macOS Intune Platform SSO Deployment

Production-validated implementation guide for deploying macOS Platform SSO using Microsoft Intune, Microsoft Entra ID, and Microsoft Company Portal.

Overview

This repository documents a tested deployment of:

• macOS Platform SSO
• Microsoft Company Portal SSO extension
• Intune macOS login window policy
• Apple MDM Push certificate integration

The configuration was reproduced successfully in a controlled validation environment after being modeled from a live enterprise deployment.

Repository Contents

• docs/implementation-guide.md
• docs/troubleshooting.md

Key Components

• Platform SSO configuration profile assigned to users and devices
• macOS Login Window policy
• Apple MDM Push Certificate active in Intune
• Company Portal installed and signed in

Requirements

• User must have M365 license that include Intune
• Microsoft Intune tenant
• Microsoft Entra ID users
• Apple MDM Push Certificate
• Company Portal for macOS
• macOS supported version for Platform SSO

Architecture

+---------------------------+
| Microsoft Intune          |
|                           |
|  - Apple MDM Push Cert    |
|  - macOS Login Policy     |
|  - Platform SSO Policy    |
+------------+--------------+
             |
             | APNs / MDM communication
             v
+---------------------------+
| macOS VM                  |
|                           |
|  - Company Portal         |
|  - Management Profile     |
|  - Platform SSO Extension |
|  - Local user session     |
+------------+--------------+
             |
             | Authentication
             v
+---------------------------+
| Microsoft Entra ID        |
|                           |
|  - User identity          |
|  - Token mapping          |
|  - SSO flow               |
+---------------------------+

Prerequisites

• A Microsoft Intune enabled tenant
• Microsoft Entra ID user accounts for testing
• Apple ID dedicated to APNs certificate management
• Active Apple MDM Push Certificate in Intune
• macOS VM or physical test Mac
• Company Portal installed on macOS device
• Test user and test device groups in Entra ID

Apple MDM Push Certificate

Apple device management in Intune requires an Apple MDM Push Certificate. Without it, Apple devices can appear enrolled incorrectly or fail to receive policies.

Best practice:

• Use a dedicated Apple ID for the APNs certificate
• Track the renewal date carefully
• Renew with the same Apple ID every year

Platform SSO assignment model

Platform SSO requires user context. In this lab, the final working configuration used:

• User group assignment for user contextual policy processing
• Device group assignment for device targeting consistency in the lab

During testing, device only assignment caused policy application issues. Adding the appropriate user assignment was required for successful Platform SSO deployment.

Company Portal dependency

Platform SSO depends on the Microsoft Company Portal SSO extension:

• Team Identifier: UBF8T346G9
• Extension Identifier: com.microsoft.CompanyPortalMac.ssoextension

The Company Portal application must be installed and the user must sign in on the device.

Results

Validated successful deployment on multiple macOS endpoints with:

• Successful policy check-in
• Platform SSO profile applied
• Login policy applied
• User sign-in integration functioning correctly