If your Active Directory includes multiple employee user names configured with the same FirstName and LastName, you must create a custom attribute in the Devices & Users > General > Lookup Fields page in the Workspace ONE UEM console to use as the Kerberos Principal Name in the iOS SSO profile configured in the Workspace ONE UEM console.


To learn more about lookup fields in the Workspace ONE UEM console, see Devices & Users / General / Lookup Fields.


  1. In the Workspace ONE UEM console, navigate to Groups & Settings > All Settings.
  2. In the Devices & Users section, select General and then click Lookup Fields.
  3. Click ADD CUSTOM FIELD and configure the following.
    Option Description
    Option Description
    Standard Lookup Field In the drop-down menu, select User Principal Name.
    Name Enter a name for the custom look up field. For example, KerberosSPN
    Description Enter the description of this custom field, for example, Custom Kerberos User Principal Name lookup
    Allow Inheritance Select Enable.
    Custom type Select Regex Lookup.
    Regular Expression Enter ^[^@]+.
  4. Click SAVE.
    The custom lookup name is listed in the Lookup table page.
  5. To add the custom lookup name to the iOS profile, in the Workspace ONE UEM console, navigate to the iOS Resources >Profiles page and select the iOS device profile to edit. In the Single Sign-On page Kerberos Principal Name text box, enter the custom lookup name that you created.
  6. Select SAVE & PUBLISH.
    See the Workspace ONE UEM documentation, Configure an iOS Profile > Single Sign-On Profile for iOS.