Platform SSO for Mac with Microsoft Entra ID

For years, Mac users had one password for their Mac and another for Microsoft 365. Platform SSO for Mac with Microsoft Entra ID changes that. It connects the Mac login to Entra ID, so people sign in once and their Microsoft apps and websites sign them in automatically. This guide covers how it works, which sign-in method to choose and what to check before you roll it out.

What Platform SSO is

Platform SSO is a macOS feature that lets an identity provider take part in signing in to the Mac. Apple introduced it in macOS 13 Ventura and has added to it with each release:

• macOS 14 added creating the Mac account on demand, when someone first signs in with their work account.
• macOS 26 lets Platform SSO be completed during Automated Device Enrollment, so people sign in with their work account during setup.
• macOS 27 adds OpenID sign-in at FileVault unlock, the Lock Screen and the login window, with multi-factor and QR code sign-in.

For Entra ID, it works through Microsoft’s Enterprise SSO plug-in, which is delivered by the Company Portal app. It is configured with a single sign-on extension profile from your device management platform. Microsoft documents it for Intune, and Jamf documents the same set-up for Jamf Pro.

The three sign-in methods

Microsoft recommends Secure Enclave. It uses a key held in the Mac’s hardware, meets phishing-resistant multi-factor requirements and works much like Windows Hello for Business. One point often surprises people: with Secure Enclave the local Mac password stays separate, by design, because FileVault uses it to unlock the disk. After a restart, people type their Mac password once, then Touch ID works as normal.

The password method keeps the Mac password in sync with the Entra ID password, so there is one password everywhere. It is simpler to explain but not phishing resistant. Smart card suits organisations that already issue smart cards with certificate-based authentication.

What you need

• macOS 13 or later; Microsoft strongly recommends macOS 14 or later.
• Macs managed by a device management platform such as Jamf Pro or Intune.
• Company Portal version 5.2404.0 or later on every Mac.
• A single sign-on extension profile with the Platform SSO settings.
• Users registered for Entra ID multi-factor authentication, with permission to register devices.
• If you use TLS inspection or proxy filtering, the exclusions Microsoft lists for Platform SSO.

Shared Macs and on-premises resources

Shared Macs need macOS 14 and a different profile, and Microsoft says conditional access is not supported on Macs shared by several people. If people still use on-premises Active Directory resources, Platform SSO can also provide Kerberos single sign-on to them. Microsoft recommends this where Kerberos resources remain, for example during a move from Active Directory to Entra ID.

Platform SSO and Jamf Connect

Jamf Connect has linked Mac sign-in to cloud identity providers for years. Jamf says it creates accounts with your identity provider, keeps local passwords in sync, gives secure access to apps “without the legacy VPN” and can grant temporary admin rights to standard users. Platform SSO is built into macOS and is Microsoft’s recommended method for single sign-on. Many organisations use Platform SSO for sign-in and keep Jamf Connect where they need its extra features, so check what you actually use before renewing.

Conditional access and compliance

Platform SSO registers the Mac with Entra ID. To let conditional access require a compliant device, the management platform must also report compliance to Entra ID. Intune does this itself. With Jamf Pro, that means Jamf’s Device Compliance integration with Entra ID; the older Jamf conditional access integration was deprecated from 31 January 2025, so check which one you have.

Rolling it out

Pilot with IT first, then a small group of everyday users. Tell people what they will see: a “Registration required” prompt, a multi-factor sign-in, and possibly a change to how they unlock their Mac. Registration with Secure Enclave can be bootstrapped with the Authenticator app or a Temporary Access Pass, which helps new starters. Roll out in waves and have the helpdesk ready for the first few days.

What it looks like in practice

We deployed Jamf Connect and Platform SSO with Entra ID for a global consumer brand running Macs across several offices, and recorded it in its Jamf Pro design document. Toynbee Hall uses Jamf Connect with Platform SSO after moving to cloud-only Entra ID. Our Mac IT support and Apple and Jamf teams set this up for organisations running Macs alongside Windows.

Apple and Microsoft add Platform SSO features with most major releases, so check the current documentation before you design your set-up.