Forum Discussion
Platform SSO + Secure Enclave: True Passwordless macOS Sign-in with Entra ID?
Hi all,
I'm testing macOS DEP/ADE + Intune + Platform SSO with Microsoft Entra ID.
I have the Mac successfully enrolling through ADE, becoming Entra joined, and users can authenticate against Entra ID.
With Platform SSO configured for Password authentication, users can sign in using their Entra password and everything works as expected.
What I'm trying to achieve is a passwordless experience using Secure Enclave, similar to Windows Hello for Business:
User enrolls the Mac via ADE
Device joins Entra ID
Platform SSO is registered
Authentication uses Secure Enclave / biometrics (Touch ID)
User is no longer prompted for their Entra password during normal sign-in/unlock scenarios
Has anyone successfully implemented this with Intune and Platform SSO?
Specifically:
Is a true Windows Hello-like passwordless experience currently supported on macOS with Entra ID + Platform SSO?
If yes, what authentication method and Platform SSO configuration are required?
Are there any known limitations where Entra authentication still requires the cloud password even when Secure Enclave is configured?
I'm interested in real-world deployments and lessons learned.
Thanks!
3 Replies
Yes, but with an important qualification: Secure Enclave Platform SSO provides a Windows Hello-like passwordless credential for Microsoft Entra authentication and SSO, but it does not completely remove the Mac’s local password.
Configure the Platform SSO authentication method as UserSecureEnclaveKey, not Password:
- In Intune, create or edit a macOS Settings catalog profile.
- Go to Authentication > Extensible Single Sign On (SSO) > Platform SSO.
- For macOS 14 or later, set Authentication Method to UserSecureEnclaveKey. macOS 13 uses the deprecated authentication-method setting.
- Deploy the profile and complete Platform SSO registration. Microsoft Authenticator MFA or a Temporary Access Pass can be used to bootstrap registration.
After registration, the hardware-bound Secure Enclave key is used for Entra SSO, Conditional Access and supported passkey/WebAuthn authentication. Touch ID can unlock the Mac after its initial unlock.
However, the local macOS password remains in place and is not synchronized with the Entra password. It is still required after a restart for the initial FileVault or machine unlock, and may be needed for local recovery and other macOS security operations. This is an Apple/FileVault requirement, not an Intune configuration failure.
For environments that must require Touch ID whenever the Secure Enclave key is accessed, Microsoft also supports UserSecureEnclaveKeyBiometricPolicy. It requires macOS 14.6 or later and Company Portal 2504 or later. There is no password fallback for Entra authentication when this policy is enabled, and enabling it after registration requires users to re-register Platform SSO.
So the achievable result is passwordless Entra authentication and Touch ID for normal unlocks, but not a completely password-free Mac lifecycle. The local password must still be retained for startup, FileVault and recovery scenarios.
Yes—Platform SSO with the Secure Enclave authentication method is Microsoft’s supported passwordless option and is conceptually similar to Windows Hello for Business. In the Intune Settings Catalog, change Platform SSO Authentication Method to UserSecureEnclaveKey for macOS 14 or later, keep the Microsoft Enterprise SSO plug-in identifiers and registration token configured, and ensure Company Portal 5.2404 or later plus Microsoft Authenticator are installed before assignment. Target a pilot group and allow users to register using MFA or a Temporary Access Pass; optionally require Touch ID through UserSecureEnclaveKeyBiometricPolicy. One important limitation remains: Secure Enclave does not replace or synchronize the local Mac password. Users must still enter that local password after startup for FileVault unlock, after which Touch ID and the hardware-bound credential provide unlock and Entra SSO. Remove any older separate SSO extension profile, because only one Platform SSO policy can apply.
That's a bit bummer this last part:
"One important limitation remains: Secure Enclave does not replace or synchronize the local Mac password. Users must still enter that local password after startup for FileVault unlock, after which Touch ID and the hardware-bound credential provide unlock and Entra SSO."
So, it does mean the local account on MAC still unmanaged, it be much nicer if it would be like on Windows with Windows Hello, that one could log in with Entra Password beside the Biometrics or PIN.
So, the choice either use Secure Enclave or Password in authentication, seems password choice is the most frictionless support model, since it is easier to help/manage.One thing, even if secure enclave is chosen and user still need to unlock with old local password, it seems it also bounds in touchID, so you both unlock the File Vault and the Entra SSO for all the apps.
