Platform SSO is configured through a single Settings Catalog policy in Intune, and once you understand the three decisions it forces, it is not complicated. This is the implementation article: the prerequisites, the authentication method choice that everything hinges on, the policy itself, the newer option to register during enrollment, and what to check when it is done. The why lives in the companion architecture piece; this is the how.
One thing worth stating at the top, because it changes how seriously you should treat this: Platform SSO for macOS with Microsoft Entra ID is now generally available. It is no longer a preview you are experimenting with. It is the supported way to tie a Mac’s login to Entra, and the Entra side of it is formally the Platform Credential for macOS authentication method.
Prerequisites
Four things need to be true before the policy will do anything. The Mac needs to be running at least macOS 13 Ventura, though macOS 14 Sonoma or later is where you want to be, because the stronger options and the smoother registration flows land there. The Company Portal app must be version 5.2404.0 or newer, because it carries the SSO extension that does the actual work. Microsoft Authenticator needs to be present. And the user has to be allowed to register or join devices to Microsoft Entra ID, which is a tenant setting people forget until registration silently fails.
The device also needs to be enrolled in Intune with user affinity, typically through Automated Device Enrollment tied to Apple Business Manager, because Platform SSO binds an identity to a user and needs to know who that user is.
The authentication method decision
This is the choice that defines your deployment, and there are three options. Get this right and the rest is mechanical.
Secure Enclave is the one to use. It provisions a hardware-bound cryptographic key inside the Mac’s Secure Enclave, unlocked by Touch ID, and it is phishing-resistant in the same way Windows Hello for Business is phishing-resistant. The key never leaves the hardware, it can act as a passkey for WebAuthn, and MFA is mandatory when it is set up. This is the passwordless, Zero Trust-aligned path, and it is what Microsoft recommends. Its one nuance is that the local account password still exists for device sign-in; Secure Enclave governs the work identity, not the Mac’s local login secret.
Smart Card uses an external hardware token, a YubiKey or similar, for SSO after the device is unlocked. It is also phishing-resistant, it requires macOS 14 or later, and it cannot be used during Setup Assistant registration. Reach for it only where hardware tokens are already the standard.
Password syncs the user’s Entra ID password with their local Mac account, so the two stay aligned and the local login effectively becomes the Entra login. It is the weakest of the three because it is still a password, but it is the most familiar, it works back to macOS 13, and on macOS 15 and later it unlocks a useful extra: a FileVault policy that verifies the Entra password at the FileVault unlock screen, so the disk-encryption prompt and the work identity finally agree. If an organization is not ready for Secure Enclave, Password is a reasonable transitional choice.
My default is Secure Enclave for any fleet on macOS 14 or later, with Password reserved for genuine transitional cases. Choosing Password because it is familiar, on hardware that could run Secure Enclave, is leaving the phishing-resistance on the table for no reason.
The Settings Catalog policy
Create a Settings Catalog policy and add the Extensible Single Sign-On (SSO) settings under Authentication. The values that make it a Platform SSO policy rather than a plain SSO extension:
- Extension Identifier:
com.microsoft.CompanyPortalMac.ssoextension - Team Identifier:
UBF8T346G9 - Type:
Redirect - URLs:
https://login.microsoftonline.com,https://login.microsoft.com,https://sts.windows.net - Registration Token:
{{DEVICEREGISTRATION}}(the curly braces matter) - Authentication Method:
UserSecureEnclaveKey,Password, orSmartCard
Two token-to-user mappings finish it: the account name maps from preferred_username (or com.apple.PlatformSSO.AccountShortName if you want the UPN prefix as the local account name), and the full name maps from the name claim. Assign the policy to a user group, not a device group, because Platform SSO is about a user identity on a device with user affinity.
A version note that will save you an afternoon: on macOS 13 the method is set through a setting Intune now labels as deprecated, while macOS 14 and later use the current Platform SSO authentication method setting. If you run a mixed fleet, put both settings in the one policy and each device will honour the one that applies to it. On macOS 14 and later you also get Shared Device Keys, which use one key set across all users of a shared Mac, and devices upgraded from macOS 13 to 14 need to re-register.
Registering during enrollment
The newer and better flow, and the one worth adopting, is registering Platform SSO during Automated Device Enrollment rather than after it. Historically a user enrolled the Mac, then later saw a “registration required” notification and had to act on it, which is exactly the kind of step that gets ignored. With registration during Setup Assistant, the enrollment profile carries the Platform SSO policy and the registration completes as part of the initial setup, so the Mac arrives at the desktop already tied to Entra with no separate prompt.
You enable it by adding the Platform SSO policy to the enrollment profile and setting registration to occur during setup. Secure Enclave and Password both work in this flow; Smart Card does not, because Setup Assistant cannot drive an external token at that stage. For any new Mac deployment I would build this in from the start rather than treating post-enrollment registration as the default, because a control users have to opt into is a control a meaningful fraction of them will not.
What registration looks like, and verifying it
When Platform SSO registers, whether during setup or from the notification afterward, the user signs in with their Entra credentials, completes MFA if the tenant requires it, and the Mac becomes Microsoft Entra joined with a hardware-backed Workplace Join certificate underpinning its Primary Refresh Token. That PRT is the thing that makes subsequent access to Entra-integrated apps silent.
To confirm it worked, check that the device shows as Microsoft Entra joined in the Entra admin center and that the user can reach a resource like the Microsoft 365 portal in a supported browser without a fresh credential prompt. Safari and Edge work natively; Chrome and Firefox need the SSO extension or the corresponding policy. Two errors are worth recognising: 10001 means the redirect payload is missing a required setting, and 10002 means you have more than one SSO extension payload fighting each other, usually an old Device Features SSO profile you need to unassign.
A note on macOS versions going forward
Apple’s move to year-based versioning matters here, because macOS 26 refines the Platform SSO experience again, and Microsoft’s guidance is now split between the pre-macOS 26 behaviour and what 26 changes. If your fleet is mixed, the mixed-method policy approach above still holds, but plan to revisit the configuration as the fleet moves onto 26, rather than assuming a policy you wrote against Sonoma is optimal on the newest release. Platform SSO is one of the faster-moving corners of Mac management, and it rewards a periodic re-read of the current documentation rather than a set-and-forget deployment.
Done properly, this is the piece that makes a managed Mac feel like it belongs in a Microsoft identity estate instead of merely tolerating one. The login and the work identity become the same thing, the experience is passwordless, and the credential behind it is hardware-bound and phishing-resistant. That is a genuinely different Mac from the one that authenticated like an unmanaged machine the day before.
Intune Deployment Guide · Phase 11: Mac Management
‹ Previous: [11.2] Platform SSO: What It Is and Why It Changes Everything for Mac
Next: [11.3] Mac Compliance ›
