Introduction

As organizations accelerate their journey to passwordless authentication, Microsoft’s Platform SSO for macOS offers a seamless, secure, and user-friendly experience for device and application sign-in. Built on Apple’s SSO framework and tightly integrated with Microsoft Entra ID, Platform SSO empowers users to leverage modern authentication methods Touch ID, smart cards, and passkeys across their macOS devices, enterprise apps, and browsers.

In this blog, we’ll walk through the essentials of Platform SSO, supported authentication methods, configuration steps, and best practices for deployment in enterprise environments.

What is Platform SSO for macOS?

Platform SSO is a Microsoft feature for macOS (13+) that leverages Apple’s SSO framework to enable single sign-on using Entra ID credentials. Users benefit from passwordless authentication, enhanced security, and a consistent experience whether logging into their device, enterprise applications, or web browsers.

Key highlights:

• Passwordless sign-in: Use Touch ID (Secure Enclave), smart cards, or passwords for device and app authentication.
• Enterprise SSO plug-in: Activated for both application and browser-based sign-in, ensuring centralized identity management.
• No agent required: Utilizes built-in macOS platform capabilities for easy deployment and management.

Authentication Methods Supported by Platform SSO

Platform SSO supports three primary authentication methods on macOS:

Secure Enclave:

Recommended for most users, Secure Enclave uses hardware-bound cryptographic keys for app and web sign-ins, enabling passwordless and phishing-resistant MFA. After a reboot, users enter their local password once, then Touch ID can be used for subsequent unlocks. The device receives a hardware-backed Primary Refresh Token (PRT) for device-wide SSO.

Smart Card:

Ideal for high-security or compliance-driven environments, Smart Card authentication provides complete passwordless sign-in and unlock. After sign-in, the device receives a PRT and Workplace Join (WPJ) certificate for seamless SSO to Microsoft 365, Safari, and Entra-protected apps.

Password:

Users sign in with their Entra ID password, which syncs to the local account for SSO across apps. Intune password policies ensure alignment with Entra ID password rules, preventing sync or sign-in issues.

How Platform SSO Works

When a Mac device joins a Microsoft Entra ID tenant, it receives a hardware-bound WPJ certificate accessible only by the Microsoft Enterprise SSO plug-in. Apps and browsers require this certificate to access resources protected by Conditional Access policies. Platform SSO is configured using the Intune settings catalog and should ideally be assigned at device enrollment, but can also be applied to existing devices.

Deployment Steps

• Device Enrollment in Intune: Organization-owned devices use Apple Business Manager or Apple Configurator; personally-owned devices enroll via Company Portal.
• Prerequisites: macOS 13+, Intune Company Portal app v5.2404.0+, supported browsers (Edge, Chrome with SSO extension, Safari), Intune RBAC permissions.
• Create Platform SSO Policy in Intune: Enable Platform SSO, select authentication method (Secure Enclave, Password, Smart Card), assign to user groups.

• Define Policies in Platform SSO Settings: Assign to users or groups with user affinity; avoid assigning to device groups to prevent Conditional Access issues.

• Enable MDM Push Certificate: Required for macOS enrollment in Intune.

• Deploy Company Portal App: Via Intune or manually from https://aka.ms/EnrollMyMac.

• Enroll Device and Validate Profiles: Sign in to Company Portal with Entra ID credentials and confirm device management profile.

Customizing the macOS Login Experience

Platform SSO allows administrators to push Login Window Text and Show Full Name settings from Intune, enabling a personalized and informative login experience for users. These settings help display the user’s full name and custom messages during sign-in, improving clarity and branding.

Best Practices

• Assign Platform SSO policies during device enrollment for a seamless experience.
• Ensure password policies in Intune and Entra ID are aligned.
• Use Secure Enclave for most users; Smart Card for compliance scenarios.
• Regularly review group memberships and issuer assignments for certificate-based authentication.
• Document all scoped policies for compliance and troubleshooting.

Conclusion

Microsoft Platform SSO for macOS is a game-changer for organizations seeking secure, passwordless authentication across devices and applications. By leveraging Entra ID credentials, Touch ID, smart cards, and passkeys, IT teams can deliver a modern, seamless, and secure experience for users while maintaining compliance and reducing operational overhead.

Ready to get started? Explore the official documentation and accelerate your passwordless journey today!