Skip to main content
Platform SSO is available for Mac computers
These settings are in the Single Sign-On Extension Library Item, and they are available only when Extension type is Redirect. Configure the Library Item name, Blueprint assignment, and Redirect extension settings in Configure the Single Sign-On Extension Library Item first.

​
Platform SSO

Platform SSO extends the Redirect extension to the macOS login window. Users can unlock their Mac with credentials from your organization’s identity provider (IdP). On a shared Mac, Platform SSO can create a local account at the login window from those credentials. Password keeps the IdP password and the local account password in sync. OpenID does this only when Allow web login password sync is Yes. User Secure Enclave Key and Smart Card leave the local account password unchanged. You can manage permissions and local group membership. IdP users who do not have a local account can use those credentials at authorization prompts.
Platform SSO requires a properly configured Single Sign-On Extension app from your identity provider, in addition to the Platform SSO profile payload deployed by Iru.
1

Enable Platform SSO

Platform SSO is off by default. Turn on Platform SSO. It is supported on macOS 14 Sonoma and later, and it requires a compatible identity provider app extension.
2

Select authentication method

Select the Authentication method. The SSO extension must support the method you select.
  • Password
  • User Secure Enclave Key
  • Smart Card
  • OpenID
OpenID is available in macOS 27 and later. Iru does not send OpenID to Mac computers running earlier than macOS 27. FileVault policy, Login policy, and Unlock policy appear only for Password. Enter a Registration token in the next step when your identity provider requires one. For any other method, skip Policies for Password and continue with Permissions and account settings.
If you plan to use OpenID, contact your identity provider to confirm that it supports OpenID with Platform SSO.
3

Enter Registration token (optional)

Enter a Registration token when your identity provider requires one. The Mac uses this value to register with Platform SSO, including silent registration when your identity provider and SSO extension support it.

​
Policies for Password

FileVault policy, Login policy, and Unlock policy appear only when Authentication method is Password. Each is available in macOS 15 and later, and the default is Not configured. For User Secure Enclave Key, Smart Card, or OpenID, continue with Permissions and account settings.
1

Set FileVault policy

FileVault policy applies when using Platform SSO at FileVault unlock on Mac computers with Apple silicon.
  • Not configured: Iru does not send this setting.
  • Attempt authentication: The Mac tries to authenticate with the identity provider. If the Mac is offline, the user can use the local account password.
  • Require authentication: The user must authenticate with the identity provider to continue.
2

Set Login policy

Login policy applies when using Platform SSO at the login window. It uses the same options as FileVault policy.
3

Set Unlock policy

Unlock policy applies when using Platform SSO at screensaver unlock. It uses the same options as FileVault policy.

​
Permissions and account settings

These settings apply to every Authentication method.
1

Set Existing user permissions

Existing user permissions sets the permissions applied to an account each time the user authenticates. The default is Not configured.
  • Not configured
  • Standard
  • Admin
  • Groups: Use the groups you configure later in this Library Item.
2

Set New user permissions

New user permissions sets the permissions applied to newly created accounts at login. The default is Not configured.
  • Not configured
  • Standard
  • Admin
  • Groups
  • Temporary (Authenticated Guest Mode)
3

Use shared device keys

Select Use shared device keys when the Mac should use the same signing and encryption keys for all users. This is required for authorization with an identity provider account and for new account creation.When Use shared device keys is selected, these settings appear:
  • Allow authorization (with identity provider account): Users can respond to system authorization prompts with their identity provider credentials.
  • Allow creation of new users at login window: The Mac creates a local account at the login window. The Mac must be online, at the login window with FileVault unlocked, and Iru must have a valid Bootstrap token for the Mac.
4

Allow device identifiers in attestation

Select Allow device identifiers in attestation to include the Mac UDID and serial number in Platform SSO attestations. This is available in macOS 15.4 and later.
5

Enter Account display name

Account display name is the name shown in notifications and authentication requests. Use your organization’s name, or another name users will recognize.
6

Set Require full login after

Require full login after is the number of seconds before the Mac requires a full login instead of a refresh. The default is 18 hours (64800 seconds). The minimum is 1 hour (3600 seconds).
7

Set Account name and Full name

Account name and Full name are the identity provider attributes used when creating new users or for authorization.
8

Add Admin groups

Admin groups are the groups used for administrator access. macOS requests membership during authentication. Select Add group for each group.
9

Add Additional groups

Additional groups are created as local groups if they do not already exist, and they are available in the local directory. Select Add group for each group.
10

Add Authorization rights

Authorization rights map an authorization right to one group. Each right can be specified once and mapped to a single group. For example, map printer management to a group. Select Add group for each mapping.
11

Add Non Platform SSO accounts

Non Platform SSO accounts are local accounts that are not subject to FileVault policy, Login policy, or Unlock policy. These accounts are also not prompted to register for Platform SSO. Select Add for each account.
12

Save the Library Item

If you use registration during Setup Assistant, continue with Enable Registration During Setup Assistant (macOS 26 and later) before you save. If Authentication method is OpenID, configure Web Login (macOS 27 and later) before you save. At least one web login URL is required. If neither applies, select Save.

​
Enable Registration During Setup Assistant (macOS 26 and later)

Starting in macOS 26, Platform SSO can run during Setup Assistant so the Mac can register with your identity provider earlier in the enrollment flow. In Mac macOS 26 and later, each setting defaults to Not configured, which means Iru does not send it. The other options are Yes and No.
1

Open the Mac macOS 26 and later section

In the Platform SSO section of this Library Item, go to Mac macOS 26 and later.
2

Set Enable registration during Setup Assistant

Select Yes for Enable registration during Setup Assistant when Platform SSO registration should start during Setup Assistant.
3

Set Create first user during Setup Assistant

Select Yes for Create first user during Setup Assistant when the Mac should create its first local account during Setup Assistant using Platform SSO.
4

Set Synchronize profile picture

Select Yes for Synchronize profile picture when the Mac should request the user’s profile picture from the SSO extension.
5

Set Enable Authenticated Guest Mode Quick Login

Select Yes for Enable Authenticated Guest Mode Quick Login on shared Mac computers where users sign in temporarily with identity provider credentials. For standard single-user Mac computers, leave this set to Not configured or select No.
6

Set New user authentication methods

New user authentication methods are the methods available for newly created accounts. You can select any combination:
  • Password
  • Smart card
  • OpenID
OpenID is available in macOS 27 and later. Iru does not send OpenID to Mac computers running earlier than macOS 27. You can add OpenID here with any Authentication method. Doing so shows Web login URL allow list in Mac macOS 27 and later.
7

Save the Library Item

If Authentication method is OpenID, or New user authentication methods includes OpenID, configure Web Login (macOS 27 and later) before you save. At least one web login URL is required. Save from that section, then return here for Automated Device Enrollment. Otherwise, select Save.
8

Install Platform SSO Library Items during Automated Device Enrollment

Platform SSO with Automated Device Enrollment requires your Single Sign-on Extension Library Item and the Auto App Library Item for your identity provider’s SSO extension application to install during Setup Assistant. In your Automated Device Enrollment Library Item, turn on Install Library Items during Setup Assistant for Mac, then add those Library Items plus any others your IdP requires for this flow (for example a Login Window Library Item). See Install Library Items during Setup Assistant for the full details. If a device is stuck on Configuring, see Manually release devices held in Setup Assistant.

​
Web Login (macOS 27 and later)

Mac macOS 27 and later appears in two cases. When Authentication method is OpenID, Allow web login password sync and Web login URL allow list appear. Web login URL allow list requires at least one URL. Allow web login password sync is optional. When New user authentication methods includes OpenID and Authentication method is Password, User Secure Enclave Key, or Smart Card, the section shows Web login URL allow list only. Select Add and enter at least one web login URL.
1

Set Allow web login password sync

Allow web login password sync appears only when Authentication method is OpenID. It synchronizes the password from web login to the local account password. It is available in macOS 27 and later. The default is Not configured.
  • Not configured: Iru does not send this setting.
  • Yes: The Mac detects the password during web login and synchronizes it to the local account password.
  • No: The Mac does not synchronize the web login password to the local account password.
2

Add web login URLs

Web login URL allow list is the set of hosts the Mac can load in the Platform SSO web view. At least one web login URL is required. Select Add, then enter a web login URL. Include the scheme and host, such as https://login.example.com. Repeat for each host. Wildcards are not supported.
3

Save the Library Item

Select the Save button.
For Microsoft Entra ID-specific Library Items and values, see Configure Platform SSO with Entra ID.