- Platforms
- macOS
- Products
- IntuneEntra IDCompany Portal
- Result
- Users sign in to the Mac with their Entra ID password, kept in sync with the local account
Overview
Let users sign in to their Mac with Microsoft Entra ID credentials and get single sign-on to apps, with Platform SSO set up in an Intune settings catalog profile.
Platform Single Sign-on (SSO)is an evolution of the Extensible Single Sign-on (SSOe) MDM payload that improves the SSO experience on Apple devices (iPhone, iPad, Mac). The Platform SSO extension works at the macOS login window, so users can sign in to their Mac with their identity provider (IdP) credentials (e.g. Microsoft Entra ID (formerly Azure AD)) and are then signed in to corporate apps and websites automatically. The local account password is kept in sync with the identity provider, so the cloud and local passwords are always the same. As a result, users need to remember only one password across their devices, and SSO to apps works as soon as they sign in. The extension supports two authentication methods:
- Password authentication: the user signs in with the local or identity provider (IdP) password.
- Secure Enclave-backed key authentication: establishes SSO but does not change the local account password on the device.
Apple announced Platform SSO at WWDC 2022. In Q3 2023, Microsoft Intune added preview support for it on managed Macs, using an updated version of the Company Portal app (not yet officially released at the time of writing). For details on how to join the preview, see Coming Soon – Platform SSO for macOS.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 | Licensing |
| Admin role | Device configuration Read, Create, Update and Assign permissions, for example Policy and Profile manager | Roles |
| Intune | Macs enrolled with Automated Device Enrollment or Device Enrollment (User Enrollment isn't supported) | Enrollment |
| Entra ID | Users allowed to register and join devices to Microsoft Entra ID | Permissions |
| Devices | macOS 13 or later, macOS 14 or later recommended | Requirements |
| Company Portal 5.2404.0 or later | Company Portal |
Configuration
With the prerequisites in place, create the settings catalog profile.
Configure the Extensible SSO MDM payload with an Intune Settings Catalog profile:
Settings category: Authentication > Extensible Single Sign On (SSO)
- Authentication Method: Password
- Registration Token: {{DEVICEREGISTRATION}}
- Extension Identifier: com.microsoft.CompanyPortalMac.ssoextension
- Screen Locked Behaviour: Do Not Handle
- Team Identifier: UBF8T346G9
- Type: Redirect
- URLs:
https://login.microsoftonline.com
https://login.microsoft.com
https://sts.windows.net
https://login.partner.microsoftonline.cn
https://login.chinacloudapi.cn
https://login.microsoftonline.us
https://login-us.microsoftonline.comDeploy the Settings Catalog policy to managed Mac devices:
The SSO extension profile installed on a device:
To check that the device is registered correctly, run this command in Terminal:
app-sso platform -s
User Experience
A short video showing how a user registers the device with Microsoft Entra ID to start Platform SSO, and then signs in to the Mac with Microsoft Entra ID password that was synced from the cloud to the local account: