Platform SSO is available for Mac computers
What is Platform SSO?
Platform SSO allows users to sign in to their Mac computers using a hardware-bound key, smart card, or their IdP password. It enhances the Microsoft Enterprise SSO plug-in for Apple devices by providing single sign-on for Microsoft work or school accounts on macOS.For the full Platform SSO setting list, see Configure Platform Single Sign-On. For Microsoft’s overview, see macOS Platform Single Sign-on.
Add and Configure the Company Portal Auto App
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.1
Assign to Blueprints
Assign to your desired Blueprints.
2
Set Installation Method
Set your Installation Method to Continuously Enforce.
3
Specify Version Enforcement
Specify your Version Enforcement settings.
4
Save the Library Item
Select the Save button.
Add and Configure a Login Window Library Item
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.1
Name the Library Item
Enter a Name for your Login Window Library Item.
2
Assign to Blueprints
Assign to your desired Blueprints.
3
Configure User Visibility
Under User Visibility, select Display username and password fields.
4
Save the Library Item
Select the Save button.
Add and Configure a Single Sign-on Extension Library Item
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.1
Name the Library Item
Enter a Name for the new Library Item.
2
Select Platform
Select Mac as the Install on platform.
3
Assign to Blueprints
Assign to your desired Blueprints.
4
Select Extension Type
Under Extension type, select Redirect.
5
Configure Extension Identifier
For Extension identifier, enter the following:
6
Set Team Identifier
Enter the following in Team identifier:
7
Configure URLs
Paste the following URLs into the URLs fields.
8
Add sovereign cloud URLs (optional)
If you use sovereign cloud domains, include the following additional URLs.
9
Enable Platform SSO
Toggle the switch for Platform SSO.
10
Select Authentication Method
Select your Authentication Method. For information on which method to use for your organization, refer to Microsoft’s support article.
11
Enter Registration token (optional)
Optionally, enter your Registration token when your identity provider requires one. The Mac uses this value for Platform SSO registration with your identity provider, including silent registration when your identity provider and SSO extension support it.
12
Enable optional settings (macOS 15 or later)
Enable additional optional settings for macOS 15 and later as needed.
13
Set Existing Users permissions
Set default permissions for Existing Users.
14
Set New Users permissions
Set default permissions for New Users.
15
Enable Shared Device Keys
Select the checkbox for Shared Device Keys.
16
Enable authorization with identity provider
Enable Allow authorization (with identity provider account). This will allow users to interact with system authorization prompts using their Microsoft Entra ID credentials.
17
Enable automatic local account creation (optional)
If you want to automatically create local accounts for users, enable Allow creation of new users at login. To create a local account, the device must be connected to the internet at the login screen with FileVault unlocked, and Iru must have a valid Bootstrap token for that device.
18
Enable device attestation (optional)
If checked, the device UDID and serial number will be included in Platform SSO attestations. Available in macOS 15.4 and later.
19
Enter Account display name
Enter an Account display name.
20
Set Require full login after
For Require full login after, enter the number of seconds before the Mac requires a full login instead of a refresh.
21
Set Account name and Full name
For Account name, enter:For Full name, enter:
22
Configure Groups (optional)
If desired, configure Admin groups, Additional groups, and Authorization rights.
Microsoft currently only supports using static Standard and Admin values for new and existing users.
- Admin groups are groups from Microsoft Entra ID that should have administrator access on the device. These groups are used to grant elevated permissions to specific users
- Additional groups are custom groups you’d like to create in the device’s local directory. These groups can be used to organize users and apply specific settings or permissions
- Authorization rights map an authorization right to one group. Each right can be specified once. For example, map printer management to a group.
23
Save the Library Item
Select the Save button.
Enable Registration During Setup Assistant (macOS 26 and later)
Starting in macOS 26, Platform SSO can run during Setup Assistant so the Mac can register with your identity provider earlier in the enrollment flow. This section lets you configure registration during setup, first-user creation, profile picture sync, and Enable Authenticated Guest Mode Quick Login.1
Open the existing Library Item
In the Library, open the existing Single Sign-on Extension Library Item you created earlier, select Edit, then go to the Mac macOS 26 and later section.
2
Set Enable registration during Setup Assistant
Select Yes for Enable registration during Setup Assistant so Platform SSO registration runs while Setup Assistant is still in progress.
3
Set Create first user during Setup Assistant
For Create first user during Setup Assistant, select Yes when the Mac should create its first local account during Setup Assistant using Platform SSO. If your organization provisions the first account differently, adjust this setting to match that workflow.
4
Set Synchronize profile picture
Configure Synchronize profile picture based on whether the Mac should request the user’s login profile picture from the SSO extension during this setup flow.
5
Set Enable Authenticated Guest Mode Quick Login
Enable Authenticated Guest Mode Quick Login defaults to Not configured. Select Yes on shared Mac computers where users sign in temporarily with identity provider credentials. For standard single-user Mac computers, leave it set to Not configured or select No.
6
Set New user authentication methods
Under New user authentication methods, select Password, Smart card, OpenID, or a combination. OpenID is available in macOS 27 and later and can be added with any Authentication method. Selecting OpenID shows Web login URL allow list in Mac macOS 27 and later.
If you plan to use OpenID, contact your identity provider to confirm that it supports OpenID with Platform SSO.
7
Save the Library Item
If New user authentication methods includes OpenID, add at least one URL to Web login URL allow list in Mac macOS 27 and later before you save. See Web Login (macOS 27 and later). Select Save.
8
Install Platform SSO Library Items during Automated Device Enrollment
In your Automated Device Enrollment Library Item, turn on Install Library Items during Setup Assistant for Mac. Add the Company Portal Auto App, Login Window, and Single Sign-on Extension Library Items you configured in this guide so they install during enrollment setup. See Install Library Items during Setup Assistant for the full details. If a device is stuck on Configuring, see Manually release devices held in Setup Assistant.
Related Articles
Configure Platform Single Sign-On
Configure Platform SSO in the Single Sign-On Extension Library Item. Set the authentication method, password policies, and macOS 26 and macOS 27 settings.
Library Overview
Overview of the Iru Endpoint Library for managing apps, profiles, scripts, and configurations. Curate Library Items and assign them to device Blueprints.
Configuring Blueprints
Create and configure Blueprints in Iru Endpoint to group devices and assign management policies. Define Assignment Maps and Library Item assignments.
Configuring Apple Enrollment
Configure Apple enrollment in Iru Endpoint: ADE, manual enrollment, enrollment codes, Setup Assistant, MDM profiles, and Blueprints.