Hey all!

As you may have seen on the release notes of Jamf Connect, there is an upcoming change on Microsoft Azure side which impacts how Jamf Connect works.

https://docs.jamf.com/jamf-connect/2.16.0/documentation/Release_History.html

Microsoft Azure AD Change Required
If Microsoft Azure AD is your IdP, upcoming changes to Microsoft Authentication Library (MSAL) require changes to your Jamf Connect configuration. Existing applications remain functional, but in December 2022 Microsoft will discontinue security updates for Azure Active Directory Authentication Library (ADAL), deprecating the use of common endpoints.

More information about the change can be found here: https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-migration

At this point current configurations and plists continue to work, even when upgrading Jamf Connect to version 2.16, but in order to prepare for the upcoming change you should tweak your configurations.

This is why the Jamf Connect Configuration tool will warn you about some missing keys if you attempt to test the ROPG workflow.

The information entered applies to all Jamf Connect products and is required to use ROPG test in Jamf Connect Configuration. If both of these fields are left blank, you will now receive an alert that a required field is missing. This helps you set up your configuration correctly.

So what do we need to change?

If we look at a minimal Azure compatible plist for Jamf Connect and Jamf Connect Login prior to the change, it should look like this:

  • Jamf Connect Login (minimum required keys):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>OIDCClientID</key>
	<string>1d884884-AAAA-BBBB-CCCC-71548a60aa76</string>
	<key>OIDCProvider</key>
	<string>Azure</string>
</dict>
</plist>
  • Jamf Connect Menu Bar (minimum required keys):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>IdPSettings</key>
	<dict>
		<key>Provider</key>
		<string>Azure</string>
		<key>ROPGID</key>
		<string>ee5e1b74-AAAA-BBBB-CCCC-f7a8964c6982</string>
	</dict>
</dict>
</plist>

In order to prepare or the upcoming change you need to ad your Tenant ID to both plists. Please note the different keys for Jamf Connect Login (OIDCTenant) and Jamf Connect Menu Bar (TenantID). Also note that the key for the Menu Bar plist needs to be put inside of the IdPSettings dictionary.

Your Tenant ID can be found in the Azure portal on the main page of the Azure Active Directory blade:

  • Jamf Connect Login (NEW minimum required keys):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>OIDCClientID</key>
	<string>1d884884-AAAA-BBBB-CCCC-71548a60aa76</string>
	<key>OIDCProvider</key>
	<string>Azure</string>
        <key>OIDCTenant</key>
        <string>af72a024-AAAA-BBBB-CCCC-fd66bf369fcc</string>
</dict>
</plist>
  • Jamf Connect Menu Bar (NEW minimum required keys):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>IdPSettings</key>
	<dict>
		<key>Provider</key>
		<string>Azure</string>
		<key>ROPGID</key>
		<string>ee5e1b74-AAAA-BBBB-CCCC-f7a8964c6982</string>
                <key>TenantID</key>
                <string>af72a024-AAAA-BBBB-CCCC-fd66bf369fcc</string>
	</dict>
</dict>
</plist>
Note: please note that the above plist are very basic configurations. Your plists will probably look a bit more complex. Just make sure to put the Tenant ID keys at the right place. Especially for Menu Bar (inside IdPSettings). For Jamf Connect Login the plist is typically just a long list of keys.

As always, please test your new configuration both in the Jamf Connect Configuration tool, as well as live on a physical test machine you deploy your new configuration to.

Reminder: this change is mandatory prior to the upcoming change on Microsoft Azure AD, scheduled for December 2022.

That’s it for now! As always, if you liked the post, hit the like button, tell your friends about it and leave a comment down below!

Brgds,
TTG