🎯 Purpose
✅ Enable Platform SSO on macOS using the Microsoft Enterprise SSO plug‑in, giving users phishing‑resistant, passwordless sign‑in to their Mac and to Entra ID apps.
➡️ Replaces IBP – HARDEN – MacOS – Single Sign On. Only one SSO extension profile should be assigned to a device.
👥 Who is affected
✅ Devices: All macOS devices
🚫 Exclusions: None
☁️ What access is protected
✅ macOS sign‑in and Entra ID sign‑in to Microsoft 365 and other Entra‑integrated apps
✅ Type: Settings catalog › Authentication › Extensible Single Sign On
🔐 How Platform SSO is configured
Setting | Value |
Extension Identifier |
|
Team Identifier |
|
Type | Redirect |
URLs | |
Registration Token |
|
Screen Locked Behavior | Do Not Handle |
Platform SSO › Authentication Method | UserSecureEnclaveKey |
Platform SSO › Use Shared Device Keys | Enabled |
Platform SSO › Account Display Name | Organisation name |
➡️ Users register their Mac with Entra ID once. Sign‑in then uses a key held in the Mac's Secure Enclave, which works like Windows Hello for Business.
ℹ️ Prerequisite: Company Portal must be installed on the Mac (it hosts the Enterprise SSO plug‑in).
⚙️ What this policy does NOT enforce
🚫 Password sync with the local account (Secure Enclave key is used instead)
🚫 Conditional Access requirements
🚫 Login window or session restrictions
🟢 Policy status
✅ Enabled
✅ Assigned to all devices
📘 Essential Eight Alignment
✅ Provides a phishing‑resistant MFA method on macOS for Essential Eight – Multi‑factor Authentication at Maturity Levels 2 and 3
ℹ️ Inforcer Best Practice control applied at all maturity levels
📘 Practical Interpretation (Executive‑Friendly)
This policy ensures that:
✅ Mac users sign in once and get single sign‑on to Microsoft 365
✅ Sign‑in uses a hardware‑bound key that can't be phished
This brings passwordless, phishing‑resistant sign‑in to macOS.