When I bring Macs into Microsoft 365 environments, I keep hitting the same wall. Secure sign-in and SSO on macOS have always trailed behind Windows. Admins and users both want something that feels native, without keychain workarounds, third-party agents or password sync that breaks every few weeks. With macOS Platform SSO and Microsoft Entra ID now in public preview, there is finally a proper sign-in solution for Apple devices that fits into the Microsoft identity world.

macOS Platform SSO ties the Mac account to the Entra ID identity

Platform SSO lets a Mac register directly with Entra ID, either during setup or after enrollment. The local user account can then be closely linked to the Entra ID identity. There are two ways to do this: a hardware key backed by the Secure Enclave (passwordless, phishing-resistant unlock with Touch ID) or classic password sync, which mirrors the Entra password to the Mac. SSO to cloud apps runs through the Enterprise SSO plug-in, which has been available for Entra ID since macOS 13. Some of the tenants I work with have started pilots, and those pilots also show where it still hurts.

A working setup needs Intune, Company Portal and a current macOS

You need a supported Mac (Apple Silicon or T2 for Secure Enclave, otherwise password sync),

  • macOS 13 or 14,
  • the latest Company Portal app installed,
  • Macs managed by Intune,
  • and a suitable licence, where Entra ID P1 covers most cases.

You configure it in the Intune admin center → Device configuration → Settings catalog, under Authentication → Extensible Single Sign On (SSO). Company Portal is mandatory. Without it, device registration just fails. Microsoft's documentation (Platform SSO for macOS, Entra ID Platform SSO, Apple SSO Plug-in) is current and useful, though a few preview quirks only show up once you test on real devices.

The Secure Enclave key is the stronger option compared to password sync

The Secure Enclave integration is the part that makes this feel current. On supported Macs, the first Entra sign-in creates a hardware-bound key in the Secure Enclave, and that key handles both unlocking the Mac and authenticating to Entra ID. It is passwordless and phishing-resistant because the key never leaves the device, and unlock can be combined with Touch ID. Older Macs fall back to password sync, which stores the Entra password locally and uses it for login. That is not ideal, but it still beats the older approaches.

Pro tip: If you plan to use Secure Enclave, start with a small pilot group. Certain legacy apps or device profiles can block Touch ID. In most cases a full wipe and re-provisioning of the user profile fixes it.

Most organizations end up running both. Some users get the Secure Enclave flow and others the password method, depending on how old the hardware is and whether BYOD devices are involved.

The authentication flow branches on whether a Secure Enclave exists

This simple diagram shows the steps macOS Platform SSO goes through:

flowchart TD
    Start["Device set up"] --> CheckEnclave["Secure Enclave present?"]
    CheckEnclave -- "Yes" --> EnclaveKey["Create enclave key"]
    EnclaveKey --> Auth["Sign in with key (Touch ID)"]
    Auth --> SSOPlugin["Enterprise SSO plug-in"]
    SSOPlugin --> AppsSSO["SSO to Entra apps"]
    CheckEnclave -- "No" --> PWFlow["Enable password sync"]
    PWFlow --> AuthPW["Sign in with Entra password"]
    AuthPW --> SSOPlugin

Figure: Authentication with macOS Platform SSO

If a Secure Enclave is available, users get the hardware-backed passwordless flow. If not, they get password sync. In both cases the Enterprise SSO plug-in provides real SSO to apps protected by Entra.

Only a handful of Intune settings really matter

Once the prerequisites are in place, the Intune side is pleasantly simple. In the Intune admin center → Device configuration → Settings catalog, search for “Extensible Single Sign On.” These are the settings I configure in projects:

  • SSO extension type: Microsoft Azure AD
  • TeamIdentifier: Value from Microsoft’s docs for Entra ID (usually "UBF8T346G9")
  • Configuration profile: For additional options like user mapping, allowed apps, etc.

Here is a minimal configuration as JSON, the way the Intune UI shows it:

{
  "SSOExtensionType": "com.microsoft.azureauthenticator.ssoextension",
  "TeamIdentifier": "UBF8T346G9",
  "Type": "Redirect",
  "AllowSharedDevice": true
}

One more reminder. If Company Portal isn't installed and the device isn't properly registered, none of this works. On first use, end users may also have to grant permissions to the SSO plug-in.

Several features still fall short in the preview

macOS Platform SSO with Entra ID is a big step, but it is still a public preview, and not every part is ready for enterprise use. These are the problems I see most often in customer pilots:

  • Multi-user devices: Not fully covered yet, the focus is on single-user deployments
  • Self-service password reset: Not reliably available from the macOS login screen
  • Migrating local accounts: Linking existing local accounts to Entra ID has limitations
  • App compatibility: Some Mac apps don't work well with the SSO plug-in, usually older or non-native ones

Keep an eye on the latest Microsoft documentation and gather feedback from your pilot users. Test on both macOS 13 and 14, because small differences in behavior do show up between versions.

I see huge potential, but I would roll it out carefully

For hybrid IT, macOS Platform SSO with Entra ID is one of the most promising releases of 2024. Macs can finally be part of the modern Microsoft identity setup, passwordless and phishing-resistant for anyone with suitable hardware. New Apple Silicon devices with Touch ID benefit the most, but the password-based method is also an improvement. It won't solve everything on its own, though. Admins should plan time for testing, especially with older devices, special app requirements or mixed environments. A careful pilot now saves you surprises later, and Mac users finally get SSO that actually works.