Platform SSO Registration during ADE on macOS

Microsoft has made Platform SSO registration during Automated Device Enrollment generally available for macOS. Until now, PSSO registration happened only after the user reached the desktop, triggered by a notification that users routinely ignored. The result was a fleet stuck in incomplete PSSO state.

Why this matters

When PSSO does not register, the usual chain of pain follows. Outlook fails to authenticate, devices show as non compliant in Company Portal, and the helpdesk burns hours on tickets that should never exist. For tenants in the middle of Jamf to Intune migrations, this was a real blocker.

Pulling registration into Setup Assistant means device identity, Workplace Join certificate, and Secure Enclave credentials are all in place before the user reaches the desktop. Conditional Access is satisfied from the first sign in.

When to use it

Enable it for every new ADE deployment targeting macOS 26 or newer. It is especially useful for new hire onboarding and environments where end users dismiss prompts. Assign the settings catalog policy, Company Portal LOB app (5.2604.0 or newer), and the ADE enrollment profile to the same static user groups.

When NOT to use it

Skip it if your estate still runs macOS 15 or older, or if you rely on dynamic groups or device groups for assignment. Both are unsupported. Do not enable it on devices that already have a PSSO policy assigned. You must wipe first, otherwise enrollment fails.

Also note: users still sign in at least twice during enrollment. Microsoft has flagged a fix, but for now manage expectations and document the flow for your service desk.

Recommendation

Turn it on. The operational gains far outweigh the small friction of multiple sign in prompts during setup. Pair it with Secure Enclave as the authentication method for the strongest credential protection. If you still run a macOS 15 estate, plan the upgrade now so you can adopt this properly rather than retrofitting later.

References

🔗 Microsft Learn: Configure Platform SSO for macOS devices in Microsoft Intune 🔗 Somesh: Deep Dive & How to

Platform SSO that registers before the desktop loads is how macOS enrollment should have worked from day one. 😉