -SelfSigned “Y”
   

2. In a text editor, replace XXX for all arguments in the command as follows:

   • CertFriendlyName: Set a friendly name for the custom signing key. The IssuedTo and IssuedBy fields for the self-signed key will be set to CN=$CertFriendlyName.
   • Password: The password that the script will use to generate the self-signed private key.
   • TenantId: The Microsoft Entra tenant ID for your organization
   • ApplicationObjectId: The Object ID of the Workspace ONE UEM MSAL SSO service principal added to your Microsoft Entra tenant.

If you are providing a public-private key pair that should be set as the custom signing key:

1. Copy the following command:

 ```

./setCustomSigningKey2.ps1 -CertFriendlyName "XXX" -Password "XXX" -TenantId "XXX" -ApplicationObjectId "XXX" -cerFile "XXX" -pfxFile "XXX” -SelfSigned “N”
 ```

3. In a text editor, replace XXX for all arguments in the command as follows: - CertFriendlyName: Set a friendly name for the custom signing key. - Password: The password of the private key file provided in pfxFile. - TenantId: The Microsoft Entra tenant ID for your organization - ApplicationObjectId: The Object ID of the Workspace ONE UEM MSAL SSO service principal added to your Microsoft Entra tenant - cerFile: The path to the public key file (.cer) - pfxFile: The path to the private key file (.pfx)

Run the Powershell script

To run the script:

1. Copy the completed command and paste it in the Powershell console.
2. Execute the command.
3. When prompted, log in using a Microsoft Entra administrator account and authorize the script. The administrator account must have the rights to modify applications (e.g. Application Administrator).

Enable Microsoft Single Sign-on

Enable Microsoft Single Sign-on for shared Android devices at the desired Organization Group.

1. Navigate to Groups & Settings > All Settings > Devices & Users > Android > Intelligent Hub Settings.
2. Enable Global sign-in/sign-out using MSAL.
3. Select Save.

Provision Applications that Support Microsoft Shared Device Mode

Install any application that supports Microsoft Shared Device Mode, such as Microsoft Teams and Outlook. A full list of first-party Microsoft applications supporting this mode can be found here. Third-party applications that integrate MSAL and support Shared Device Mode can also be used.

Check Out the Shared Device

On the shared Android device, select Log In. Microsoft Authenticator will be launched to the foreground. Once you complete authentication with Microsoft Entra ID, you will be redirected back to Workspace ONE Launcher, and the device checkout process will continue as usual.

Launch the applications supporting Microsoft Shared Device Mode. You will be signed in without need for further authentication.