Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
For a current Microsoft Entra deployment, use Platform SSO as the primary design and treat the basic Microsoft Enterprise SSO plug-in as the lighter-weight option. Both are delivered through an Apple MDM configuration profile, but Platform SSO adds device registration, Secure Enclave or smart-card authentication, local-account management, password synchronization, and login-window capabilities.
This updates the procedure described in the original HTMD Blog guide, which was published in 2023 and predates several current Platform SSO requirements.
What Extensible SSO does on macOS
Apple’s Extensible Single Sign-On framework lets an MDM install and configure an SSO app extension. The extension handles authentication for specified identity-provider URLs and supported applications.
For Microsoft Entra ID, the extension is delivered through Company Portal for macOS. Microsoft’s Enterprise SSO plug-in can reduce repeated sign-in prompts in supported browsers and applications. It does not, by itself, create a local Mac account or replace MDM enrollment.
#1 Best Overall
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Platform SSO builds on this mechanism. It can add device-bound credentials, Secure Enclave passwordless authentication, smart-card authentication, local and Entra password synchronization, login-window policies, and local-account creation in supported enrollment scenarios.
Enterprise SSO plug-in versus Platform SSO
| Capability | Enterprise SSO plug-in | Platform SSO |
|---|---|---|
| Reduce repeated Microsoft Entra sign-ins | Yes | Yes |
| Requires an MDM profile | Yes | Yes |
| Device-bound credentials | No or limited | Yes |
| Secure Enclave passwordless sign-in | No | Yes |
| Smart-card authentication | No | Yes |
| Synchronize local and Entra passwords | Not its main purpose | Yes, with the password method |
| Create local users at login | No | Yes, subject to macOS and enrollment requirements |
| Registration during Automated Device Enrollment | Not by itself | Yes, with coordinated configuration |
Choose the basic plug-in when the objective is mainly fewer authentication prompts on already-enrolled Macs. Choose Platform SSO when device registration, phishing-resistant authentication, local-account controls, or login-window integration are part of the design.
Prerequisites
Core requirements
- Mac computers enrolled in an MDM service such as Microsoft Intune.
- A Microsoft Entra tenant and users configured for the intended authentication flow.
- Company Portal for macOS installed and signed in.
- Appropriate permissions for device registration or Microsoft Entra join.
- A configuration profile assigned to the intended users or devices.
- Network access to the applicable Microsoft Entra authentication endpoints.
- MFA and Conditional Access requirements understood before rollout.
Platform SSO requirements
Microsoft documents Platform SSO support for macOS 13.0 and later and recommends macOS 14 Sonoma or later for the better current experience. The cited Intune guidance requires Company Portal 5.2404.0 or later. Apple also requires a supported MDM, a compatible Platform SSO extension, and either Apple silicon or an Intel Mac with Touch ID.
Authentication choices include Password, UserSecureEnclaveKey, and, on supported macOS 14-and-later configurations, SmartCard. Safari and Microsoft Edge support the experience. Chrome requires the Microsoft Single Sign On extension, while Firefox requires the appropriate Microsoft Entra SSO policy.
Choose an authentication method
- Password: Synchronizes the local account password with the Microsoft Entra password. It is familiar and broadly understandable, but creates dependencies for password changes, expiration, offline login, FileVault, and recovery.
- UserSecureEnclaveKey: Uses a hardware-protected credential on supported Macs and enables a passwordless or Touch ID-oriented experience. Plan recovery for device replacement, Secure Enclave problems, and account lockout.
- SmartCard: Uses a smart card or compatible hardware token. It suits certificate-based or regulated environments, but smart-card registration is not supported during the relevant Setup Assistant flow and may need to be completed afterward.
For macOS 13, Microsoft documents Authentication Method (Deprecated). For macOS 14 and later, use Platform SSO → Authentication Method. Do not configure the older field as though it were the correct setting for every macOS release.
Create the Intune configuration profile
- Sign in to the Microsoft Intune admin center.
- Go to Devices → Manage devices → Configuration.
- Select Create → New policy.
- Choose Platform: macOS and Profile type: Settings catalog.
- Name the profile and continue to Configuration settings → Add settings.
- Browse to Authentication → Extensible Single Sign On (SSO).
Microsoft may reorganize Intune navigation, but the Settings Catalog location is the relevant configuration area.
Basic Microsoft Entra Enterprise SSO values
For a redirect-based configuration, use Microsoft’s current documented values:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- BUILT FOR COLLEGE. AND BEYOND — MacBook Air with the M5 chip packs blazing speed and powerful AI capabilities into an incredibly portable design. And with up to 18 hours of battery life,* this thin and light powerhouse is ready to take on almost any major, just about anywhere.
- TEAR THROUGH TOUGH ASSIGNMENTS — With its faster CPU and unified memory, the M5 chip delivers even more performance and fluidity across apps, making multitasking and creative workflows smooth and responsive. A powerful Neural Engine and next-generation GPU with Neural Accelerators give you a powerful platform for AI.
- MAKE QUICK WORK OF YOUR TO-DO LIST — Apple Intelligence helps you write, express yourself, and get things done effortlessly — whether it’s for school or everyday life. With groundbreaking privacy protections, it gives you peace of mind that no one else can access your data — not even Apple.*
- UP TO 18 HOURS OF BATTERY LIFE — MacBook Air delivers incredible battery life with amazing performance, so you can power through a full day of classes without worrying about plugging in.
- A BRILLIANT 13.6-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Air supports 1 billion colors, making photos and videos pop with rich contrast and sharp detail, and text appears supercrisp. So everything — from class presentations to movies to games — looks truly stunning.
Extension Identifier: com.microsoft.CompanyPortalMac.ssoextension
Team Identifier: UBF8T346G9
Type: RedirectConfigure the Microsoft Entra URLs that apply to your cloud and geography. Global-cloud examples are:
https://login.microsoftonline.com
https://login.microsoft.com
https://sts.windows.netMicrosoft also documents these sovereign-cloud endpoints:
https://login.partner.microsoftonline.cn
https://login.chinacloudapi.cn
https://login.microsoftonline.us
https://login-us.microsoftonline.comDo not automatically include China or US Government endpoints in every tenant. Select URLs appropriate to the organization’s Microsoft cloud. An optional application prefix allow list may include:
com.apple.,com.microsoftUse that option only when it matches the organization’s application scope. The full Microsoft parameter guidance is available in the Microsoft Entra SSO plug-in documentation.
Platform SSO settings
Configure Platform SSO settings in the same Settings Catalog profile. Select the authentication method that matches the macOS version and the recovery model you can support. On macOS 15 and later, Microsoft documents a Platform SSO FileVault policy. When the Password method is selected, the relevant value is AttemptAuthentication.
Do not enable password synchronization, FileVault integration, or login-window account management across a production fleet until you have tested password changes, offline login, FileVault unlock, password expiration, recovery, and offboarding.
Deploy Company Portal before expecting SSO
Company Portal is not merely a user-facing enrollment utility in this configuration. It delivers the Microsoft Enterprise SSO plug-in required by the Microsoft implementation.
Rank #3
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
- Add the current Company Portal for macOS to Intune.
- Deploy it as a required application where appropriate.
- Ensure the Mac receives the application before the Platform SSO profile is expected to activate.
- Confirm that the installed version meets the documented requirement.
- Have the user sign in to Company Portal and complete registration.
An old Company Portal build can cause Platform SSO to fail even when Intune reports that the configuration profile succeeded.
Assign the profile for the enrollment scenario
Existing Intune-enrolled Macs
Assign the profile to the intended user or user group. The Mac receives it at the next check-in, after which the user completes registration when prompted.
New organization-owned Macs
Use Apple Business Manager or Apple School Manager with Automated Device Enrollment. Coordinate the enrollment profile, required Company Portal application, and Platform SSO Settings Catalog policy.
For Platform SSO during Setup Assistant, Microsoft requires the relevant components to be assigned consistently. Assigning them to different static groups, dynamic groups, or device groups can cause enrollment failure. Follow Microsoft’s Platform SSO during Automated Device Enrollment guidance exactly.
Personal or BYOD Macs
Use the appropriate Intune enrollment method and ensure user affinity and Company Portal sign-in are understood. Do not assume that a personal Mac supports every organization-owned-device feature, including enrollment-time local-account creation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Complete user registration
On an already configured Mac, the usual flow is:
- The device receives the MDM profile and Company Portal.
- A Registration required notification may appear.
- The user selects the notification or opens Company Portal.
- The user signs in with the Microsoft Entra account.
- The user completes MFA if required.
- The Mac registers with Microsoft Entra ID and receives the relevant workplace-join certificate.
- Supported browsers and applications can use the resulting SSO state.
The experience differs when Platform SSO is configured during Setup Assistant. A Ventura or Safari demonstration from the older HTMD article should not be treated as representative of every current Platform SSO flow.
Verify the deployment
In Intune
- Open the profile’s device and user assignment status.
- Check Succeeded, Error, Conflict, and Not applicable results.
- Review the device’s last check-in and policy-sync state.
- Confirm Company Portal installation status and version.
On the Mac
- Open System Settings → Privacy & Security → Profiles and confirm that the MDM profile arrived.
- Review Company Portal preferences for registration, deregistration, and account-removal controls.
- On supported newer macOS versions, inspect Platform SSO registration information in System Settings.
Test applications, not just policy delivery
Test Safari and Microsoft Edge against a Microsoft Entra-protected site. If Chrome is in scope, install and enforce the Microsoft Single Sign On extension. If Firefox is in scope, deploy its Microsoft Entra SSO policy.
Rank #4
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Also test at least one non-Microsoft application using OAuth 2.0, OpenID Connect, or SAML, plus a Conditional Access-protected resource. A successful Intune profile status proves policy delivery, not universal application SSO. URL matching, application support, browser configuration, Conditional Access, network inspection, and token state can all affect the result.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting
The profile says Succeeded, but SSO does not work
Check the exact extension identifier, Team ID, Company Portal version, Company Portal sign-in state, profile assignment, configured URLs, browser requirements, and conflicting SSO profiles. The current Microsoft identifier is com.microsoft.CompanyPortalMac.ssoextension; the abbreviated com.microsoft value is not the complete Microsoft configuration value.
Recommended Free Tools
SSO works in Safari but not Chrome
Deploy the Microsoft Single Sign On extension through Chrome Enterprise policy or an Intune preference configuration. Chrome needs that additional extension for this scenario.
The registration prompt never appears
Verify Company Portal installation and sign-in, Intune check-in, registration permissions, MFA, Conditional Access, proxy filtering, and TLS inspection. Also check for an old Company Portal build or a stale existing device registration.
Existing local accounts behave unexpectedly
Platform SSO does not automatically convert every existing local account into a correctly managed Entra-linked account. Decide which account is primary, whether it is standard or administrator, whether password synchronization is wanted, how deregistration will work, and how FileVault unlock users will be managed.
ADE enrollment fails
Use the same required static user groups for the enrollment profile, Company Portal app, and Platform SSO policy where Microsoft specifies that model. Confirm that Company Portal is available at the required stage. If enrollment is left inconsistent, wiping and re-enrolling may be necessary.
Several SSO extensions claim the same domain
Apple allows a specific domain to be handled by only one SSO extension. Avoid overlapping Microsoft, Okta, Kerberos, or other identity-provider profiles for the same authentication domain.
Best Value
- FAST RUNS IN THE FAMILY — The 16-inch MacBook Pro with the M5 Pro or M5 Max chip brings next-generation speed and powerful on-device AI to personal, professional, and creative tasks. With all-day battery life, double the starting storage,* and a breathtaking Liquid Retina XDR display, it’s pro in every way.*
- BUCKLE UP — Along with a next-generation CPU, faster unified memory, and up to 2x faster SSD storage,* M5 Pro and M5 Max feature a more powerful GPU with a Neural Accelerator built into each core, delivering faster AI performance and on-device training capabilities. So you can blaze through demanding workloads at mind-bending speeds.
- BUILT FOR AI — Apple silicon, and every major component that powers it, is designed to run demanding on-device AI workloads like LLM inference and training. And Apple Intelligence helps you write, express yourself, and get things done effortlessly with groundbreaking privacy protections at every step.*
- ALL-DAY BATTERY LIFE — MacBook Pro delivers the same exceptional performance whether it’s running on battery or plugged in.*
- MACOS RUNS APPS FAST — All your go-to apps run lightning fast in macOS, including built-in apps like FaceTime and Messages. Plus, built-in virus protection and free software updates help keep your Mac running smoothly and securely.
Security and operational planning
Platform SSO is not a substitute for MDM enrollment, and passwordless authentication is not automatic. Secure Enclave or smart-card authentication must be configured and supported by the hardware and macOS version.
Before production rollout, document break-glass access, device replacement, local administrator privileges, offboarding, deregistration, lost tokens or smart cards, password recovery, offline use, and FileVault recovery. Define how long cached credentials remain usable and what happens after prolonged offline use or password expiration.
Alternatives to Intune
Extensible SSO is an Apple MDM payload, so it can also be delivered by Apple-focused platforms such as Jamf Pro, Kandji, or Mosyle, provided the MDM supports the required Apple payloads and the identity provider’s extension.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsOrganizations standardized on Okta may evaluate Okta Device Access. That is a different identity-provider path and should not be mixed with Microsoft Entra workflows without a clear ownership model. For on-premises Active Directory resources, Platform SSO can also be combined with a Kerberos SSO configuration where appropriate.
Frequently Asked Questions
Does Platform SSO work without Intune?
It does not require Intune specifically, but it requires an MDM that supports Apple’s Extensible SSO and Platform SSO payloads. The Microsoft Company Portal implementation is designed for Microsoft-managed deployments.
Is Platform SSO the same as the Enterprise SSO plug-in?
No. Platform SSO incorporates the SSO mechanism and adds device registration, authentication methods, login-window behavior, and local-account capabilities.
Does Platform SSO create a Mac local account?
It can create local accounts in supported Platform SSO and enrollment scenarios, but it does not automatically convert every existing local account into a managed Entra account.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Is macOS 13 still supported?
Microsoft documents Platform SSO support from macOS 13.0. For macOS 13, use the documented Authentication Method (Deprecated) setting; macOS 14 and later use Platform SSO → Authentication Method.
Can multiple identity providers handle the same domain?
No. Apple’s guidance indicates that a specific domain should be handled by only one SSO extension, so overlapping identity-provider profiles can conflict.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
