To support Sign in with Apple on your website, or in your app on another platform, configure your developer account to associate a Sign in with Apple-enabled app with a Services ID and a private key.

To use Apple sign in, you need a client ID, Team ID, Key ID, and private key. You can get them from the Apple Developer Portal, then use them to generate the client secret JWT. You will need an active Apple Developer account to access the developer portal and generate these credentials.

Discussion You must obtain a client identifier from WWDR before you can use Sign In with Apple.

After you add Apple as one of your application's sign-in options, customers can sign in to Microsoft Entra External ID with an Apple account. Learn more about authentication methods and identity providers for customers.

Use Sign in with Apple to let your users sign in to your app’s accompanying website with their Apple Account. To configure web authentication, you must create a Services ID and associate your website to an existing primary iOS, macOS, tvOS, or watchOS App ID enabled for Sign in with Apple.

To enable users to sign in using an Apple ID, you need to add the Apple identity provider to a user flow. Sign in with Apple can be configured only for the recommended version of user flows.

The identifier for the client at the identity provider.

Learn how to configure Sign in with Apple as an identity provider for your App Service or Azure Functions app.

For users who don’t sign in after the transfer, you must generate an access token and use it to obtain your team-scoped identifier. Generate the access token with your client credential and provide scope as `user.migration` using the following HTTP POST method.

To configure SSO, you apply the necessary configuration using a device management service. The configuration needs to include information about the Single Sign-on extension communicating with the IdP, as well as which apps and Safari web URLs are allowed to use SSO or restricted from using it.