Platform SSO lets people sign in to their Mac with their Microsoft Entra account, unlock it with Touch ID and reach apps and websites without repeated password prompts. In this post I'll build the Intune settings catalog policy, compare the three authentication methods, walk through registration and diagnose the most common failures.
Errors this guide fixes
Error 10001Intune admin center (Platform SSO policy)Error 10002Intune admin center (Platform SSO policy)
How Platform SSO works and what you need#
Platform SSO is part of the Microsoft Enterprise SSO plug-in, which Company Portal installs on the Mac. Registration joins the Mac to Microsoft Entra ID with a hardware-bound device identity, and the SSO extension then brokers Entra ID sign-ins and Conditional Access device checks for apps and supported browsers. It's included in every Intune licensing plan.
- macOS 13 or later. You need macOS 14 or later for the current Authentication Method setting and for smart card sign-in.
- Company Portal 5.2404.0 or later, deployed as a required app. An older Company Portal makes Platform SSO fail.
- Enrolled Macs: Automated Device Enrollment or Apple Configurator for corporate Macs, Company Portal device enrollment for personal ones.
- Users allowed to join devices: in the Microsoft Entra admin center, Entra ID › Devices › Overview › Device settings, Users may join devices to Microsoft Entra must include your Mac users. If it doesn't, registration fails without a useful error.
- MFA through Conditional Access, not legacy per-user MFA, which breaks password sync during registration.
- Admin rights: the Policy and Profile Manager role, or Device configuration Read, Create, Update and Assign.
Step 1: Choose the authentication method#
| Method (setting value) | How users sign in | Notes |
|---|---|---|
Secure Enclave (UserSecureEnclaveKey) | Local password after a restart (FileVault), then Touch ID | Phishing-resistant, hardware-bound, usable as a passkey. Microsoft's recommended option. |
Smart card (SmartCard) | Smart card certificate and PIN | Passwordless; needs Entra certificate-based authentication and macOS 14+. |
Password (Password) | The Entra ID password becomes the local password | Keep local passcode rules no stricter than Entra's; add the FileVault policy on macOS 15+. |
Tip: Start with Secure Enclave unless you have a smart card mandate. It leaves the local password (and FileVault) alone and turns sign-ins from the Mac into phishing-resistant MFA.
Step 2: Create the settings catalog policy#
In the Microsoft Intune admin center, go to Devices › Manage devices › Configuration › Create › New policy, pick macOS and Settings catalog. In the settings picker, open Authentication › Extensible Single Sign On (SSO) and configure:
| Setting | Value |
|---|---|
| Extension Identifier | com.microsoft.CompanyPortalMac.ssoextension |
| Team Identifier | UBF8T346G9 |
| Type | Redirect |
| URLs | https://login.microsoftonline.com, https://login.microsoft.com, https://sts.windows.net |
| Registration Token | {{DEVICEREGISTRATION}} (keep the braces) |
| Screen Locked Behavior | Do Not Handle |
| Platform SSO › Authentication Method (macOS 14+) | UserSecureEnclaveKey, SmartCard or Password |
| Authentication Method (Deprecated) | Only for macOS 13 Macs, in the same policy |
| Platform SSO › Use Shared Device Keys | Enabled |
| Platform SSO › Token To User Mapping | Account Name: com.apple.PlatformSSO.AccountShortName; Full Name: name |
| Platform SSO › FileVault Policy (macOS 15+) | AttemptAuthentication (Password method only) |
Assign the policy to user groups for Macs with a primary user; device groups and filters aren't supported there and can leave people failing Conditional Access. Use device groups only for shared Macs enrolled without user affinity.
Watch out: A Mac can have only one SSO extension payload, so unassign any older SSO app extension profile built with the Device features template once the new policy works. Choose carefully, too: changing Authentication Method or Use Shared Device Keys later makes every Mac re-register.
Step 3: Deploy Company Portal and register the Macs#
Assign the current Company Portal for macOS as Required to the same users. On enrolled Macs, the next sync delivers the policy and a Registration required notification appears. The user selects it, signs in with their work account, completes MFA and, with Secure Enclave, confirms with Touch ID. The Mac is then Microsoft Entra joined.
New Macs on macOS 26 can register inside Setup Assistant: add Enable Registration During Setup to the same policy (plus Enable Create First User During Setup for the Password method only), deploy Company Portal 5.2604.0 or later as a line-of-business app with only the com.microsoft.CompanyPortalMac bundle ID, and use an ADE profile with user affinity, Setup Assistant with modern authentication, Await final configuration and Locked enrollment. Target all three at the same assigned (static) user groups; a misconfiguration means wiping the Mac.
Verify#
- In System Settings, open the installed management profiles and confirm the Extensible SSO payload (
com.apple.extensiblesso) lists your URLs. - In Terminal, run the command below. A healthy Mac reports
registrationCompletedas true and aloginTypethat matches your method. - In the Microsoft Entra admin center, the Mac shows as Microsoft Entra joined.
- Open a Microsoft 365 web app in Safari, or in Edge while signed in to the Edge profile: no password prompt. Chrome needs the Microsoft Single Sign On extension.
app-sso platform -sTroubleshooting the common failures#
| Symptom | Likely cause | Fix |
|---|---|---|
Error 10001 | A required setting is missing, a setting doesn't apply to Redirect payloads, or macOS 13 and 14 settings sit in different policies | Fix the single policy; mixed fleets need both authentication settings |
Error 10002 | More than one SSO extension profile on the Mac | Unassign the old Device features SSO profile |
| Registration never completes, no error | User isn't allowed to join devices | Fix the Entra device setting from the prerequisites |
| Password sync fails during registration | Per-user MFA, or a local passcode policy stricter than Entra's | Use Conditional Access MFA; align complexity |
| SSO extension inactive after a macOS update | Stale software update daemon state | Run sudo killall swcd, then sudo swcutil reset |
| Registration fails on the corporate network | TLS inspection | Exempt the Microsoft sign-in URLs above and Apple's app-site-association domains |
| Secure Enclave Mac wants to re-register after a FileVault or MDM password reset | Keys were tied to the old local password | Expected; register again |
To repair a registration on macOS 14 or later, open Users & Groups › Network Account Server, select Edit, then Repair, or deregister in Company Portal › Preferences and register again. For a support case, send logs from Company Portal › Help › Send diagnostic report and keep the incident ID. For deeper traces, enable AppSSO debug logging, reproduce, capture a sysdiagnose and reset:
sudo log config --mode "level:debug,persist:debug" --subsystem "com.apple.AppSSO"
sudo sysdiagnose
sudo log config --reset --subsystem "com.apple.AppSSO"Tips & gotchas#
- Platform SSO supports Microsoft Entra join only; there's no hybrid join option for Macs.
- With the Password method, a password changed elsewhere (for example via SSPR) is requested on the Mac within about four hours.
- A user who closes the sign-in dialog mid-registration should sign out and back in; the registration notification then reappears.
