How to Deploy macOS Platform Single Sign-On (Platform SSO) with Microsoft Entra ID

For years, binding a Mac to a traditional on-premises Microsoft Active Directory (using the macOS Directory Utility) was the standard for synchronizing the Mac’s local login password with the user’s corporate identity. However, as organizations migrated to cloud-native Microsoft Entra ID (formerly Azure AD), native password synchronization broke. Third-party tools like Jamf Connect or xcreds filled the void, using OIDC flows to sync passwords.

Apple has fundamentally modernized this architecture in macOS Ventura and Sonoma by introducing Platform Single Sign-On (Platform SSO). Integrated natively into the macOS framework, Platform SSO allows a Mac to establish an unbreakable cryptographic trust with a cloud Identity Provider (IdP) like Entra ID.

This guide explains the architecture of Platform SSO (PSSO), the prerequisites for deployment, and how to configure Microsoft Entra ID as the native identity provider for macOS endpoints.

Understanding Platform SSO Architecture

Platform SSO provides two primary capabilities, depending on how it is configured:

1. Password Sync: The user logs in to the Mac with their Entra ID password. If the password changes in the cloud, the Mac updates its local keychain and FileVault password to match.
2. Hardware Bound PRT (Primary Refresh Token): This is the true power of PSSO. macOS securely generates hardware-backed cryptographic keys within the Secure Enclave. These keys are registered with Entra ID. When the user logs in, macOS requests a PRT from Microsoft. This PRT acts as a universal ticket; when the user opens Safari or Edge, they are silently authenticated to all Microsoft 365 services without typing a password, satisfying Conditional Access policies requiring “compliant devices.”

Prerequisites

To deploy Platform SSO with Entra ID, your environment must meet strict requirements:

• macOS Version: macOS 13 (Ventura) or 14 (Sonoma) minimum.
• MDM Requirement: The Macs must be managed by an MDM (e.g., Microsoft Intune, Jamf Pro, Kandji). You cannot configure PSSO manually via the terminal.
• Microsoft Entra ID: The Microsoft Enterprise SSO plug-in for Apple devices must be deployed to the Macs.

Step 1: Deploying the Microsoft Enterprise SSO Plug-in

Platform SSO utilizes the Apple Extensible Enterprise SSO framework. Microsoft provides an application (the Company Portal app) that contains the necessary app extension.

Using your MDM, you must deploy the Microsoft Intune Company Portal app to all target Macs. The users do not need to launch the app; the binary simply needs to be present on the disk so macOS can load the com.microsoft.CompanyPortalMac.ssoextension.

Step 2: Creating the Extensible SSO Payload Profile

Once the extension is present, you must push an MDM Configuration Profile to configure it.

In your MDM (e.g., Intune or Jamf), create a new macOS configuration profile utilizing the Extensible Single Sign-On payload.

Configure the following critical parameters:

• Extension Type: Redirect
• Extension Identifier: com.microsoft.CompanyPortalMac.ssoextension
• Team Identifier: UBF8T346G9 (This is Microsoft’s Apple Developer ID, ensuring macOS only loads the legitimate extension).
• URLs to match: Add https://login.microsoftonline.com and https://login.microsoft.com.

Step 3: Enabling Platform SSO in the Payload

Within that same Extensible SSO payload, you must inject specific custom XML keys to activate the Platform SSO features (as standard SSO only covers Safari, not the macOS login screen).

Add the following custom configuration dictionary (often labelled as “Custom Configuration” or injected directly into the plist):

<dict>
    <key>AppPrefixAllowList</key>
    <string>com.microsoft.,com.apple.</string>
    <key>browser_sso_interaction_enabled</key>
    <integer>1</integer>
    <key>disable_explicit_app_prompt</key>
    <integer>1</integer>
    <key>PlatformSSO</key>
    <dict>
        <key>UseSharedDeviceKeys</key>
        <integer>1</integer>
    </dict>
</dict>

The PlatformSSO dictionary key is the trigger that instructs the macOS framework to initiate the hardware-bound registration process with Entra ID.

Step 4: The End-User Registration Experience

Because Platform SSO binds the cryptographic identity to the user’s local account, the final step must be initiated by the user.

When the MDM pushes the profile to the Mac, macOS intercepts it and generates a native system notification: “Registration Required: Your organization requires you to register this Mac.”

When the user clicks the notification, macOS opens a native system dialog (not a web browser). The user inputs their Entra ID email and password, and satisfies their Microsoft MFA prompt.

Behind the scenes, the Microsoft SSO extension communicates with Entra ID, provisions the Secure Enclave hardware keys, registers the device object in the Entra ID portal, and securely caches the PRT.

Step 5: Verifying the PSSO Status

As a system administrator, you can verify that Platform SSO has successfully bound to the Mac by utilizing the app-sso command-line utility.

Open Terminal on the Mac and run:

app-sso platform -s

The output will display the exact state of the Platform SSO registration, indicating whether the hardware keys are active and if the Primary Refresh Token is currently valid.

Conclusion

Apple Platform SSO represents the death of legacy Active Directory binding for macOS. By natively integrating with Microsoft Entra ID through the Extensible SSO framework, organizations achieve seamless password synchronization, silent hardware-backed authentication to cloud resources, and rigorous compliance with modern Zero Trust conditional access policies.