For a long time, bringing your organisation's identity down onto a Mac meant one of two things. You either created and managed local accounts by hand, or you paid for a third-party tool to bridge the gap between your cloud identity and the login window. Apple has spent the last few years changing that with Platform Single Sign-On, and the most recent macOS releases have moved it from an interesting idea into something you can build a real deployment around.

What Platform SSO actually is

Platform SSO is Apple's own framework for signing users into a Mac with their identity provider credentials, and then handing them single sign-on into any app or website federated with that same provider. The work is done by an extension supplied by your identity provider: Microsoft's Company Portal app for Entra ID, or Okta Verify for Okta. Once a user has registered, they authenticate once and pick up a token that carries them into their Microsoft or Okta protected apps without typing a password again.

The important word is "platform". Single sign-on inside individual apps has been around for a while. Platform SSO takes that idea and applies it to the whole Mac, starting right at login. And because it's built into macOS, you no longer need a separate product sitting in front of the login window to make it happen.

The three authentication methods

When you configure Platform SSO, you choose how the Mac proves who the user is. There are three options, and the choice matters more than it first appears.

Password uses the user's identity provider password. The local Mac account password becomes the Entra or Okta password, and the two are kept in step automatically.

Secure Enclave key uses a cryptographic key held in the Mac's Secure Enclave, the same hardware that backs Touch ID. The key never leaves the device, so it can't be phished or copied off the machine.

Smart Card uses a physical smart card or equivalent. It's the right answer for specific high-assurance environments, but it's the least common of the three, so I'll set it aside for this series.

Most organisations end up choosing between the first two, so it's worth putting them side by side.

Access options

The line that sums it up: with password mode you get local account password sync as part of the SSO payload you're already running, whereas with Secure Enclave key authentication you're strengthening your security posture with a non-exportable, hardware-bound method for reaching your cloud resources. It sits close in spirit to Windows Hello for Business, and it can lean on the same Conditional Access machinery.

There's one detail in that table worth pulling out, because it drives a lot of design decisions later in the series. In Secure Enclave mode, Platform SSO deliberately leaves the local account password alone. It doesn't change it, and it doesn't sync it. That's by design, because FileVault uses the local password as its unlock key, and Apple isn't about to let an SSO extension quietly break disk encryption. So Secure Enclave mode gives you an excellent security posture but says nothing about keeping the Mac's password aligned with the cloud. If you want that alignment too, something else has to provide it. Hold that thought, because it's central to Part 3.

Simplified Setup: the change that reframed everything

The single biggest development in the last year arrived with macOS 26 Tahoe, and it's called Simplified Setup.

Before it, Platform SSO had a slightly awkward chicken-and-egg problem. You could only configure it after a user had already created a local account on the Mac, so the polished cloud-identity experience only kicked in once someone had gone through the old local-account routine first.

Simplified Setup removes that. It folds Platform SSO registration into the Setup Assistant itself, during automated device enrolment. The Mac pauses early in setup, the user signs in with their Entra or Okta credentials, and the first local account is then created straight from that identity, provisioned from the token. The user lands on the desktop already registered for Platform SSO, with no separate prompt to chase afterwards. Put another way, the very first account on the device is the cloud identity, which is what people have wanted from Mac identity for years.

A note of realism is fair here. Simplified Setup needs macOS 26 or later and a current build of the identity provider's app, and for Entra ID that means keeping Company Portal up to date. There are still a few edges being smoothed off, such as mapping the right attribute to the local account's short username. It works well today, but it rewards proper testing before a wide rollout.

Authenticated Guest Mode

Alongside Simplified Setup, macOS 26 also brought Authenticated Guest Mode. This lets someone sign into a shared Mac with their organisational credentials for a temporary session, authenticated through Platform SSO, without creating a permanent local account or home folder, while still getting single sign-on to your resources. If you run shared or hot-desk Macs, it's well worth a look.

What's coming in macOS 27

Platform SSO isn't standing still. macOS 27 Golden Gate, in public beta now and expected to ship around September, takes it further again. The headline for identity is web-based authentication: an identity provider web view that can appear at the login window, the lock screen and even the FileVault unlock screen, bringing passwordless sign-in and stronger multi-factor options such as push approvals and QR-code scanning right to the point of login. Touch ID can be required by policy, and Platform SSO is also moving onto Apple's Declarative Device Management model.

That's a meaningful shift, because the login window has always been the part of the Mac that Platform SSO couldn't fully own. macOS 27 starts to close that gap, which raises an obvious question.

Jamf Connect, What’s next

If Platform SSO can now provision accounts during setup, authenticate at the login window and satisfy Conditional Access, where does that leave Jamf Connect? That's exactly what Part 2 tackles. And in Part 3, I'll walk through the setup we're recommending to customers right now, including where Jamf Connect still earns its keep.

Further reading