Entra ID

Entra ID

Control who can use which tools with Microsoft Entra ID groups. When Entra ID is set up, people sign in with their work Microsoft account, and Magic Toolbox shows only the tools their groups allow. A helpdesk team can get Command, Device Logs and LAPS, while only senior admins see Wipe and Clone.

Entra ID is set up by IT with a configuration profile. There's nothing to configure in the app itself.

---

How it works

1. Magic Toolbox reads your tenant ID, client ID and group mappings from the configuration profile.
2. Until someone signs in, the Home screen shows Sign In Required and no tools.
3. They click Sign In in the title bar. Microsoft's sign-in page opens in a browser window, where they sign in as usual, including any multi-factor authentication or Conditional Access your tenant requires.
4. Magic Toolbox asks Microsoft Graph for the person's name and the groups they're a member of.
5. It matches those group names against EntraGroupMappings and shows the tools mapped to every group they're in. A person in no mapped group sees no tools.

Sign-in uses the OAuth 2.0 authorisation code flow with PKCE. Magic Toolbox never sees the person's password, and the app registration needs no client secret.

Entra ID decides which tools appear. It doesn't change what a tool can do in Jamf Pro. That's still decided by the Jamf Pro account or API client used to connect. Give each team Jamf Pro credentials with only the privileges their tools need. See Jamf API Permissions.

---

Before you start

You need:

• a Microsoft Entra ID tenant
• a role that can create app registrations and grant admin consent, such as Application Administrator or Cloud Application Administrator
• a way to deploy a configuration profile to your Macs, such as Jamf Pro

---

1. Register Magic Toolbox in Entra ID

1. Sign in to the Microsoft Entra admin center.

2. Go to Identity → Applications → App registrations and click New registration.

3. Fill in the form:

   Field	Value
   Name	Magic Toolbox, or any name you'll recognise
   Supported account types	Accounts in this organizational directory only (single tenant)
   Redirect URI: platform	Public client/native (mobile & desktop)
   Redirect URI: value	magictoolbox://auth

4. Click Register.

5. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. These go in the configuration profile.

The redirect URI must be exactly magictoolbox://auth, all lower case, under the Mobile and desktop applications platform. If you added it under Web or Single-page application instead, sign-in fails.

Don't create a client secret or certificate. Magic Toolbox is a public client and doesn't use one.

2. Add the API permissions

1. In the app registration, open API permissions.

2. Click Add a permission → Microsoft Graph → Delegated permissions, and add:

   Permission	Why it's needed
   User.Read	Reads the signed-in person's name and email address. Usually added already
   GroupMember.Read.All	Reads the groups the signed-in person is a member of
   openid, profile, email	Standard sign-in scopes
   offline_access	Lets the app stay signed in between launches without asking again

3. Click Grant admin consent for your tenant and confirm. The status for every permission should show a green tick.

GroupMember.Read.All needs admin consent. Without it, people see a consent error when they sign in.

All of these are delegated permissions: the app acts as the signed-in person and can only read what they can read. It doesn't use any application permissions.

3. Create the groups

Create a group in Entra ID for each level of access you want, and add people to them. For example:

Group	Tools
MT-FullAccess	Every tool
MT-Helpdesk	Command, Device Logs, LAPS, MDM Command Queue, Policy Scope, Fleet Health, Network Check
MT-Auditors	The audit tools
MT-ProfileBuilders	The profile builders

Things to know:

• Groups are matched by display name, exactly, including capitals and spaces. If you rename a group in Entra ID, update the configuration profile too.
• Only direct membership counts. If a person is a member of a group that's itself a member of MT-Helpdesk, they don't get the helpdesk tools. Add people to the mapped groups directly.
• Use security groups or Microsoft 365 groups. Either works.
• Use group names that are unique in your tenant, so the wrong group can't match.

4. Add the settings to your configuration profile

Add these keys to the Magic Toolbox configuration profile, using your own IDs and group names:

<key>EntraTenantID</key>
<string>00000000-0000-0000-0000-000000000000</string>
<key>EntraClientID</key>
<string>11111111-1111-1111-1111-111111111111</string>
<key>ShowEntraSignIn</key>
<true/>
<key>EntraGroupMappings</key>
<dict>
    <key>MT-FullAccess</key>
    <array>
        <string>*</string>
    </array>
    <key>MT-Helpdesk</key>
    <array>
        <string>Command</string>
        <string>Device Logs</string>
        <string>LAPS</string>
        <string>MDM Command Queue</string>
        <string>Policy Scope</string>
        <string>Fleet Health</string>
        <string>Network Check</string>
    </array>
</dict>

• * gives a group every tool.
• Tool names must match the list of tool names exactly.
• EntraTenantID can also be a verified domain, such as example.onmicrosoft.com.

Managed Preferences has a complete example plist and the steps to build and deploy the profile in Jamf Pro.

5. Test it

1. Deploy the profile to a test Mac, or test it locally.
2. Open Magic Toolbox. The Home screen should show Sign In Required, with a Sign In button in the title bar.
3. Sign in with an account in one of your mapped groups. You should see only that group's tools.
4. Open Preferences → Entra ID Integration to check the tenant, client ID and number of group mappings the app has received.

---

What people see

The Sign In button. In the title bar, next to the appearance button. While signing in, it shows a spinner. Once signed in, it shows the person's first name in green. Click the name and choose Sign Out to sign out.

Signing in. Microsoft's sign-in page opens in a private browser window, so it doesn't use cookies from Safari or other browsers. After signing in, a Welcome message appears and the tools load.

If sign-in fails, an orange warning icon replaces the button. Click it to see Microsoft's error message, then Try Again.

Preferences → Entra ID Integration. This section only appears when Entra ID is set up. It shows:

• the tenant ID
• the last eight characters of the client ID
• how many group mappings the profile has
• who is signed in, with a Sign Out button
• Show Sign In button in title bar, which people can switch off unless ShowEntraSignIn is set in the profile. Then it shows Managed and can't be changed

---

Staying signed in

• After signing in, Magic Toolbox keeps a refresh token, plus the person's name and email address, in the macOS Keychain, on this Mac only. The Keychain service is au.mdmmagic.toolbox.entra.
• It also remembers which tools the person was allowed, so the Home screen appears straight away at the next launch.
• At each launch, it uses the refresh token to sign in again in the background, and re-reads the person's groups. Changes to group membership take effect the next time the app opens, or when the person signs out and in again.
• If the background sign-in fails, for example because the Mac is offline, the token has expired or been revoked, or the person has been disabled in Entra ID, the person is signed out and needs to sign in again.
• Sign Out deletes the refresh token, name, email and remembered tools from this Mac.

To sign someone out everywhere, revoke their sessions in Entra ID. Each Mac signs them out the next time Magic Toolbox opens.

---

Troubleshooting

There's no Sign In button.

• Both EntraTenantID and EntraClientID must be in the profile. Check what the Mac has received with defaults read "/Library/Managed Preferences/au.mdmmagic.MagicToolbox".
• ShowEntraSignIn might be set to false in the profile, or the person may have switched the button off in Preferences → Entra ID Integration.

"Sign In Required" never goes away, but I don't want people to sign in. Remove EntraTenantID and EntraClientID from the profile. To limit tools without sign-in, use AllowedTools instead. See Managed Preferences.

I signed in but see "No tools available".

• You're not a direct member of any group in EntraGroupMappings. Nested groups don't count.
• The group name in the profile doesn't match the group's display name in Entra ID exactly.
• The tool names in the profile are misspelled. Check them against the list of tool names.
• AllowedTools is also set, and none of your Entra tools are in it. Only tools in both lists appear.

Sign-in fails with a message about the redirect URI. The app registration doesn't have magictoolbox://auth as a redirect URI under Mobile and desktop applications. Add it there, exactly as written.

Sign-in fails with a message about consent or approval. Admin consent hasn't been granted. In the app registration, open API permissions and click Grant admin consent.

Sign-in fails saying the application wasn't found in the directory. EntraClientID is wrong, or the app registration is in a different tenant from EntraTenantID.

I'm signed out every time I open the app. The background sign-in is failing. Check the Mac can reach login.microsoftonline.com and graph.microsoft.com, and that a Conditional Access policy isn't blocking refresh tokens for this app.

I was added to a group but still don't see the tools. Quit Magic Toolbox from the menu bar icon and open it again, or sign out and back in. Group changes in Entra ID can also take a few minutes to apply.

---

Network access

When Entra ID is set up, Magic Toolbox also connects to:

Host	What for
login.microsoftonline.com	Signing in, and refreshing the sign-in at launch
graph.microsoft.com	Reading the signed-in person's name, email address and group memberships

Nothing about the person or their groups is sent to MDM Magic. See Privacy and Security.

---

Related

• Managed Preferences: build the configuration profile, with a full example
• Jamf API Permissions: give each team only the Jamf Pro privileges they need
• Security FAQ