Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID
Authentication

Macos Platform Sso Architecture

21 October 2026Doc update+63 / −26 lines

In brief

The documentation now explains Password, UserSecureEnclaveKey, and SmartCard registration and authentication flows, including credential handling, device proof, and PRT issuance. It also recommends UserSecureEnclaveKey for most deployments.

What Entra admins need to know

Administrators can use the expanded guidance to select and configure an authentication method and understand its credential behavior.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

User registration

User registration associates the local macOS user with a Microsoft Entra identity and provisions the authentication method selected by the administrator. More details in the Authentication methods section below.

The supported methods are:

  • UserSecureEnclaveKey
  • Smart Card

With the UserSecureEnclaveKey method, user registration also provisions a hardware-bound user key:

  1. The user completes Microsoft Entra authentication and any required multifactor authentication.
  2. macOS creates or accesses a user key protected by the Secure Enclave.
  3. The public key is registered with Microsoft Entra ID and associated with the user and device.
  4. The private key remains protected on the Mac.
  5. The extension completes the user's PSSO configuration.

Diagram that shows the Platform SSO device and user registration sequence.

Figure 2. Device registration establishes device trust; user registration associates a user and authentication method with the Mac.

Authentication methods

The authentication method determines how the user proves their identity.

Password

With the Password method, macOS synchronizes the local account password with the user's Microsoft Entra password:

  1. After Platform SSO user registration completes, macOS Platform SSO (Apple) prompts the user to enter their Microsoft Entra password.
  2. macOS uses the user's Microsoft Entra username and password to request a Platform SSO PRT. The request also includes device proof that binds it to the registered Mac.
  3. Microsoft Entra ID verifies the credential, validates the device proof and issues the PRT.
  4. After the PRT is issued successfully, macOS updates the local account password to match the Microsoft Entra password.
  5. If the Microsoft Entra password changes later, macOS prompts the user to authenticate and updates the local password to keep the passwords synchronized.

This method reduces the number of passwords the user must manage, but it isn't passwordless or phishing-resistant

UserSecureEnclaveKey

With the UserSecureEnclaveKey method, user registration also provisions a hardware-bound user key:

  1. macOS Platform SSO (Apple) generates a user key protected by the Secure Enclave.
  2. The user completes Microsoft Entra authentication and any additional authentication required to register the key.
  3. The public key is registered with Microsoft Entra ID and associated with the user and registered Mac.
  4. The private key remains protected by the Secure Enclave and isn't exported from the Mac.
  5. The Microsoft Enterprise SSO plug-in completes the user's Platform SSO configuration.
  6. When requesting a Platform SSO PRT, macOS creates an assertion and signs it with the Secure Enclave-protected private key. The request also includes device proof that binds it to the registered Mac.
  7. Microsoft Entra ID verifies the assertion with the registered public key, validates the user and device proofs, and issues the PRT.

The local account password remains a separate local credential and is never updated as part of PSSO with this auth method. Microsoft recommends  UserSecureEnclaveKey  for most Platform SSO deployments.

SmartCard

With the Smart Card method, the user proves their identity by using a certificate and its associated private key:

  1. The user completes the required smart card and PIN interaction.
  2. macOS creates an authentication assertion and uses the smart card's private key to sign it. The private key remains on the smart card and isn't exported.
  3. The PRT request includes the signed assertion, the associated certificate information, and device proof that binds the request to the registered Mac.
  4. Microsoft Entra certificate-based authentication validates the certificate, user mapping, signed assertion, and device proof before Microsoft Entra ID issues the Platform SSO PRT.

Diagram that shows a comparison of Platform SSO authentication methods.

Figure 3. Password, UserSecureEnclaveKey, and Smart Card are alternative methods for producing user authentication proof.

Identity-provider configuration

  • The active authentication method.
  • The application, audience, and scopes used by the protocol.
  • The requirements for validating service responses.
  • The representation of method-specificrequest format for the selected authentication proof.method.
  • Kerberos TGT mapping as applicable.

macOS persists this information through Apple's PSSO framework. This arrangement allows macOS to coordinate login, unlock, account management, credential refresh, and System Settings experiences while Microsoft remains responsible for Microsoft Entra registration and service-specific validation.

  1. macOS decrypts, validates, and saves the Platform SSO PRT using operating-system protections.
  2. macOS makes the PRT available to the Microsoft SSO extension through Apple's PSSO framework.
  3. The extension uses the PRT to obtain app-specific tokens or complete supported web SSO.
  4. macOS manages Platform SSO PRT refresh automatically. If the Platform SSO tokens are missing, expired, or more than four hours old, macOS Platform SSO attempts to refresh them or obtain new tokens from Microsoft Entra ID.

The user's password, private key used by UserSecureEnclaveKey, or smart-card private key isn't converted into a PRT. Those credentials prove the user's identity. Microsoft Entra ID issues the PRT after validating that proof and the registered device context.

Diagram that shows how macOS obtains and protects the Platform SSO PRT.

Figure 3.4. macOS sends the device-bound authentication request, protects the returned Platform SSO PRT, and shares it with the Microsoft SSO extension.

Authentication methodsObtain Kerberos TGTs

In addition to the Platform SSO PRT, Microsoft Entra ID can return Kerberos ticket-granting tickets (TGTs) in the protected Platform SSO response:

  • A cloud TGT for accessing cloud resources that use Microsoft Entra Kerberos.
  • An on-premises TGT for accessing resources in an on-premises Active Directory Domain Services environment.

The TGTs are separate from the Platform SSO PRT, even though Microsoft Entra ID returns them in the same authentication method changes how the user proves identity. It doesn't change the broader device-registration and app-SSO architecture.response.

Password

The high-level flow is:

  1. The Microsoft Enterprise SSO plug-in configures macOS Platform SSO (Apple) to request available Kerberos TGTs from Microsoft Entra passwordID.
  2. The SSO plug-in supplies macOS Platform SSO (Apple) with Kerberos ticket mappings that identify the cloud and local on-premises TGT fields in the Microsoft Entra response.
  3. macOS password are synchronized accordingPlatform SSO (Apple) sends a Platform SSO PRT request to PSSO policy. The authentication request remains bound toMicrosoft Entra ID. Based on the registered Mac. This method reduces the number of passwords the user manages, but it isn't passwordless or phishing-resistant.

    UserSecureEnclaveKey

    A hardware-bound user key is protectedconfiguration supplied by the Secure Enclave. When fresh proof is required, macOS requests a signature fromSSO plug-in, the private key and request indicates that available Kerberos TGTs should be returned alongside the PRT in the same protected response.

  4. Microsoft Entra ID verifies it with the registered public key. The private key doesncredential and validates the user and device proofs. It then returns the Platform SSO PRT and any available cloud or on-premises TGTs in the protected response.
  5. macOS Platform SSO (Apple) decrypts and validates the response.
  6. Based on the configured TGT mappings, macOS imports the selected TGTs into a Kerberos credential cache. If custom_tgt_setting  isn't leavespecified, the Mac. SSO plug-in maps both the cloud and on-premises TGTs by default. Administrators can configure it to map both TGTs, only the cloud TGT, only the on-premises TGT, or neither TGT.
  7. If the Kerberos SSO extension is configured with usePlatformSSOTGT enabled, macOS makes Platform SSO TGT available to the extension when the ticket’s realm matches the realm requested by the extension.
  8. The local account passwordKerberos SSO extension uses the matching TGT to obtain service tickets for cloud or on-premises Kerberos resources without prompting the user to authenticate again, provided that the TGT remains a separate local credential.

    Microsoft recommends the UserSecureEnclaveKey auth method for most PSSO deployments.

    SmartCard

    The user proves identity with a certificate and its associated private key. The user completes the required card and PIN interaction,valid and the smart card signs the authentication proof without exporting the private key. Microsoft Entra certificate-based authentication validates the certificate, signature, user mapping, registered device, and policy.

    Diagram that shows a comparison of Platform SSO authentication methods.

    Figure 4. Password, UserSecureEnclaveKey, and Smart Card are alternative methods for producing user authentication proof.

    resource configuration permits SSO.

Application and browser SSO

  1. Supported applications and browsers use the extension to obtain their own tokens or sessions.
  2. When policy requires new proof, macOS invokes the configured authentication method again.
  3. With UserSecureEnclaveKey, the Platform Credential can also answer supported WebAuthn passkey challenges.
  4. macOS(Apple) maintains the registration state on the machine, and may re-trigger the registration flow if needed.

Related content

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…