This guide provides step-by-step instructions for configuring Microsoft Single Sign-On (MSAL SISO) for shared Android devices using Workspace ONE UEM. It outlines both Entra-only and hybrid deployment models, including pre-requisites, identity configurations, and claims setup. Whether you're integrating Microsoft Entra ID directly or syncing through a third-party directory, this document walks you through the complete process—from setting up Immutable ID mappings and custom claims to enabling shared device sign-in and provisioning supported applications.
Pre-requisites
The following are pre-requisites for enabling Microsoft Single Sign-on for shared Android devices:
- A Microsoft Entra tenant
- Workspace ONE UEM 2506*
- Managed Android devices must:
- Have Workspace ONE Intelligent Hub 25.03 or higher
- Have Workspace ONE Launcher 24.11 or higher
- Be configured as a shared device with Workspace ONE Launcher
- Users that will check out the shared device must be provisioned to Workspace ONE UEM. Just-in-time (JIT) user provisioning is not supported with Microsoft SSO.
- Microsoft Authenticator must be installed and configured in Shared Device mode on the device. Please note that:
- This will involve setting up the conditional access integration between Workspace ONE UEM and Microsoft. However, you are not required to enable conditional access policies for applications in Microsoft Intune. Shared Device Mode underpins both the Microsoft Conditional Access and Single Sign-on integrations, so they share this setup process in Workspace ONE UEM.
- Workspace ONE Intelligence must be enabled for the Workspace ONE UEM environment as part of this process.
*This feature can also be enabled in Workspace ONE UEM 2410 environments on patch 12 and higher. For more assistance, please contact Workspace ONE support.
Setup
First, determine which configuration will be used for Global MSAL SISO.
¿Le resultó útil esta página?