Blog Post

Microsoft Entra Blog
3 MIN READ

Coming Soon – Platform SSO for macOS

brian_melton-grace's avatar
brian_melton-grace
Icon for Microsoft rankMicrosoft
Aug 29, 2023

Earlier this year we took a big step towards improving customers’ experience with Apple devices by providing companies with the Microsoft Enterprise SSO plug-in for Apple devices. This plug-in enables Microsoft Entra ID users to have device-wide single sign-on (SSO) for all apps and websites in a consistent, secure, and seamless way. Best of all, it always stays up to date with the latest Microsoft technologies as they evolve. 

 

Today we're announcing a powerful enhancement to these capabilities - Platform SSO for macOS. This enhancement is designed to make using your macOS devices more seamless and secure than ever. 

Platform SSO is an enhancement to the existing SSO Extension capabilities for macOS, which allows users to sign into their Macs using passwordless credentials or passwords managed and validated by Entra ID.

 

Enabled by Platform SSO and powered by Microsoft’s Enterprise SSO plug-in, Platform Credentials for macOS allow users to go passwordless by using Touch ID to unlock their device and be signed into Entra ID under the hood using a device bound cryptographic key. It uses phishing-resistant credentials, based on the technology we use for Windows Hello for Business, and backed by Apple’s hardware already in your device. This will save your organization money by removing the need for security keys or other hardware. Once you sign in, the existing Microsoft Enterprise SSO plug-in continues to do its magic keeping you signed into the apps you use for work, but with a credential that’s safer and more secure. 

 

For those not ready to completely remove passwords from Entra ID sign-ins, Platform SSO for macOS allows organizations to synchronize their local account password and their Entra ID passwords so users can use one credential across their macOS device. No more remembering separate passwords.  

 

Platform SSO for macOS also allows admins to configure the end-user authentication method, specifying either the phishing-resistant credential or a traditional password as the authentication method.  

 

 

Simplified Management 

 

As part of this update, we’ve reimagined the employee onboarding experience on Macs for users of Microsoft Intune. Platform SSO for macOS simplifies the employee onboarding experience on Microsoft Intune by enabling a familiar and native macOS experience that Mac users will love. As an example, it eliminates the need to launch the Company Portal app to access resources protected by Conditional Access on Intune-managed Macs. To learn more about how Microsoft Intune is innovating in Apple device management, see 10 ways Microsoft Intune improves Apple device management - Microsoft Community Hub. 

 

The upcoming public preview of Platform SSO for macOS will work with Microsoft Intune. Other MDM providers will be coming soon. 

 

Helping You Go Zero Trust 

 

Through our integration with the Secure Enclave included in modern Macs, the passwordless authentication method offers a powerful means for enterprises to advance their zero trust security objectives. By eliminating passwords as a primary attack vector, organizations can significantly enhance their security postures.

 

The credentials used in passwordless systems are bound to physical hardware. This requires attackers to gain physical access to specific hardware rather than steal login information, making unauthorized access even more challenging. 

 

How to Prepare 

 

We are currently in private preview with select customers today with public preview coming soon. If you’d like to be considered to be added to the private preview, please contact Platform SSO for macOS feedback. Spaces are limited.

 

Meanwhile, you can prepare your organization for Platform SSO for macOS by taking the following steps:

 

  1. Deploy the Microsoft Enterprise SSO plug-in. 
  2. Ensure users are registered for Microsoft Entra ID multifactor authentication; for the best experience, we recommend using Microsoft Authenticator. 
  3. Update macOS devices to macOS 13 (Ventura) or later. 

 

Summing up 

 

Platform SSO for macOS is a big step towards enhancing the SSO experience and security of the Macs in your organization. Users benefit from SSO through a hardware-bound key or by signing in to a Mac using their Microsoft Entra ID password. The integration with the Secure Enclave enables hardware-bound, passwordless, phishing-resistant authentication on macOS devices advancing enterprises' zero trust security objectives. At public preview launch, Platform SSO for macOS can be natively managed with Microsoft Intune, with support for other MDM providers coming soon. 

 

 

Learn more about Microsoft Entra:

Updated Aug 22, 2023
Version 1.0
Announcements and Product News
  • DavidLarsen's avatar
    DavidLarsen
    Brass Contributor
    Aug 30, 2023

    Will passwordless sign-in also work for unlocking FileVault? Or will the user still need the password for the initial unlock after a reboot?

  • DeanH's avatar
    DeanH
    Brass Contributor
    Aug 30, 2023
     

    Should we be seeing an alternate login screen at this stage of the preview?

     

    So it would look like it was setup for login with IdP credentials or even Touch-ID but using your Azure credentials (alike to WHFB or password login with Azure AD account) Because I looked at the guide and I can't see any reference in the doc to the PSSO options in the settings.

     

  • Komeil's avatar
    Komeil
    Brass Contributor
    Sep 27, 2023

    In Sonoma, it automatically creates the user account upon the first sign-in.

    You can use  "token for user mapping" but it uses the account username to create a local account by default (it's actually a network account).

     

    I couldn't get Token to User Mapping working to use other attributes from the token such as {{partialupn}} 

     

  • Komeil's avatar
    Komeil
    Brass Contributor
    Sep 29, 2023

    stevenm5781 - 

    Configuration settings > Authentication > Extensible Single Sign On (SSO)

    Authentication Method: Password

    Registration Token: {{DEVICEREGISTRATION}}

    Extension Identifier: com.microsoft.CompanyPortalMac.ssoextension

    Screen Locked Behaviour: Do Not Handle

    Team Identifier: UBF8T346G9

    Type: Redirect

    URLs:

              - https://login.microsoftonline.com

              - https://login.microsoft.com

              - https://sts.windows.net

              - https://login.partner.microsoftonline.cn

              - https://login.chinacloudapi.cn

              - https://login.microsoftonline.us

              - https://login-us.microsoftonline.com

    Configuration settings > Authentication > Extensible Single Sign On (SSO) > Platform SSO >

    Authentication Method: Password

    Enable Authorization: Enabled

    Enable Create User At Login: Enabled

    New User Authorization Mode: Standard

    Use Shared Device Keys: Enabled

    User Authorization Mode: Standard

     

    The PlatformSSO part of the policy works on Sonoma only

    Deploy the Setting Catalog policy to your managed Mac devices

  • sujithtnch57's avatar
    sujithtnch57
    Copper Contributor
    Oct 09, 2023

    There are two things I would like to know. Platform SSO isn't working during the setup assistant when a user needs to create a local account, but it works well after a local user logs in and when the company portal preview is launched.

     

    After my first successful testing, I applied the same policy and company portal preview to a pilot user. The user receives the notification to register, and the 'Enter your EntraID credentials' prompt does contain the pre-added Entra ID, but it's not accepting the user's credentials.

     

    Please share your thoughts if you have experienced the above mentioned issue while you are testing and also I would like to know when the GA release for this feature. 

     

    Thanks

  • sujithtnch57's avatar
    sujithtnch57
    Copper Contributor
    Oct 11, 2023

     

    Today, I encountered another issue. Because of a risk sign-in alert, I had to change my password from a Windows device via a browser. About an hour later, I wanted to see what would happen on my Mac after the password change. it did not allow me to use the new password for login, and I had to revert to using my old password. After logging in, the company portal notification appeared with the message "Authentication Required." When I entered my newly changed password, it didn't accept it, and also didn't accept the old one either, and the notification prompt kept popping up which is annoying.

     

    On the other hand, when I tried to access Teams and Outlook, they seemed to work without prompting for an interactive Azure sign-in.

  • peterfle0410's avatar
    peterfle0410
    Copper Contributor
    Mar 14, 2024

    Peter_R_T Thanks for sharing this idea. Unfortunately this doesn't work for me. The documentation for the Windows Accounts plugin also states to support only Windows 10 and later.

     

    Meanwhile I also found the documentation for "Allow automatic sign-in to Microsoft cloud identity providers": https://chromeenterprise.google/policies/#CloudAPAuthEnabled. This also states to be supported only on Chrome for Windows. 

  • Peter_R_T's avatar
    Peter_R_T
    Copper Contributor
    Aug 31, 2023

    Will it be possible to use, when we're using another solution instead of MS Authenticator as MFA? (We're using another solution that sends a push through an app, so it's not just sms)