Hi,
we are currently investigating an issue with Kerberos support in one of our apps. The apps are deployed as managed apps via MDM, together with the new extensible SSO Kerberos profile. In this scenario, Ivanti EPMM is used as MDM, and the extensible SSO configuration has placeholders for the actual user principal name that get filled with the users actual information from our directory. In general, the setup works fine, the Kerberos tickets are requested and supplied to the device, and the SSO extension is providing them to the service.
However, in our test MDM environment we enroll i.e. iPad test devices with different test users from our directory and change those users during testing to switch between defined personas.
We observed that the credentials acquired by the Kerberos SSO extension dialogue persist even after MDM unenrollment, and even after a device reset. Even if we enroll back to MDM with another user, the previous principal name shows in the SSO extension dialogue and cannot be changed.
To us, this seems like a design issue. We use same Apple ID when running these tests, so I suspect that the credential caching could be at Keychain level. Regardless of where they are cached, since the configuration was a managed one, I would expect it to clear the credentials after unenrollment and at least after a device reset.
We found some article regarding macOS on the internet, which seems to go into a similar direction however the author states that the credentials could be removed with MDM removal.
https://automatica.com.au/2026/01/remove-additional-platform-single-sign-on-credentials-saved-in-macos-when-using-psso-with-microsoft-365-entra-and-company-portal/
Question: How are we supposed to get Kerberos SSO credentials cleared on iOS devices? Is this a known issue, or something that does not work as designed?