Use this article when Mac login with Factorial IT is deployed and a Mac fails to register or to sign the employee in. It shows how to read the Mac's message, check the registration in Terminal and apply the right fix. If the employee has simply forgotten their Mac password, see "Unblock lost passwords" instead.

Feature/Functionality

Overview

Most failures come from one of four causes:

• The Mac's profile blocks a page. The sign-in window says Sign-in site not allowed. The Mac has an older profile than the current sign-in page needs, which usually lasts until the control is saved again.
• A Mac password rule is stricter than the Factorial IT password. Sign-in fails straight after the employee types their Factorial IT password, because macOS will not accept it as the Mac password.
• Registration never completes. The Mac shows Registration failed and will automatically retry and keeps asking the employee to register.
• A login method is not offered by the control. The employee cannot see Google or Microsoft on the sign-in page.

How to use — find the cause

1. Check the control in the console. Open the Mac login with Factorial IT control. Look at its Login methods, and confirm the Mac is in its targeting and runs macOS 27 or later.
2. Check the registration on the Mac. Open Terminal and run:

   app-sso platform -s

POUserStateNormal means the account is registered. POUserStateNeedsRegistration means registration has not finished.

1. List blocked pages. If the Mac shows Sign-in site not allowed, run:

   sudo /usr/bin/log show --last 1h --predicate 'subsystem == "com.apple.AppSSO" AND category == "WebLoginAllowList"'

Every blocked page shows up as Navigation blocked: host=… url=….

1. Read the sign-in log. If sign-in fails, run:

   /usr/bin/log show --predicate 'subsystem == "com.apple.AppSSO"' --info --debug --style compact --last 30m

Password does not meet local policy confirms a Mac password rule is stricter than the Factorial IT password.

Type the full path /usr/bin/log, not just log. In the default macOS shell, log is a different built-in command.

Fix 1 — save the control again

Use it for Sign-in site not allowed and for a missing login method. The Mac must be online and enrolled.

1. Open the Mac login with Factorial IT control.
2. Check the Login methods and click Save. Every save sends an updated profile to the targeted Macs.
3. Once the Mac has the new profile, ask the employee to sign in again.

If a page is still blocked, contact support and include the Navigation blocked line.

Fix 2 — align the Mac password rules

Use it when sign-in fails with Password does not meet local policy. You need to be able to edit the controls that target the Mac.

1. Find the password rule that is stricter than the Factorial IT password rules (at least 8 characters, upper and lower case, a number and a special character). The macOS Password and screenlock controls already respect these rules, so look in a Custom file or another profile.
2. Remove that rule from the Mac, or loosen it so it is no stricter than the Factorial IT rules.
3. Ask the employee to sign in again.

Alternatively, the employee can change their Factorial IT password to one the Mac accepts and then sign in again.

Fix 3 — reset the registration

Use it when registration keeps failing. The Mac must be online and enrolled, and the employee must be able to unlock it with their Mac password.

1. Take the Mac out of the control's targeting, for example by removing it from the targeted device group.
2. Wait until the Mac checks in and the profile is gone.
3. Put the Mac back in the targeting. It gets the profile again and asks the employee to register.

Do not count on the Repair button in System Settings > Users & Groups. On macOS 27.0 it cannot recover a registration once the Mac password has been synced.

If the Mac is offline

The employee opens the Mac with their Mac password for as long as the Offline grace period set on the control allows, counted from their last successful Factorial IT sign-in. Once the Mac is back online, they sign in with Factorial IT again.

Contact support

If none of the fixes work, write to support@factorial.it and include:

• the Mac's serial number and macOS version
• when the registration or sign-in failed
• the output of app-sso platform -s
• the Navigation blocked line, if the Mac shows Sign-in site not allowed

Troubleshooting and FAQ

Troubleshooting

• Sign-in site not allowed. The Mac has an outdated profile. Save the control again (Fix 1) and wait for the new profile.
• Sign-in fails right after the password. A Mac password rule is stricter than the Factorial IT one. Check the log for Password does not meet local policy and apply Fix 2.
• Registration failed and will automatically retry, again and again. Reset the registration (Fix 3).
• Google or Microsoft is missing on the sign-in page. Check Login methods on the control and save it (Fix 1).
• log show returns something unexpected. You probably typed log instead of /usr/bin/log.

FAQ

1. Which macOS version does Mac login with Factorial IT need?
   macOS 27 or later.
    
2. How do I know whether the Mac is registered?
   Run app-sso platform -s in Terminal. POUserStateNormal means registered; POUserStateNeedsRegistration means not yet.
    
3. Can I use the Repair button in Users & Groups?
   Not reliably. On macOS 27.0 it does not recover the registration once the Mac password has been synced. Use Fix 3 instead.
    
4. What are the Factorial IT password rules?
   At least 8 characters, with upper and lower case, a number and a special character.
    
5. Can the employee use the Mac while offline?
   Yes, with their Mac password, during the Offline grace period set on the control.