Enabling Platform Single Sign-On (PSSO) on your Mac

Platform Single Sign-On (PSSO) allows you to sign in to your Mac using your UWin Account credentials (your Microsoft work or school account). Once you sign in to your Mac, you will also be automatically signed in to supported University applications and websites, reducing the number of times you need to enter your credentials.

Originally, PSSO was deployed to Mac users using the Password configuration, which synchronizes the Mac password with the UWin Account password. The newer configuration, called Secure Enclave PSSO, is being rolled out gradually and does not synchronize the Mac password with the UWin Account password. Instead, macOS creates a hardware-bound passkey, known as a platform credential. The private key remains securely protected within the Mac's Secure Enclave, while the corresponding public key is registered with Microsoft Entra ID.

Once IT Services has enabled PSSO for your account, sign in to your Mac as you normally would, then follow the steps below to complete the SSO setup on your Mac:

1. You will eventually see the Registration Required pop-up at the top right of the screen. Hover over the pop-up or click on it and select Register. 

   

2. When a Single Sign-On for Mac window appears, select Continue. 

3. You will be prompted to Register your macOS account with your identity provider. Enter your Mac account credentials and select Next. 

4. When the Register your device with Microsoft Entra sign-in window appears, select the University account you want to use. If required, enter your UWin Account credentials.

5. Complete multi-factor authentication (MFA) when prompted.

6. You should see Preparing your device.... message. This can take a couple of minutes. Stay on this screen until your device is ready.

7. When registration is completed, you will see Single- Sign-on for Mac - Registration complete message. Click on Close to finalise this setup.

Troubleshooting

Once you've completed the steps above, it's a good idea to check your device registration status.

1. To check that registration has completed successfully, navigate to Settings and select Users & Groups.

2. Select Edit next to Network Account Server and check that Mac SSO Extension is listed as Registered.

3. To verify the method used for authentication, navigate to your username in the Users & Groups window and select the Information icon ("i" in a circle). Check the method listed, which should be Secure enclave key or Password, depending on which config profile was assigned to your account by the admin.

If Platform SSO does not show "Registered", or your PSSO registration is not working correctly:

1. Open System Settings.
2. Select Users & Groups.
3. Next to Network Account Server, select Edit.
4. Select Repair. This option is available on macOS 14 and later and restarts the Platform SSO registration process.
5. Follow the registration prompts. Unlock your local account when requested, then sign in with your University Microsoft Entra account and complete MFA. For Secure Enclave PSSO, macOS provisions the Secure Enclave-backed credential as part of this registration process.
6. When registration is finished, return to System Settings > Users & Groups > Network Account Server > Edit and confirm that Platform SSO now shows "Registered."

Registration Message Not Displayed

If Registration Required message is not showing in the top-right corner of your Mac desktop, you can complete the registration another way:

1. Open Settings.
2. Select Users & Groups.
3. Select Edit next to "Network account server"
4. If you see a Register button, select it and follow the on-screen prompts.