By MacAdmins LatAm, Community Team. Published 2026-05-19. Updated 2026-05-19.
Category: technical
For years, getting corporate identity onto a Mac meant binding to Active Directory, deploying middleware, or asking users to manage two passwords. Platform SSO is Apple's answer to that mess — and with macOS 26 Tahoe, it just got meaningfully better. Here's a clear-eyed look at what it is, how it works, and where the gaps still are.
The Problem Platform SSO Is Solving
When a Mac comes out of the box, its local account has no connection to your identity provider. There's no link to Entra ID, no Okta session, nothing. If you leave it alone, users end up with a local password that drifts from their corporate password over time, no MFA at the login window, and a device your IdP has no visibility into.
Historically, organizations patched this with Active Directory binding (which has become increasingly brittle in cloud-first environments) or third-party tools. Platform SSO is Apple building this capability natively into the OS, so it's not a bolt-on but a first-class part of how macOS handles authentication.
What Platform SSO Actually Does
Platform SSO extends Apple's Extensible SSO (SSOe) framework — which lets apps and websites redirect authentication to your IdP — and takes it further by integrating identity directly into the macOS login window. Instead of being limited to web apps and SaaS tools, it ties the Mac's local user account to your cloud IdP.
Once a device and user are registered, you get:
- Local Mac credentials synchronized with or backed by your IdP
- Automatic SSO token delivery to compatible native and web apps
- MFA policy enforcement at the login window (depending on your IdP and configuration)
- Device registration with your IdP, enabling Conditional Access decisions
- No more Active Directory binding or middleware required
Platform SSO requires a Mac with Apple silicon or an Intel-based Mac with Touch ID. It also requires an MDM solution that supports the Extensible SSO configuration profile payload — like Jamf Pro — and a compatible IdP extension installed on the device.
The Three Authentication Methods
Platform SSO supports three ways to authenticate. Your choice here has real security and UX implications, so it's worth understanding all three before you design your deployment.
Password Sync
Your IdP password stays synchronized with your local Mac password. When you change it in Entra or Okta, your Mac follows. Familiar to users, easy to explain, and well-supported across IdPs.
Best for: most deploymentsSecure Enclave Key
A cryptographic key is generated and stored on-chip. Authentication uses a simplified PIN — no password ever leaves the device. Phishing-resistant and aligns with passwordless strategies. Think Windows Hello, but for Mac.
Best for: regulated industriesSmart Card
External smart card or hardware token (like a YubiKey) is used to authenticate at login. The smart card then grants SSO across apps that use your IdP for authentication. Organizations can also switch methods post-enrollment.
Best for: high-security environmentsWhat's New in macOS 26 Tahoe
Simplified Setup
This is the biggest change in macOS 26 for Mac admins. Before Simplified Setup, Platform SSO registration could only happen after a user had already created a local account on their Mac — meaning identity was always configured post-enrollment.
Simplified Setup moves Platform SSO registration into Setup Assistant itself. The device is held in Setup Assistant while the MDM profile chain and Platform SSO extension finish installing. Then macOS kicks off a required PSSO registration. The first local user account is created from the identity of whoever authenticates with the IdP — no pre-existing local account needed.
The workflow looks like this:
MDM profile chain and the Platform SSO extension from your IdP complete their installation before the user proceeds.
macOS initiates a required PSSO registration. Device attestation is requested from Apple — verifying this is a genuine Apple device — and shared with the IdP.
The user signs in with their corporate credentials. The IdP grants a session.
macOS creates the first local user account based on the authenticated identity. The device reaches the desktop with SSO already active.
Microsoft Intune now supports Platform SSO registration during Automated Device Enrollment as a generally available feature (Company Portal 5.2604.0+, with the "Enable Registration During Setup" setting enabled). Both Okta and Microsoft Entra ID are now fully supported for Simplified Setup in production.
Authenticated Guest Mode and Tap to Login
macOS 26 also ships two features particularly relevant for shared-device environments like healthcare, education, and retail: Authenticated Guest Mode and Tap to Login.
Authenticated Guest Mode
Provides a fast, temporary login experience for users who only need a Mac for a short period. Instead of provisioning a full local account, users authenticate with their IdP credentials to get an ephemeral session. When they're done, nothing persists. This is directly confirmed in Apple's enterprise release notes for macOS Tahoe.
Tap to Login (NFC)
NFC-based login using compatible accessories is now available alongside Authenticated Guest Mode. Access Keys are stored in Apple Wallet on iPhone. A user taps their iPhone to an NFC reader connected to the Mac and authenticates with their IdP credentials. Designed for shared workstations where typing credentials repeatedly is a friction point — think nurse stations, classroom carts, or lab computers.
Identity Provider Support
Not all IdPs are equal when it comes to Platform SSO feature coverage. Here's the current state as of May 2026 — this table was recently updated to reflect Microsoft's general availability announcement for Entra ID Simplified Setup support:
| Identity Provider | Password Sync | Secure Enclave | Smart Card | Simplified Setup |
|---|---|---|---|---|
| Microsoft Entra ID | ✓ | ✓ | ✓ | ✓ GA May 2026 |
| Okta | ✓ | ✓ | — | ✓ Production |
| PingFederate | In progress | In progress | — | In progress |
| Google Workspace | Not supported* | Not supported | Not supported | Not supported |
* Google Workspace does not natively support Apple's Platform SSO protocol. Some third-party MDMs can broker Google authentication through an identity proxy layer, but this is not native Platform SSO. Verify capabilities with your specific vendor.
A note on Google Workspace
If your organization uses Google as its primary IdP, Platform SSO is not your path today. Google does not support Apple's Platform SSO protocol natively — no Password Sync, no Secure Enclave key, no Simplified Setup. Some MDM vendors offer workarounds through identity brokering, but these are not the same as native Platform SSO integration.
If you're in a Google shop, Jamf Connect remains the correct solution. Keep an eye on this space and, if it matters for your org, advocate directly to your Google account team.
What About Jamf Connect?
This question comes up in every conversation about Platform SSO: does this replace Jamf Connect? The short answer is no, at least not entirely and not yet.
Platform SSO does not currently handle:
- Offline MFA — Jamf Connect supports time-based one-time passwords so users can authenticate without an internet connection. Platform SSO requires an active IdP connection.
- Privilege elevation — Jamf Connect provides managed workflows for granting and revoking admin rights. Platform SSO doesn't handle this.
- Google Workspace deployments — as covered above.
The practical deployment strategy most organizations are landing on: new device enrollments go through Platform SSO with Simplified Setup for fresh zero-touch deployments. Jamf Connect handles existing fleets during the migration window, offline auth requirements, and privilege management. Many organizations will run both in parallel for years, and that's by design — they're built to coexist.
For existing devices, the cleanest path is waiting for hardware refresh cycles. Set a target date for new devices to use Platform SSO from day one. Migrate existing devices opportunistically during upgrades rather than forcing a hard cutover that creates a support surge.