Sync the Mac Password with Active Directory Using the Kerberos SSO Extension and Intune

Platform SSO=”hm-upd”>

Updated October 2026

• On macOS 13 and later Microsoft recommends Platform SSO for Microsoft Entra ID. Platform SSO can also get Kerberos tickets for on-premises Active Directory, but local password sync with Active Directory is still a Kerberos SSO extension feature.
• The Kerberos type now has more settings (for example Allow only managed apps and Request credential, macOS 12 and later), and the realm should be written in capital letters.

Screenshots are from October 2021 and show the old Microsoft Endpoint Manager admin center and macOS 12. Source: Microsoft Learn: SSO app extension settings and Apple: Kerberos SSO extension

Platforms

macOS

Products

IntuneActive Directory

Result

The Mac gets Kerberos tickets from Active Directory, and the local password matches the Active Directory password

Overview

Keep the local Mac password in sync with the Active Directory password, and get Kerberos single sign-on to on-premises resources, with the Apple Kerberos SSO extension deployed by Intune.

Single sign-on (SSO) app extensions on Apple devices (Mac, iPhone and iPad) make it easier to sign in to apps and websites. With Microsoft Intune you can deploy two of them (see SSO options for Apple devices in Intune):

• Microsoft Enterprise SSO plug-in, for apps and websites that use Microsoft Entra ID (formerly Azure AD), such as Microsoft 365 apps
• Apple Kerberos SSO extension, for apps and websites that use on-premises Active Directory

You can use both on the same Mac, in separate profiles. For example, users get SSO to Microsoft 365 apps through Microsoft Entra ID, while the Kerberos SSO extension keeps the local Mac account password in sync with the Active Directory password. Microsoft Entra ID can't sync the local password with Active Directory.

In this post I configure only the Kerberos SSO extension with local password sync. On macOS 13 and later Microsoft recommends Platform SSO for Microsoft Entra ID sign-in; Platform SSO can also hand out Kerberos tickets for on-premises Active Directory, but it syncs the local password with Microsoft Entra ID, not with Active Directory.

Prerequisites

Before you start, check that you have the following.

Configuration

One device features profile with the Kerberos SSO app extension is all you need.

Create the Kerberos SSO profile

In the Intune admin center (intune.microsoft.com) go to Devices > macOS > Configuration > Create > New policy, choose the Templates profile type and the Device features template, and name the profile (see Add device feature settings):

Under Single sign-on app extension set (see all settings):

• SSO app extension type: Kerberos
• Realm: your Active Directory realm in capital letters, for example DOMAIN.COM (my test used lowercase and still worked)
• Domains: .domain.com. Domains must start with a period and can't repeat in any other SSO app extension profile.
• Enable local password sync: Yes. It doesn't work for users signed in with an Active Directory mobile account.

Newer settings, such as Allow only managed apps, Request credential and Require LDAP connections for TLS, need macOS 11 or 12 and later. Assign the profile to the Mac users or devices.

User Experience

The user signs in to Active Directory once, and the extension syncs the Mac password.

When the profile (Extensible Single Sign-On Extension) is installed and the Mac can reach a domain controller, the user is asked to sign in with Active Directory credentials:

The Mac needs a network connection to Active Directory (local network or VPN) before the sign-in prompt appears. If the user doesn't choose Sign in automatically, macOS asks for credentials again when the Kerberos ticket expires, usually after 10 hours:

Then the extension checks the Active Directory and Mac passwords. If they don't match, the Mac password is synced:

Passwords in sync: the local Mac password now matches the Active Directory password, and the user signs in to the Mac with the Active Directory password:

To troubleshoot on the Mac, use the app-sso command in Terminal, for example app-sso -h for help or app-sso -i DOMAIN.COM for the realm details:

app-sso -h

Usage:
app-sso [options]

Options:
    -a, --authenticate REALM [opts]  Displays the login dialog for the specified realm, or end with success if already authenticated.
        -u, --username USERNAME      The username for authentication.
        -f, --force                  Display the login screen regardless if already authenticated.
        -q, --quiet                  Supress the realm information after login.
        -R, --refresh                Request a new TGT and refresh password dates.
    -d, --logout REALM               Performs a logout for the specified realm.
    -c, --changepassword REALM       Displays the change password dialog for the specified realm.
    -l, --listrealms                 Displays the list of configured realms.
    -i, --realminfo REALM            Displays the information for the specified realm.
        -v, --verbose                List the complete site code cache in the results.
    -s, --sitecode REALM             Performes a site lookup for the specified realm.
        -v, --verbose                List the complete site code cache in the results.
    -r, --reset {REALM}              Resets the cache for all realms or the specified realm.
    -k, --keychainoption REALM       Resets the save to keychain option for the specified realm.
    -p, --proceedusersetup REALM     Toggle if login prompts appear upon network state change if delayUserSetup is enabled in extension data.
    -t, --sharedsettings REALM       Prints the kerberos settings that are shared with other processes for the specified realm. For diagnostic purposes only, not intended for scripting.
    -j, --json                       Formats the output as json rather than plist format.
    -h, --help                       Prints this help.

On the domain controller, check the Windows Security log. A successful request for a Kerberos ticket (TGT) is event ID 4768: