The Mac local password and the company password have been two different things for twenty years.
Platform Single Sign-on ends that. The local account password synchronises with your identity provider whenever it changes, locally or remotely, local accounts can be created on demand when someone signs in with a company identity, and it all works from the login window rather than after it. For Indian organisations on Microsoft Entra ID this closes the oldest gap in the Mac support queue, and we deploy it remotely from Gachibowli, Hyderabad.
- macOS 13+The stated minimum version
- 5 methodsPassword, web, smart card, Secure Enclave, access key
- Password syncLocal and identity provider, either direction
- On demandLocal accounts created at first sign-in
One is an Apple framework. The other is a product that addresses the same problem.
We work with both, and the distinction matters when deciding what to deploy, because they are not alternatives in the way people assume.
- Platform Single Sign-on is an Apple capability in macOS. It requires a device management service that supports Extensible Single Sign-on configuration and a compatible extension from your identity provider. It is the underlying mechanism, not a thing you buy.
- Jamf Connect is a Jamf product addressing Mac identity, and it fits a Jamf-managed estate with Jamf tooling around it. For Indian organisations already running Jamf Pro, that integration and the surrounding capability set are the argument for it.
- The practical question is therefore not which of the two, but what your device management service and your identity provider each support, and whether you want the Apple framework configured directly or a product experience built around it.
- For the Microsoft-centric majority of Indian businesses, Entra ID plus Intune plus the Microsoft SSO extension is the common path, and the prerequisites are specific: Company Portal 5.2404.0 or later, an SSO extension MDM payload configured by an administrator, and macOS versions checked against what each feature needs.
Eight things about Platform SSO that decide whether it fits your estate.
Password synchronisation, in both directions
Apple states that when enabled, the local user password automatically synchronises with the identity provider whenever a user changes their password, locally or remotely. That single behaviour removes the oldest recurring Mac ticket in any Indian helpdesk queue: the company password changed, the Mac password did not follow, and someone is locked out of their own machine on a Monday morning.
Local accounts created on demand
Apple describes creating additional local user accounts on demand when a user signs in with credentials from an identity provider account, with administrators choosing which identity attribute becomes the account name. For shared Macs, hot-desking, training rooms and any device more than one person uses, this removes the account pre-creation exercise entirely.
A Secure Enclave-backed key, the interesting one
Apple describes a user who signs in to their Mac with a local account password using a Secure Enclave-backed key to authenticate. That binds authentication to the hardware in the machine rather than to something the user knows and could be phished out of, which is a materially different security property from a synchronised password, and worth considering for anyone whose account an attacker would value.
Web-based authentication, using the journey you already run
Web-based flows are supported with multifactor authentication and QR code scanning. For organisations whose identity provider already runs a specific sign-in journey, conditional policies and second factors included, the Mac login uses that journey rather than a parallel simplified one that quietly bypasses the controls you spent a year configuring.
Smart card and access key options
Smart card authentication is supported and requires registration with the identity provider, and there is an access key approach described as pass-based authentication through Apple Wallet. Across five methods, most organisations find one that matches what they already use, which is usually the fastest route to a decision rather than a reason to adopt something new for the Macs.
It works with your device management service, whichever it is
The requirement Apple states is a device management service that supports Extensible Single Sign-on configuration, plus a compatible extension from your identity provider. Platform SSO is not tied to one management platform: organisations on Intune, Jamf or another service can use it provided both halves of the requirement are met, which is the first thing we confirm.
Shared device keys, which gate several features
Apple states shared device keys are mandatory for several capabilities, naming Automated Device Enrollment, Touch ID, web authentication, guest mode, on-demand accounts and network authorisation. That is a design consideration rather than a footnote, because several of those are precisely the features organisations adopt Platform SSO for in the first place.
Version requirements that need checking against your fleet
Apple states Platform SSO is available from macOS 13 or later, with more advanced capabilities requiring later versions. For Microsoft Entra ID estates, Microsoft recommends a minimum of macOS 14 Sonoma and requires Intune Company Portal 5.2404.0 or later before users are targeted. Which features your actual fleet can use is something we confirm against the estate, not assume.
Four things that decide whether a Platform SSO rollout is smooth.
We confirm both halves of the prerequisite first
Apple requires a device management service supporting Extensible Single Sign-on configuration and a compatible extension from your identity provider. Both, not either. Confirming those two facts, plus the macOS versions actually in your fleet and, for Entra estates, the Company Portal version, takes a short conversation and decides whether this is a configuration project or a prerequisites project.
We choose the method from what you already run
Five approaches are supported: password including federated environments, web-based flows with multifactor and QR code scanning, smart card, a Secure Enclave-backed key, and an access key through Apple Wallet. The right one is almost always whichever matches your existing identity approach, not the most technically interesting one.
We plan around the shared device key requirements
Apple names Automated Device Enrollment, Touch ID, web authentication, guest mode, on-demand accounts and network authorisation as requiring shared device keys. Several of those are the reasons organisations want Platform SSO at all, so establishing the requirement early prevents a design that assumes a capability it never enabled the prerequisite for.
We handle the existing Macs deliberately
A fresh Mac enrolling into Platform SSO is straightforward. A Mac someone has used for three years, with a local password that diverged from the company one long ago, is a migration. Mapping that starting state across the fleet and sequencing the change remotely from Hyderabad, team by team across India, is what separates a quiet rollout from a week of login problems.
Six Indian situations where Mac identity is worth solving properly.
A design, media or engineering team on Macs
Almost every Indian tech or creative business has one, and it is usually the group with the least patience for IT process. A sign-in experience that uses the password they already know everywhere else removes a daily irritation, and it makes every subsequent management conversation with that team easier.
A regulated firm needing consistent identity controls
Where multifactor authentication, conditional policies and access reviews apply across the estate, a Mac population authenticating against an ungoverned local password is a real gap, and one that DPDP-driven security reviews increasingly notice. Web-based authentication with multifactor support means the Mac login runs the same journey and the same controls as everything else.
An organisation with shared or hot-desked Macs
Local accounts created on demand when someone signs in with a company credential are exactly what shared estates need, removing the pre-provisioning exercise entirely. Note that on-demand accounts are among the features Apple names as requiring shared device keys, so the prerequisite goes in the design from day one.
Education and training environments
Labs, teaching rooms and shared machines where different people use the same Mac through the day, common across Indian universities and training institutes. Accounts created at first sign-in, with the account name derived from an identity attribute you choose, make the estate manageable without an administrator preparing accounts for every possible user.
A helpdesk drowning in Mac password calls
The most common and most avoidable Mac ticket: someone changed their company password, the Mac local password did not follow, and now they cannot sign in. Password synchronisation in both directions removes that category of ticket entirely, which is usually the fastest way to justify the project internally.
An organisation moving towards phishing-resistant authentication
A Secure Enclave-backed key binds authentication to the hardware in the machine rather than to a shared secret, a materially different property from a synchronised password. For Indian organisations already rolling out passkeys and hardware-bound credentials elsewhere, extending that thinking to the Mac login is the natural next step.
How Mac identity actually works in Indian organisations.
| Feature | Platform SSO configured | A directory binding or product | Local accounts, unconnected |
|---|---|---|---|
Local password matches the company password | Yes | Usually | No |
Password change propagates automatically | Yes | Sometimes | No |
Local accounts created without pre-provisioning | Yes | Sometimes | No |
Company multifactor policy applies at sign-in | Yes | Varies | No |
Hardware-bound authentication available | Yes | Varies | No |
Works from the login window | Yes | Varies | Not applicable |
Depends on a directory connection | No | Frequently | No |
Shared Macs practical to run | Yes | Awkward | No |
Password reset generates a support call | Rarely | Sometimes | Routinely |
Frequency in the Indian market | Rare | Uncommon | Very common |
Five approaches, and what each one involves.
| Method | What it involves | |
|---|---|---|
| Password | Credential-based, including WS-Trust for federated environments | |
| Web-based | Flexible flows with multifactor support and QR code scanning | |
| Smart card | Hardware token, requiring registration with the identity provider | |
| Secure Enclave-backed key | Local password sign-in using a key bound to the device hardware | |
| Access key | Pass-based authentication through Apple Wallet | |
| Local account creation | Accounts created on demand at first sign-in with an identity provider credential | |
| Password synchronisation | Local password syncs with the identity provider on change, locally or remotely |
Five steps, and the prerequisites check comes first.
- 1
Confirm the prerequisites and the fleet
A device management service supporting Extensible Single Sign-on configuration, a compatible extension from your identity provider, and the macOS versions actually present across the estate against the stated minimum of macOS 13 or later. For Entra ID estates we also confirm Company Portal is at 5.2404.0 or later before anyone is targeted.
- 2
Choose the authentication method and the account model
Which of the supported methods fits your existing identity approach, whether password synchronisation is enabled, which identity attribute becomes the local account name, and whether accounts should be created on demand for shared devices. These decisions shape everything that follows.
- 3
Enable the prerequisites the features depend on
Including shared device keys, which Apple names as mandatory for Automated Device Enrollment, Touch ID, web authentication, guest mode, on-demand accounts and network authorisation. Several of those are usually the reason for the project, so this is not an optional configuration detail.
- 4
Pilot on both new and established Macs
A freshly enrolled Mac and a Mac someone has used for years with a diverged local password behave differently, and the second one reveals the real migration work. Testing both, with real users rather than IT staff, determines the shape of the rollout.
- 5
Communicate, then roll out in waves
This changes how people sign in to their own machine, so a short clear message about what will look different, and what to do if it does not work, is worth more than any technical preparation. Then waves by team, with the group most tolerant of a hiccup first, all delivered remotely wherever your teams sit.
What Indian organisations ask about Platform Single Sign-on.
Fifteen questions worth answering first.
Prerequisites
- Does your management service support Extensible SSO?A stated Apple requirement.
- Does your identity provider have a compatible extension?The other half of the requirement.
- What macOS versions are in your fleet?macOS 13 or later is the stated minimum.
- Are the Macs enrolled in management already?Configuration is delivered through it.
- Do you use Automated Device Enrollment?Shared device keys are required for it.
Design
- Which authentication method fits your identity approach?Five are supported.
- Do you want password synchronisation enabled?It works in both directions.
- Which identity attribute becomes the local account name?Administrators specify this.
- Do any Macs need accounts created on demand?Shared, lab and hot-desk devices.
- Is Touch ID or guest mode in scope?Both require shared device keys.
Existing Macs
- How many local accounts already exist per Mac?The starting state shapes the migration.
- Do local and company passwords currently differ?They almost always do.
- Are any Macs below the minimum macOS version?A refresh or upgrade question.
- How will users be told what is changing?It affects their daily sign-in.
- What is the fallback if something goes wrong?Sign-in changes deserve a rollback path.
The pages around this one.
macOS management
The wider Mac management picture: enrolment, configuration, updates and where identity fits into it.
Learn moreJamf Connect
The Jamf product addressing Mac identity, and how it compares as an approach for a Jamf-managed estate.
Learn moreMac in a Microsoft environment
The integration picture around identity: management ownership, Defender, updates and conditional access.
Learn moreCheck two things: your management service and your identity provider.
Platform SSO needs a device management service supporting Extensible Single Sign-on and a compatible extension from your identity provider. Both, not either. If you have them, this is a configuration project. If not, that gap is what to solve first, and we will tell you which it is within 4 business hours of your enquiry.