Platform SSO

Platform SSO is an Apple framework that lets Macs authenticate against an organization’s identity provider (IdP) from the very first login and keep that credential in sync everywhere the user needs to sign in — the login window, apps, and the browser — instead of prompting for a password at every step.

What to Know

Introduced with macOS 13 Ventura, Platform SSO works through a vendor-built SSO extension delivered to the Mac through an MDM profile (the Extensible Single Sign-On payload). Once registered, the extension can authenticate the user with a password, a web-based sign-in flow, a smart card, or a Secure Enclave–backed key, and it can silently renew tokens in the background so users aren’t repeatedly re-prompted. Platform SSO requires Apple silicon, or an Intel Mac with a Touch ID sensor, along with an MDM solution that supports delivering the Extensible Single Sign-On payload.

Because Platform SSO ties the local macOS account to a cloud identity, it also underlies Apple’s Simplified Setup workflow, introduced with macOS 26. Previously, an admin had to finish creating a local account during Setup Assistant before Platform SSO could register; Simplified Setup moves that registration earlier, so the IdP-authenticated identity itself creates the Mac’s one and only local account during first boot.

For admins, Platform SSO reduces password fatigue and helps enforce consistent authentication policy across devices, but it requires coordination between the MDM, the identity provider, and — in most deployments — a client app that hosts the SSO extension.

Common Scenarios

Enterprise IT: Enterprise teams use Platform SSO to align Mac login with their existing cloud identity provider, cutting down on helpdesk tickets tied to password drift between the local Mac account and cloud credentials, and enabling access policies tied to device and user state.

MSP: MSPs managing Macs for multiple clients use Platform SSO to standardize identity across tenants that each run their own IdP, relying on MDM-delivered profiles to keep the SSO extension configuration consistent without touching each Mac by hand.

Education: Education IT teams use Platform SSO to connect shared or 1:1 Macs to the district’s or institution’s identity provider, cutting down the number of sign-in prompts students and staff see while still enforcing the district’s password and access policies.

In Addigy

Addigy supports Platform SSO through Extensible SSO configuration profiles for identity providers including Microsoft Entra ID and Okta, deployed via policy so admins don’t have to hand-edit a profile. Addigy’s Identity feature and Platform SSO can work together or independently, depending on how much of the deployment an org wants their IdP versus Addigy to handle.

For fleets running macOS 26 or later with a supported identity provider, that same Extensible SSO profile also enables Apple’s Simplified Setup flow, registering Platform SSO during Setup Assistant itself instead of after enrollment. For fleets on older macOS versions, or IdPs without Simplified Setup support yet, admins should confirm their identity provider and MDM payload settings line up before deploying broadly, since requirements continue to evolve with newer macOS releases.