Has anyone experienced macOS Platform SSO working normally for several weeks and then suddenly prompting the user to register again? We use Secure Enclave-based PSSO, and when the issue occurs, Conditional Access prevents the user from accessing services through the browser. We have more than 700 enrolled devices, but only around 20–30 users appear to be affected. I'm looking for likely causes, diagnostic steps, or a reliable fix.
3 Answers
Check the device state before repairing it. Running `app-sso platform -s` can show whether the local PSSO configuration is corrupted or whether the registration has simply disappeared. That distinction may help determine whether a macOS update, re-registration, or a full rebuild is appropriate.
There may be two issues happening at once: a macOS PSSO registration problem and a Conditional Access policy blocking the recovery process. Recent changes to policies that target security-information registration can cause the user to be evaluated by Conditional Access while PSSO is trying to register. Temporarily placing the relevant policy in report-only mode, or reviewing its device-compliance and authentication-strength requirements, can help confirm whether it is causing the browser lockout.
This is a known and frustrating failure mode with Mac device trust and Entra registration. The Mac can silently lose its trust relationship, then recognize the problem weeks later and request registration again. Forcing a repair does not always work and can sometimes leave the device in a worse state. If the affected devices are below macOS Sequoia 15.3, patching them is worth trying because earlier versions had an AppSSOAgent/AppSSODaemon concurrency issue that could corrupt the PSSO configuration.
We have more than 700 enrolled devices, but only about 20–30 users are affected, so it does seem limited to certain machines or configurations.
I ran `app-sso platform -s` on a few affected machines, and it reported that they were registered. However, the users continued receiving repeated PSSO registration prompts and the registration never completed.