Forum Discussion
Platform SSO + Secure Enclave: True Passwordless macOS Sign-in with Entra ID?
Yes—Platform SSO with the Secure Enclave authentication method is Microsoft’s supported passwordless option and is conceptually similar to Windows Hello for Business. In the Intune Settings Catalog, change Platform SSO Authentication Method to UserSecureEnclaveKey for macOS 14 or later, keep the Microsoft Enterprise SSO plug-in identifiers and registration token configured, and ensure Company Portal 5.2404 or later plus Microsoft Authenticator are installed before assignment. Target a pilot group and allow users to register using MFA or a Temporary Access Pass; optionally require Touch ID through UserSecureEnclaveKeyBiometricPolicy. One important limitation remains: Secure Enclave does not replace or synchronize the local Mac password. Users must still enter that local password after startup for FileVault unlock, after which Touch ID and the hardware-bound credential provide unlock and Entra SSO. Remove any older separate SSO extension profile, because only one Platform SSO policy can apply.
That's a bit bummer this last part:
"One important limitation remains: Secure Enclave does not replace or synchronize the local Mac password. Users must still enter that local password after startup for FileVault unlock, after which Touch ID and the hardware-bound credential provide unlock and Entra SSO."
So, it does mean the local account on MAC still unmanaged, it be much nicer if it would be like on Windows with Windows Hello, that one could log in with Entra Password beside the Biometrics or PIN.
So, the choice either use Secure Enclave or Password in authentication, seems password choice is the most frictionless support model, since it is easier to help/manage.
One thing, even if secure enclave is chosen and user still need to unlock with old local password, it seems it also bounds in touchID, so you both unlock the File Vault and the Entra SSO for all the apps.