Employees unlock their Mac with their Microsoft Entra ID username and password, thanks to Apple's Platform SSO. Use it when your company already runs on Entra ID and you want one set of credentials from the login window to the apps.
Feature/Functionality
Overview
This control is for Macs only:
| macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|
| ✅ |
Before you deploy it, connect your Entra tenant under Settings > Integrations.
How to use
- Go to MDM > Controls > Add new control and pick Mac login with Entra.
- In the dropdown, choose the authentication method:
- Secure enclave: ties the credentials to the Mac's secure enclave. This is the most secure option.
- Choose the target: every macOS device, specific device groups or a custom target.
Deploying the control installs the app that Entra Platform SSO needs on every targeted Mac. You do not have to push it separately.
What happens on the Mac
Factorial IT relies on macOS Platform Single Sign-On (Platform SSO), available since macOS 13, to link the login window to Entra ID. At login, macOS checks the credentials with Entra ID and keeps the token it gets back in the Keychain. Browsers and apps then reuse that token, so the employee is not asked to sign in again.
If the Mac cannot reach Entra ID, it still lets the employee in with the credentials it has cached locally.
Change or remove the control
Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement, but the configuration already on the devices stays there.
Tips and Best Practices
- Connect Entra first. The control needs your tenant linked under Settings > Integrations.
- Make sure the first login is online. The Mac needs internet the first time to set up its link with Entra ID.
- Pilot on a small group. Target a device group before rolling out to every Mac.
- Remember that disabling is not undoing. Settings already on the Macs stay after you disable the control.
Troubleshooting and FAQ
Troubleshooting
- The first login after deployment fails. Check the Mac is online. The first login needs a connection to bind the device to Entra ID.
- You cannot finish setting up the control. Check your Entra tenant is connected under Settings > Integrations.
- Settings remain on Macs after disabling the control. That is expected. Disabling stops enforcement but does not remove what is already on the devices.
FAQ
-
Which macOS version is required?
The control relies on Platform SSO, which Apple introduced in macOS 13.
-
Can employees log in without internet?
Yes, after the first login. Without a connection, macOS uses the locally cached credentials.
-
Do I need to install the Entra app myself?
No. Deploying the control installs it on the targeted Macs.
-
Do employees have to sign in again in their browser and apps?
No. The token from the Mac login is stored in the Keychain and reused for single sign-on.