Has anyone else experienced macOS Platform SSO working normally for several weeks and then suddenly prompting users to register again? We use Secure Enclave, and when the device loses its Entra trust, our Conditional Access policy prevents the user from accessing browser-based services. We have more than 700 enrolled devices, but only around 20–30 users appear to be affected. Is there a reliable fix or a way to identify what causes the registration to fail?
2 Answers
This is a known problem with macOS Platform SSO and Entra device trust. The Mac can silently lose its trust relationship, then discover the problem weeks later and request registration again. Attempts to force a repair can sometimes make things worse. Check whether the affected Macs are running an older macOS version, since Apple has addressed some Platform SSO configuration corruption issues in newer releases. Before repairing a device, run `app-sso platform -s` and save the output so you can determine whether the configuration is corrupted or whether the registration was simply lost.
There may be two separate issues here. One is the macOS Platform SSO registration failure itself; the other is Conditional Access blocking the user during the recovery process. Conditional Access rules that apply to security-information registration can now affect Platform SSO credential registration. If the policy requires a compliant device or a particular authentication strength, a Mac that is already out of sync may be unable to satisfy the requirement and gets stuck in a registration loop. Temporarily placing the relevant policy in report-only mode can help confirm whether Conditional Access is causing the browser lockout, while you review the sign-in logs for the affected users.
I ran `app-sso platform -s` on a few affected machines, and it reported that they were registered. However, the users continued receiving repeated Platform SSO registration prompts and the devices never completed registration.