Add app_sso_platform table to orbit and use table in Entra ID query ingestion (#30140)

#28621

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Added/updated automated tests
- [X] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [X] Make sure fleetd is compatible with the latest released version of
Fleet (see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)).
- [X] Orbit runs on macOS, Linux and Windows. Check if the orbit
feature/bugfix should only apply to one platform (`runtime.GOOS`).
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [X] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).

schema/osquery_fleet_schema.json

@@ -561,6 +561,43 @@
     ],
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_schemes.yml"
   },
+  {
+    "name": "app_sso_platform",
+    "platforms": [
+      "darwin"
+    ],
+    "description": "Returns device and login information parsed from the \"app-sso platform -s\" command (\"Platform SSO\" extensions).",
+    "columns": [
+      {
+        "name": "extension_identifier",
+        "type": "text",
+        "required": true,
+        "description": "Extension identifier of the Platform SSO extension (e.g. \"com.microsoft.CompanyPortalMac.ssoextension\")."
+      },
+      {
+        "name": "realm",
+        "type": "text",
+        "required": true,
+        "description": "Realm of the user that logged via Platform SSO (e.g. \"KERBEROS.MICROSOFTONLINE.COM\")."
+      },
+      {
+        "name": "device_id",
+        "type": "text",
+        "required": false,
+        "description": "Device ID extracted from \"Device Configuration\" -> \"deviceSigningCertificate\" -> Subject -> CommonName."
+      },
+      {
+        "name": "user_principal_name",
+        "type": "text",
+        "required": false,
+        "description": "User principal name of the user that logged in via Platform SSO."
+      }
+    ],
+    "notes": "This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).",
+    "evented": false,
+    "url": "https://fleetdm.com/tables/app_sso_platform",
+    "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_sso_platform.yml"
+  },
   {
     "name": "apparmor_events",
     "description": "Track AppArmor events.",

schema/tables/app_sso_platform.yml

@@ -0,0 +1,23 @@
+name: app_sso_platform
+platforms:
+  - darwin
+description: Returns device and login information parsed from the "app-sso platform -s" command ("Platform SSO" extensions).
+columns:
+  - name: extension_identifier
+    type: text
+    required: true
+    description: Extension identifier of the Platform SSO extension (e.g. "com.microsoft.CompanyPortalMac.ssoextension").
+  - name: realm
+    type: text
+    required: true
+    description: Realm of the user that logged via Platform SSO (e.g. "KERBEROS.MICROSOFTONLINE.COM").
+  - name: device_id
+    type: text
+    required: false
+    description: Device ID extracted from "Device Configuration" -> "deviceSigningCertificate" -> Subject -> CommonName.
+  - name: user_principal_name
+    type: text
+    required: false
+    description: User principal name of the user that logged in via Platform SSO.
+notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).
+evented: false