Platform SSO for Mac: A Practical Guide for Okta, Google and Microsoft 365 Businesses

Most people sign in to their Mac with one password and sign in to their work accounts with another. The two drift apart. Someone changes their cloud password, forgets to change the Mac password, and support tickets follow. Worse, the local Mac password often sits outside your identity provider entirely. It never expires, never enforces MFA, it appears in no security policy you set centrally.

Platform SSO is Apple’s answer to that problem. It connects the macOS login window directly to your identity provider. The credentials your employees use for everything else now unlock their Mac too.

Done well, it removes a whole category of password friction and closes a real security gap at the same time.

This guide explains what Platform SSO is and the three ways it can authenticate. It then covers where Okta, Google Workspace and Microsoft 365 actually stand today.

They are not at the same stage, and knowing the difference matters before you commit to a rollout.

What Platform SSO actually is

Platform Single Sign-On, usually shortened to Platform SSO or PSSO, is a framework built into macOS. It extends your identity provider all the way to the login window. Apple introduced it with macOS Ventura in 2022. Every release since has expanded it. Sonoma and Sequoia built on it, and the latest macOS generation improves setup
considerably.

It is best understood as the modern replacement for binding a Mac to a directory. In the past, organisations joined Macs to Active Directory to tie them to central identity. That approach is now the wrong one for cloud-first businesses. Platform SSO does the equivalent job for the cloud era. It links the Mac to a cloud identity provider rather than an on-premises directory.

Once configured, Platform SSO does three things. It lets the Mac create local accounts from the login window using cloud credentials. It keeps those credentials in step with
the identity provider. And it providesThe tokens that make this work are held securely on the device and refreshed automatically as they expire. The result is one identity, enforced consistently, from the moment the employee powers the Mac on.

The three authentication methods

Platform SSO can work in one of three modes. Choosing the right one is the most important decision in any deployment. It determines both your security posture
and the day-to-day experience for your team.

1. Secure Enclave key

This is the method Apple, Microsoft and Okta all recommend, and for good reason. A cryptographic key is generated and held in the Mac’s Secure Enclave, the same dedicated security hardware that backs Touch ID. The key never leaves the device, so it cannot be phished or copied off the machine. Employees authenticate with Touch ID, going effectively passwordless for cloud resources.

Crucially, the Secure Enclave method leaves the local account password untouched and separate. It meets phishing-resistant MFA requirements and works in a way conceptually similar to Windows Hello for Business on the Windows side. For most businesses that care about security, this is the right choice.

2. Password synchronisation

In this mode, the identity provider password is synchronised with the local macOS account. The employee uses the same password for their cloud accounts and their Mac, and changing it in one place updates the other. It is the simplest method to understand and the easiest for users, since there is only ever one password to remember.

It carries a trade-off worth knowing. The password method stores its keys in the iCloud Keychain, which introduces a theoretical risk that credentials could be exported and reused elsewhere. The risk is limited in practice, but for security-conscious businesses it is a reason to prefer the Secure Enclave method where the identity provider supports it.

3. Smart card

The third method uses a physical smart card or hardware token, such as a PIV or CAC card. It suits high-assurance environments, government and defence contexts, and any organisation already invested in smart card infrastructure. It is the least common of the three and requires additional hardware and configuration, so most commercial businesses set it aside in favour of one of the other two.

What you need for Platform SSO to work

Platform SSO is not something you switch on in isolation. Three things need to be in place.

1. A supported version of macOS. While Platform SSO exists from Ventura onwards, Sonoma or later is the realistic minimum for a smooth deployment, and newer is better given how much the feature has matured.
   
2. An MDM platform to deliver the configuration. Platform SSO is configured through a profile pushed by your mobile device management platform. Jamf Pro or Microsoft Intune both do this. The MDM defines which authentication method is used, how registration happens and how it ties into the rest of your device policy.
   
3. An identity provider that supports it. This is the part that trips businesses up, because support varies significantly between providers. Apple built the framework, but each identity provider has to implement its side of it, and they have done so at different speeds and to different depths. This is where the three providers you are most likely to use diverge.

Platform SSO with Microsoft 365 and Entra ID

If your business runs on Microsoft 365, your identity provider is Microsoft Entra ID, and this is the most mature Platform SSO integration available. Microsoft has invested heavily in it through the Enterprise SSO plug-in for Apple devices.

Entra ID supports all three authentication methods, and Microsoft actively recommends the Secure Enclave approach. In that mode it delivers passwordless, phishing-resistant sign-in via Touch ID, built on the same underlying technology as Windows Hello for Business. It integrates with Conditional Access, so you can require a compliant, enrolled Mac before granting access to Microsoft 365 resources, exactly as you would for a Windows device.

For a business already committed to Microsoft 365, this integration is the strongest argument for Platform SSO. The Mac stops being the odd device out in a Microsoft identity estate and becomes a first-class citizen, subject to the same access policies, the same MFA enforcement and the same passwordless experience as everything else. For mixed Mac and Windows fleets on Microsoft, it brings genuine consistency to how identity works across both platforms.

Platform SSO with Okta

Okta was the first identity provider to support Platform SSO, alongside Jamf, back in 2023. Its implementation lives within Okta Device Access, the part of Okta’s platform that extends identity to the device login itself.

Okta’s support began with password synchronisation, branded as Desktop Password Sync, which lets employees sign in to their Mac with their Okta credentials directly at the login screen. More recently Okta has added Secure Enclave-backed key support through Platform SSO, bringing it into line with the hardware-bound, passwordless approach that Microsoft offers. That is a meaningful step, because it means Okta businesses no longer have to accept the password method’s trade-offs to get Platform SSO working.

Deployment requires the Okta Verify app on each Mac and configuration of Okta Device Access on the identity side, delivered through your MDM. For businesses that have standardised on Okta as their identity layer, Platform SSO closes the last gap, extending Okta’s reach from applications all the way down to the Mac lock screen. Onboarding becomes genuinely seamless: a new starter signs in once with their Okta identity and the Mac provisions their account from the login window.

Platform SSO with Google Workspace, the honest picture

Here is the part most guides skip, and the part that matters most if you run on Google. Google Workspace does not offer a first-party Platform SSO integration in the way Microsoft and Okta do. There is no Google equivalent of the Microsoft Enterprise SSO plug-in or Okta Device Access that plugs natively into the macOS login window.

This is not a small detail. It means a Google Workspace business cannot simply switch on Platform SSO the way an Entra ID or Okta business can. If your identity lives in Google and you want cloud credentials at the Mac login window, you generally need one of two approaches.

The first is a dedicated tool that bridges Google identity to the Mac. Jamf Connect has done exactly this since 2018, bringing cloud identity to Mac account provisioning and login, and it works with Google as the identity source. For many Google Workspace businesses, Jamf Connect rather than native Platform SSO is the practical route to a cloud-credential login experience.

The second is to federate Google through an identity provider that does support Platform SSO. Some businesses put Okta or Entra ID in front of Google Workspace, using Google for productivity while the Platform SSO-capable provider handles device identity. This adds architecture and cost, so it only makes sense in specific circumstances.

The honest takeaway: if you are a Google Workspace business set on Platform SSO, plan for Jamf Connect or a federation layer rather than expecting native support. Knowing this before you start saves a great deal of wasted configuration effort.

How this compares to the Windows side of a mixed fleet

If you run a mixed Mac and Windows fleet, it helps to see Platform SSO as the Apple counterpart to something Windows has had for a while. On Windows, Windows Hello for Business provides the same passwordless, hardware-backed, phishing-resistant sign-in, tied to Entra ID. Platform SSO with the Secure Enclave method is deliberately built along the same lines, which is why Microsoft describes the two as conceptually equivalent.

For a business standardising identity across both platforms, that parallel is the goal. Windows devices authenticate through Windows Hello for Business, Macs authenticate through Platform SSO, and both answer to the same identity provider with the same access policies. The employee experience becomes consistent regardless of which device they pick up, and your security team enforces one set of rules across the whole estate rather than treating the Macs as an exception.

Getting the Apple half of that picture right is usually where mixed-fleet businesses need the most help, because the Windows side is familiar ground and the Mac side is not. Our guide on why Windows IT teams struggle with Mac management covers that gap in more detail.

Why Platform SSO matters for security and compliance

Platform SSO is often sold on convenience, one identity, fewer passwords, smoother onboarding. The stronger case is a security one.

An unmanaged local Mac password is a genuine weakness. It sits outside your identity provider, so it does not expire, does not require MFA and does not respond to any central policy. If an employee leaves, that local password may remain valid on the device until someone manually intervenes. Platform SSO closes this gap by bringing the login itself under the control of your identity provider.

With the Secure Enclave method, you gain phishing-resistant, passwordless authentication that satisfies MFA requirements and aligns with the direction insurers and frameworks are pushing. For businesses pursuing Cyber Essentials, strong access control is one of the five core controls, and Platform SSO is a clean way to demonstrate that Mac access is governed by the same enforced identity as everything else. It turns the Mac login from an unmanaged local secret into a controlled, auditable part of your security posture.

Tying device access to cloud identity also strengthens your joiner and leaver process. When identity is central, deprovisioning a departing employee in your identity provider cuts their access to the Mac as well, rather than leaving a valid local account behind.

Common mistakes to avoid

Choosing the password method by default. It is the simplest to set up, so it gets chosen without much thought. Where your identity provider supports the Secure Enclave method, that is almost always the better choice for security. Default to Secure Enclave and use password sync only when you have a specific reason.

Assuming Google Workspace works like the others. As covered above, it does not. A Google business that plans a Platform SSO rollout expecting native support will hit a wall. Plan the Jamf Connect or federation route from the start.

Configuring it without testing across macOS versions. Behaviour differs between macOS generations, and a fleet running a mix of versions needs the profile tested on each. Rolling out to the whole fleet before piloting is how avoidable problems reach every employee at once.

Overlooking FileVault interaction. How Platform SSO interacts with FileVault at the login window depends on the method and macOS version chosen. This needs deliberate configuration rather than being left to default, particularly where the password method is in use.

Treating it as a one-off switch rather than part of device management. Platform SSO works as part of a properly configured MDM and identity setup, not in isolation. It depends on the enrolment, the profiles and the identity integration around it all being correct.

How nDuo helps

We implement Platform SSO for UK businesses across all three identity providers, and crucially we know where each one stands.
– Microsoft 365 and Entra ID businesses, we configure Platform SSO with Secure Enclave and tie it into Conditional Access.
– Okta businesses, we deploy Okta Device Access and the Secure Enclave method through your MDM.
– Google Workspace businesses, we advise honestly on the Jamf Connect or federation route rather than promising native support that does not exist.

That means configuring the MDM profiles correctly, choosing the right authentication method for your security requirements, testing across your fleet before rollout and integrating the result into your wider Apple management and security posture. The goal is one enforced identity from the Mac login window outward, whichever identity provider you run.

If your Mac logins currently sit outside your identity provider, or you are planning a move to passwordless authentication and want the Apple side done properly, this is exactly the kind of work we do.

Read our guide to the perfect employee onboarding process to see how Platform SSO fits into a seamless first-day experience, or our Jamf Pro vs Microsoft Intune comparison to understand the MDM layer that delivers it.

Book a free consultation with our team to talk through Platform SSO for your identity provider and get a clear recommendation on the right approach.