Platform SSO is Apple’s modern authentication framework for macOS (13+), designed to replace traditional Active Directory binding.

It integrates your organization’s Identity Provider (IdP) directly into the macOS login process, allowing users to log in to their Mac with their enterprise credentials (e.g., Okta, Microsoft Entra ID) and automatically gain access to supported apps, websites, and services — without separate sign-ins.

How It Works

1. User logs in to their Mac with IdP credentials (password, Secure Enclave key, smart card, or access key).
2. macOS + SSO extension authenticates with the IdP and receives SSO tokens.
3. Tokens are stored securely in the Keychain and are shared only with the Platform SSO extension.
4. These tokens are then used for seamless authentication across native apps and web apps, without repeated logins.
5. Tokens refresh automatically (e.g., if expired or older than 4 hours).

Supported Authentication Methods

• Password / WS-Trust: Uses local password synced with IdP; supports federated IdPs via WS-Trust.
• Secure Enclave key: Passwordless authentication using Secure Enclave–backed key generated at registration.
• Smart Card: High-security method; requires smart card registration & attribute mapping.
• Access Key (Wallet): Tap to Login using Apple Wallet pass + NFC for shared environments (macOS 26+).

Key Features

🔸 Replaces AD binding — integrates cloud identity directly with macOS login.

🔸 Password sync between local macOS account and IdP.

🔸 SSO for native + web apps using one login.

🔸 On-demand account creation — create local user accounts at login using IdP credentials.

🔸 Authenticated Guest Mode — temporary login without creating a local account.

🔸 Tap to Login (macOS 26) — use Apple Wallet credentials via NFC for instant sign-in.

🔸 Group management & network authorization — assign privileges based on IdP groups.

🔸Kerberos ticket integration and token refresh mechanisms.

Configuration Requirements

macOS 13+ (some features require macOS 14–26).

Apple silicon or Intel Mac with Touch ID.

MDM that supports Extensible SSO configuration payload.

App with a Platform SSO extension compatible with your IdP.

Shared device keys for advanced features (on-demand account creation, Authenticated Guest Mode, etc.).

Platform SSO in Automated Device Enrollment

With macOS 26, Platform SSO can be enforced during Setup Assistant:

1. Device requests enrollment → MDM returns SSO config.
2. macOS installs extension + registers device.
3. User authenticates with IdP → macOS uses token to complete MDM enrollment & Managed Apple ID sign-in.
4. Local account is created & synced with IdP credentials.
5. Login policies and group mappings apply automatically.

Benefits

• Streamlined user experience — one login unlocks everything.
• Reduced IT overhead — fewer password-related tickets.
• Strong security — supports MFA, Secure Enclave, Smart Cards, and zero-trust models.
• Improved compliance — centralized authentication makes policy enforcement easier.
• Scalable — works with modern IdPs like Okta and Microsoft Entra ID.

Compatible IdPs

• Okta — first to support Platform SSO.
• Microsoft Entra ID (formerly Azure AD) — also fully supported.
• Others can integrate by building their own Platform SSO extensions.

Related Features

• Enrollment SSO → Simplifies BYOD enrollment using Managed Apple ID.
• Simplified Setup (macOS 26) → Allows PSSO setup during initial device provisioning.
• Tap to Login → NFC-based instant login for shared Macs.

✨ Key Takeaways

Platform SSO represents a major step forward in integrating macOS devices with modern cloud identity solutions. By streamlining authentication, it enhances security, simplifies user login experiences, and reduces IT overhead.