Which two data elements are required to configure the iOS Mobile SSO profile? (Choose two.)

Question

Options

• ARealm
• BService Principal
• CEmail Address
• DiOS Version
• ERenewal Certificate

• A
  83% (33)
• B
  5% (2)
• C
  10% (4)
• D
  3% (1)

Explanation

Configuring the iOS Mobile SSO profile (commonly in platforms like Okta or similar MDMs using Kerberos-based SSO) requires a Realm to define the Kerberos authentication domain (e.g., COMPANY.COM) and a Renewal Certificate to establish trusted identity between the device and the identity provider - both are mandatory fields in the profile configuration. Without the Realm, the SSO system has no domain context to authenticate against, and without the certificate, there is no secure credential to bind the profile to the device.

Why the distractors are wrong:

• B (Service Principal): While SPNs exist in Kerberos environments, they are not a required input field when configuring the iOS Mobile SSO profile itself.
• C (Email Address): This is a user attribute, not a profile configuration parameter.
• D (iOS Version): A device characteristic, not something you configure in an SSO profile.

Memory tip: Think "R&R" - Realm and Renewal Certificate. Both start with concepts of establishing trust: the Realm defines where to authenticate, and the Renewal Certificate defines who is trusted to do it.

No community discussion yet for this question.