Configuration profile for Associated Domains settings for macOS devices

This document explains how to use a configuration profile for Associated Domains settings on macOS devices.

Associated domains establish a secure connection between an application and a website, enabling features like shared credentials or seamless integration between the app and the website. Organizations aiming to launch application versions of their websites can establish a connection between their apps and websites using associated domains. This allows their apps to access features such as Extensible App Single Sign-On, shared web credentials, Handoff, App Clips, and universal links. On macOS devices, associated domains between an application and a website can also be established using a custom configuration profile, as explained in the following document. Hexnode’s Deploy Custom Configuration feature helps IT admins install configuration profiles on macOS devices enrolled in Hexnode UEM.

Set Associated Domains

The following sample configuration profile can be used to set associated domains on macOS devices. This profile will help applications access services such as shared web credentials, Universal Links, Handoff, and App Clips from a specific domain. The configuration profile uses the com.apple.associated-domains payload to configure associated domains. The applications are identified by their app identifier in the ApplicationIdentifier field, and the website domains are specified in the AssociatedDomains field.

Ensure that you have an apple-app-site-association (AASA) file on your website and the appropriate entitlement in your application. An associated domain matches the associated domains entitlement in your app with the apple-app-site-association file on your website.

Before deploying the configuration profile make sure to do the following changes:

• Enter the Application Identifier of your application in place of “Provide your Application Identifier” in the profile.
• Enter the domain name with a fully qualified hostname in place of “specify the service and the websites domain” in the profile.

The above configuration profile uses the following keys to set associated domains:

1. Configuration (Required)

   This key defines the dictionary of keys used to specify the associated domains.

2. ApplicationIdentifier (Required)

   This key defines the app identifier for the application to be linked to a website.

3. AssociatedDomains (Required)

   This key can be used to define the domains of your website. While defining a domain, use fully qualified hostnames, for example, “www.itletters24.com”. This key can also be used to define domains for specific services such as shared web credentials, Universal Links, Handoff, and App Clips. They should be specified in the form of “service:www.itletters24.com”. The following table describes the types of supported associated domain services and their purposes:

   Service	Purpose
   webcredentials	Shared web credentials
   applinks	Universal links
   activitycontinuation	Handoff
   appclips	App Clips

4. EnableDirectDownloads

   On devices running macOS 11 and later, applications request AASA (apple-app-site-association) files from an Apple-managed CDN (content delivery network) to associate a domain. These files contain the data required for associating the domains. When this key is set to true, the application downloads the data directly from the website’s server instead of from a CDN.

What happens on the device end?

After successfully installing the profile on a macOS device, the device identifies the application and website using the values provided in the profile and configures an associated domain. For example, the image below illustrates the successful profile installation, associating the domain between the application ‘itletters24‘ and the website ‘www.itletters24.com‘.



Notes:

• To create and customize configuration profiles, you can use tools like Apple Configurator, Profile Manager or manually create them using text editors.
• Use non-encrypted .mobileconfig, .xml, or plist files to deploy profiles across devices.
• Ensure that you do not associate conflicting configurations with the devices.
• It is recommended to manually validate the configuration profile on a system before executing it in bulk.
• Hexnode will not be responsible for any damage/loss to the system on the behavior of the configuration profile.