Microsoft Entra ID
AuthenticationTroubleshoot Macos Platform Single Sign On Extension
In brief
The macOS Platform SSO troubleshooting guidance now states that changing Use Shared Device Keys in an existing deployment triggers device re-registration with Microsoft Entra ID.
What Entra admins need to know
Administrators should account for device re-registration when changing this setting.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
On a Mac registered with Platform SSO, apps might show sign-in errors such as 4ut1e, -42008, or "Failed to sign the request" after you wake or unlock the device. This can happen when token requests start before macOS unlocks the user's cryptographic keys, causing token decryption or request signing to fail. These errors can also have other causes.
On macOS 14 or later, enable Use Shared Device Keys in the Platform SSO configuration to help prevent this issue. This setting makes device authentication keys available before the user unlocks the device. For configuration details, see Configure Platform SSO in Intune. Changing this setting in an existing deployment triggers device re-registration with Microsoft Entra ID.
Report an issue
Report an issue
@@ -184,7 +184,10 @@ Because Secure Enclave keys are protected by your local account password, passwo On a Mac registered with Platform SSO, apps might show sign-in errors such as `4ut1e`, `-42008`, or "Failed to sign the request" after you wake or unlock the device. This can happen when token requests start before macOS unlocks the user's cryptographic keys, causing token decryption or request signing to fail. These errors can also have other causes. -On macOS 14 or later, enable **Use Shared Device Keys** in the Platform SSO configuration to help prevent this issue. This setting makes device authentication keys available before the user unlocks the device. For configuration details, see [Configure Platform SSO in Intune](/intune/device-configuration/settings-catalog/configure-platform-sso-macos#step-2---create-the-platform-sso-policy-in-intune). Changing this setting in an existing deployment triggers device re-registration with Microsoft Entra ID.+On macOS 14 or later, enable **Use Shared Device Keys** in the Platform SSO configuration to help prevent this issue. This setting makes device authentication keys available before the user unlocks the device. For configuration details, see [Configure Platform SSO in Intune](/intune/device-configuration/settings-catalog/configure-platform-sso-macos#step-2---create-the-platform-sso-policy-in-intune).++> [!IMPORTANT]+> Changing this setting in an existing deployment triggers device re-registration with Microsoft Entra ID. ## Report an issue