Platform SSO is available for Mac computers
What is Platform SSO?
Platform SSO is a capability that allows users to sign in to their Mac devices using a hardware-bound key, smart card, or their IdP password. This feature enhances the Microsoft Enterprise SSO plug-in for Apple devices, providing single sign-on for Microsoft Entra ID accounts on macOS.For more information, see Microsoft’s macOS Platform Single Sign-on overview.
Add and Configure the Company Portal Auto App
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.Assign to Blueprints
Assign to your desired Blueprints.
Add and Configure a Login Window Library Item
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.Assign to Blueprints
Assign to your desired Blueprints.
Add and Configure a Single Sign-on Extension Library Item
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the Library Overview article.Assign to Blueprints
Assign to your desired Blueprints.
Add sovereign cloud URLs (optional)
If you use sovereign cloud domains, include the following additional URLs.
Select Authentication Method
Select your Authentication Method. For information on which method to use for your organization, refer to Microsoft’s support article.
Enter Registration token (optional)
Optionally, enter your Registration token when your identity provider requires one. The Mac uses this value for Platform SSO registration with your identity provider, including silent registration when your identity provider and SSO extension support it.
Enable optional settings (macOS 15+)
Enable additional optional settings for macOS 15 and later as needed.
Enable authorization with identity provider
Enable Allow authorization (with identity provider account). This will allow users to interact with system authorization prompts using their Microsoft Entra ID credentials.
Enable automatic local account creation (optional)
If you want to automatically create local accounts for users, enable Allow creation of new users at login. To create a local account, the device must be connected to the internet at the login screen with FileVault unlocked, and Iru must have a valid Bootstrap token for that device.
Enable device attestation (optional)
If checked, the device UDID and serial number will be included in Platform SSO attestations. Available in macOS 15.4 and later.
Configure Token Mapping
In Token mapping, enter the following for AccountName:Enter the following for FullName:
Configure Groups (optional)
If desired, configure Admin Groups, Additional Groups, and User Groups.
Microsoft currently only supports using static Standard and Admin values for new and existing users.
- Admin groups are groups from Microsoft Entra ID that should have administrator access on the device. These groups are used to grant elevated permissions to specific users
- Additional groups are custom groups you’d like to create in the device’s local directory. These groups can be used to organize users and apply specific settings or permissions
- User groups are particularly useful, allowing you to map specific macOS system rights to custom groups created in the local directory. For example, you can use user groups to grant ‘sudo’ access or manage printer permissions
Enable Registration During Setup Assistant (macOS 26 and later)
Starting in macOS 26, Platform SSO can run during Setup Assistant so the Mac can register with your identity provider earlier in the enrollment flow. This section lets you configure registration during setup, first-user creation, profile picture sync behavior, and Authenticated Guest Mode for shared-device workflows.Open the existing Library Item
In the Library, open the existing Single Sign-on Extension Library Item you created earlier, click Edit, then go to the Mac macOS 26 and later section.
Set Enable registration during Setup Assistant
Select Yes for Enable registration during Setup Assistant so Platform SSO registration runs while Setup Assistant is still in progress.
Set Create first user during Setup Assistant
For Create first user during Setup Assistant, select Yes when the Mac should create its first local account during Setup Assistant using Platform SSO. If your organization provisions the first account differently, adjust this setting to match that workflow.
Set Synchronize profile picture
Configure Synchronize profile picture based on whether the Mac should request the user’s login profile picture from the SSO extension during this setup flow.
Set Enable Authenticated Guest Mode
Configure Enable Authenticated Guest Mode when you deploy shared Mac computers where users sign in temporarily with IdP credentials and want Authenticated Guest Mode behavior. For standard single-user Mac computers, leave this behavior off.
Set New user authentication methods
Under New user authentication methods, select the authentication methods available for newly created accounts.
Install Platform SSO Library Items during Automated Device Enrollment
In your Automated Device Enrollment Library Item, turn on Install Library Items during Setup Assistant for Mac. Add the Company Portal Auto App, Login Window, and Single Sign-on Extension Library Items you configured in this guide so they install during enrollment setup. See Install Library Items during Setup Assistant for the full details.