> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Platform Single Sign-On

> Configure Platform SSO in the Single Sign-On Extension Library Item. Set the authentication method, password policies, and macOS 26 and macOS 27 settings.

<Callout icon="apple" color="#B84A7A" iconType="regular">Platform SSO is available for Mac computers</Callout>

These settings are in the **Single Sign-On Extension** Library Item, and they are available only when **Extension type** is **Redirect**. Configure the Library Item name, Blueprint assignment, and Redirect extension settings in [Configure the Single Sign-On Extension Library Item](/en/endpoint/library/library-items-profiles/configure-the-single-sign-on-extension-library-item#redirect) first.

## Platform SSO

Platform SSO extends the Redirect extension to the macOS login window. Users can unlock their Mac with credentials from your organization's identity provider (IdP). On a shared Mac, Platform SSO can create a local account at the login window from those credentials. **Password** keeps the IdP password and the local account password in sync. **OpenID** does this only when **Allow web login password sync** is **Yes**. **User Secure Enclave Key** and **Smart Card** leave the local account password unchanged. You can manage permissions and local group membership. IdP users who do not have a local account can use those credentials at authorization prompts.

<Warning>
  Platform SSO requires a properly configured Single Sign-On Extension app from your identity provider, in addition to the Platform SSO profile payload deployed by Iru.
</Warning>

<Steps>
  <Step title="Enable Platform SSO">
    Platform SSO is off by default. Turn on **Platform SSO**. It is supported on macOS 14 Sonoma and later, and it requires a compatible identity provider app extension.
  </Step>

  <Step title="Select authentication method">
    Select the **Authentication method**. The SSO extension must support the method you select.

    * **Password**
    * **User Secure Enclave Key**
    * **Smart Card**
    * **OpenID**

    OpenID is available in macOS 27 and later. Iru does not send **OpenID** to Mac computers running earlier than macOS 27. **FileVault policy**, **Login policy**, and **Unlock policy** appear only for **Password**. Enter a **Registration token** in the next step when your identity provider requires one. For any other method, skip [Policies for Password](#policies-for-password) and continue with [Permissions and account settings](#permissions-and-account-settings).

    <Note>
      If you plan to use **OpenID**, contact your identity provider to confirm that it supports OpenID with Platform SSO.
    </Note>
  </Step>

  <Step title="Enter Registration token (optional)">
    Enter a **Registration token** when your identity provider requires one. The Mac uses this value to register with Platform SSO, including silent registration when your identity provider and SSO extension support it.
  </Step>
</Steps>

## Policies for Password

**FileVault policy**, **Login policy**, and **Unlock policy** appear only when **Authentication method** is **Password**. Each is available in macOS 15 and later, and the default is **Not configured**. For **User Secure Enclave Key**, **Smart Card**, or **OpenID**, continue with [Permissions and account settings](#permissions-and-account-settings).

<Steps>
  <Step title="Set FileVault policy">
    **FileVault policy** applies when using Platform SSO at FileVault unlock on Mac computers with Apple silicon.

    * **Not configured**: Iru does not send this setting.
    * **Attempt authentication**: The Mac tries to authenticate with the identity provider. If the Mac is offline, the user can use the local account password.
    * **Require authentication**: The user must authenticate with the identity provider to continue.
  </Step>

  <Step title="Set Login policy">
    **Login policy** applies when using Platform SSO at the login window. It uses the same options as **FileVault policy**.
  </Step>

  <Step title="Set Unlock policy">
    **Unlock policy** applies when using Platform SSO at screensaver unlock. It uses the same options as **FileVault policy**.
  </Step>
</Steps>

## Permissions and account settings

These settings apply to every **Authentication method**.

<Steps>
  <Step title="Set Existing user permissions">
    **Existing user permissions** sets the permissions applied to an account each time the user authenticates. The default is **Not configured**.

    * **Not configured**
    * **Standard**
    * **Admin**
    * **Groups**: Use the groups you configure later in this Library Item.
  </Step>

  <Step title="Set New user permissions">
    **New user permissions** sets the permissions applied to newly created accounts at login. The default is **Not configured**.

    * **Not configured**
    * **Standard**
    * **Admin**
    * **Groups**
    * **Temporary (Authenticated Guest Mode)**
  </Step>

  <Step title="Use shared device keys">
    Select **Use shared device keys** when the Mac should use the same signing and encryption keys for all users. This is required for authorization with an identity provider account and for new account creation.

    When **Use shared device keys** is selected, these settings appear:

    * **Allow authorization (with identity provider account)**: Users can respond to system authorization prompts with their identity provider credentials.
    * **Allow creation of new users at login window**: The Mac creates a local account at the login window. The Mac must be online, at the login window with FileVault unlocked, and Iru must have a valid Bootstrap token for the Mac.
  </Step>

  <Step title="Allow device identifiers in attestation">
    Select **Allow device identifiers in attestation** to include the Mac UDID and serial number in Platform SSO attestations. This is available in macOS 15.4 and later.
  </Step>

  <Step title="Enter Account display name">
    **Account display name** is the name shown in notifications and authentication requests. Use your organization's name, or another name users will recognize.
  </Step>

  <Step title="Set Require full login after">
    **Require full login after** is the number of seconds before the Mac requires a full login instead of a refresh. The default is 18 hours (64800 seconds). The minimum is 1 hour (3600 seconds).
  </Step>

  <Step title="Set Account name and Full name">
    **Account name** and **Full name** are the identity provider attributes used when creating new users or for authorization.
  </Step>

  <Step title="Add Admin groups">
    **Admin groups** are the groups used for administrator access. macOS requests membership during authentication. Select **Add group** for each group.
  </Step>

  <Step title="Add Additional groups">
    **Additional groups** are created as local groups if they do not already exist, and they are available in the local directory. Select **Add group** for each group.
  </Step>

  <Step title="Add Authorization rights">
    **Authorization rights** map an authorization right to one group. Each right can be specified once and mapped to a single group. For example, map printer management to a group. Select **Add group** for each mapping.
  </Step>

  <Step title="Add Non Platform SSO accounts">
    **Non Platform SSO accounts** are local accounts that are not subject to **FileVault policy**, **Login policy**, or **Unlock policy**. These accounts are also not prompted to register for Platform SSO. Select **Add** for each account.
  </Step>

  <Step title="Save the Library Item">
    If you use registration during Setup Assistant, continue with [Enable Registration During Setup Assistant (macOS 26 and later)](#enable-registration-during-setup-assistant-macos-26-and-later) before you save. If **Authentication method** is **OpenID**, configure [Web Login (macOS 27 and later)](#web-login-macos-27-and-later) before you save. At least one web login URL is required. If neither applies, select **Save**.
  </Step>
</Steps>

## Enable Registration During Setup Assistant (macOS 26 and later)

Starting in macOS 26, Platform SSO can run during Setup Assistant so the Mac can register with your identity provider earlier in the enrollment flow. In **Mac macOS 26 and later**, each setting defaults to **Not configured**, which means Iru does not send it. The other options are **Yes** and **No**.

<Steps>
  <Step title="Open the Mac macOS 26 and later section">
    In the **Platform SSO** section of this Library Item, go to **Mac macOS 26 and later**.
  </Step>

  <Step title="Set Enable registration during Setup Assistant">
    Select **Yes** for **Enable registration during Setup Assistant** when Platform SSO registration should start during Setup Assistant.
  </Step>

  <Step title="Set Create first user during Setup Assistant">
    Select **Yes** for **Create first user during Setup Assistant** when the Mac should create its first local account during Setup Assistant using Platform SSO.
  </Step>

  <Step title="Set Synchronize profile picture">
    Select **Yes** for **Synchronize profile picture** when the Mac should request the user's profile picture from the SSO extension.
  </Step>

  <Step title="Set Enable Authenticated Guest Mode Quick Login">
    Select **Yes** for **Enable Authenticated Guest Mode Quick Login** on shared Mac computers where users sign in temporarily with identity provider credentials. For standard single-user Mac computers, leave this set to **Not configured** or select **No**.
  </Step>

  <Step title="Set New user authentication methods">
    **New user authentication methods** are the methods available for newly created accounts. You can select any combination:

    * **Password**
    * **Smart card**
    * **OpenID**

    OpenID is available in macOS 27 and later. Iru does not send **OpenID** to Mac computers running earlier than macOS 27. You can add **OpenID** here with any **Authentication method**. Doing so shows **Web login URL allow list** in **Mac macOS 27 and later**.
  </Step>

  <Step title="Save the Library Item">
    If **Authentication method** is **OpenID**, or **New user authentication methods** includes **OpenID**, configure [Web Login (macOS 27 and later)](#web-login-macos-27-and-later) before you save. At least one web login URL is required. Save from that section, then return here for Automated Device Enrollment. Otherwise, select **Save**.
  </Step>

  <Step title="Install Platform SSO Library Items during Automated Device Enrollment">
    Platform SSO with Automated Device Enrollment requires your **Single Sign-on Extension** Library Item and the **Auto App** Library Item for your identity provider’s SSO extension application to install during Setup Assistant. In your **Automated Device Enrollment** Library Item, turn on **Install Library Items during Setup Assistant** for **Mac**, then add those Library Items plus any others your IdP requires for this flow (for example a **Login Window** Library Item). See [Install Library Items during Setup Assistant](/en/endpoint/enrollment/apple/configuring-apple-enrollment#install-library-items-during-setup-assistant) for the full details. If a device is stuck on **Configuring**, see [Manually release devices held in Setup Assistant](/en/endpoint/enrollment/apple/configuring-apple-enrollment#manually-release-devices-held-in-setup-assistant).
  </Step>
</Steps>

## Web Login (macOS 27 and later)

**Mac macOS 27 and later** appears in two cases.

When **Authentication method** is **OpenID**, **Allow web login password sync** and **Web login URL allow list** appear. **Web login URL allow list** requires at least one URL. **Allow web login password sync** is optional.

When **New user authentication methods** includes **OpenID** and **Authentication method** is **Password**, **User Secure Enclave Key**, or **Smart Card**, the section shows **Web login URL allow list** only. Select **Add** and enter at least one web login URL.

<Steps>
  <Step title="Set Allow web login password sync">
    **Allow web login password sync** appears only when **Authentication method** is **OpenID**. It synchronizes the password from web login to the local account password. It is available in macOS 27 and later. The default is **Not configured**.

    * **Not configured**: Iru does not send this setting.
    * **Yes**: The Mac detects the password during web login and synchronizes it to the local account password.
    * **No**: The Mac does not synchronize the web login password to the local account password.
  </Step>

  <Step title="Add web login URLs">
    **Web login URL allow list** is the set of hosts the Mac can load in the Platform SSO web view. At least one web login URL is required. Select **Add**, then enter a web login URL. Include the scheme and host, such as `https://login.example.com`. Repeat for each host. Wildcards are not supported.
  </Step>

  <Step title="Save the Library Item">
    Select the **Save** button.
  </Step>
</Steps>

For Microsoft Entra ID-specific Library Items and values, see [Configure Platform SSO with Entra ID](/en/endpoint/library/library-items-profiles/configure-the-platform-sso-with-microsoft-entra-id-library-item).