Forum Discussion

King_Rustamus's avatar
King_Rustamus
Copper Contributor
Aug 07, 2026

Platform SSO + Secure Enclave: True Passwordless macOS Sign-in with Entra ID?

Hi all, I'm testing macOS DEP/ADE + Intune + Platform SSO with Microsoft Entra ID. I have the Mac successfully enrolling through ADE, becoming Entra joined, and users can authenticate against Entra...
intune
mobile device management (mdm)
Jason_M's avatar
Jason_M
Iron Contributor
Aug 10, 2026

Yes, but with an important qualification: Secure Enclave Platform SSO provides a Windows Hello-like passwordless credential for Microsoft Entra authentication and SSO, but it does not completely remove the Mac’s local password.

Configure the Platform SSO authentication method as UserSecureEnclaveKey, not Password:

  1. In Intune, create or edit a macOS Settings catalog profile.
  2. Go to Authentication > Extensible Single Sign On (SSO) > Platform SSO.
  3. For macOS 14 or later, set Authentication Method to UserSecureEnclaveKey. macOS 13 uses the deprecated authentication-method setting.
  4. Deploy the profile and complete Platform SSO registration. Microsoft Authenticator MFA or a Temporary Access Pass can be used to bootstrap registration.

After registration, the hardware-bound Secure Enclave key is used for Entra SSO, Conditional Access and supported passkey/WebAuthn authentication. Touch ID can unlock the Mac after its initial unlock.

However, the local macOS password remains in place and is not synchronized with the Entra password. It is still required after a restart for the initial FileVault or machine unlock, and may be needed for local recovery and other macOS security operations. This is an Apple/FileVault requirement, not an Intune configuration failure.

For environments that must require Touch ID whenever the Secure Enclave key is accessed, Microsoft also supports UserSecureEnclaveKeyBiometricPolicy. It requires macOS 14.6 or later and Company Portal 2504 or later. There is no password fallback for Entra authentication when this policy is enabled, and enabling it after registration requires users to re-register Platform SSO.

So the achievable result is passwordless Entra authentication and Touch ID for normal unlocks, but not a completely password-free Mac lifecycle. The local password must still be retained for startup, FileVault and recovery scenarios.