🔐 macOS + Intune + Entra ID: Seamless Login with Platform SSO and Password Sync (Yes, Even FileVault!)

Modern IT environments are ditching legacy directories and embracing cloud identity — but MacBooks have always been tricky when it comes to syncing logins with Entra ID (formerly Azure AD). That ends now.

With Platform SSO for macOS and Password Sync, you can:

• Let users sign into their Mac with their Entra ID password
• Automatically keep the password in sync
• And yes — even unlock FileVault at boot using their cloud credentials

This blog walks you through the step-by-step configuration using Microsoft Intune, Apple Business Manager (ABM), and Automated Device Enrollment (ADE).

---

✅ Prerequisites

Before diving in, make sure the environment is set up properly:

• Apple Business Manager (ABM) integrated with Intune
• Devices enrolled using Automated Device Enrollment (ADE)
• Intune configured and licensed (Microsoft 365 Business Premium, E3, or E5)
• Devices are macOS 13+ (macOS 14+ recommended)
• FileVault enabled via Intune policy
• Users have cloud-only or hybrid Entra ID accounts

---

🔧 What You’re Deploying

With Password Sync mode, Platform SSO:

• Syncs the Entra ID password to the local macOS user
• Allows login and FileVault unlock using the Entra ID password
• Keeps local and cloud passwords in sync
• Enables SSO into Microsoft 365 apps and web resources

---

🛠️ Step-by-Step Setup in Intune

Step 1: Create the Platform SSO Configuration Profile

1. Go to Intune Admin Center → Devices → macOS → Configuration profiles
2. Click Create profile
   • Platform: macOS
   • Profile type: Settings catalog
3. Name it something like macOS - Platform SSO (Password Sync)

Step 2: Configure Platform SSO Settings

1. In the Settings Catalog, click Add Settings
2. Search for and add the following:
   • Platform Single Sign-On
     • Enable Platform SSO: Enabled
     • Use Platform SSO: Enabled
     • Enable Password Sync: Enabled
     • Identity Provider Domain Hint: yourdomain.com
     • OIDC App Redirect URI: (optional — leave blank or use msauth.yourdomain.com://auth if using Microsoft apps with deep linking)

🎯 Important: Make sure you do not enable “Enable Secure Enclave” — that is a separate auth method and behaves differently.

Step 3: Assign the Profile

• Target a dynamic group that contains only ADE-enrolled macOS devices
• Make sure devices are supervised and deployed via ABM (not manually enrolled)

---

🔒 Step 4: Enable FileVault (via Intune)

To ensure FileVault integrates properly with Platform SSO:

1. In Intune, go to Endpoint security → Disk encryption
2. Create a macOS FileVault policy
3. Set:
   • FileVault: Enable
   • Recovery key: Store in Intune
   • Escrow location: Intune
4. Assign it to the same ADE-enrolled device group

---

🧪 Step 5: Test the Experience

Here’s what the user sees:

1. Mac boots → FileVault unlock screen appears
2. User enters Entra ID password → Unlocks FileVault
3. Login proceeds to macOS
4. No password mismatch issues, even after changing Entra ID password online
5. Microsoft apps (Outlook, OneDrive, Teams, etc.) auto-authenticate using SSO

---

🚨 Things to Watch Out For

• Manually enrolled Macs won’t work — must be ABM + ADE enrolled
• If FileVault is enabled before Platform SSO is configured, you may need to re-enroll or reissue FileVault keys
• Offline password changes won’t sync — users need to be online for sync to occur
• Make sure you don’t mix Secure Enclave and Password Sync configs in your fleet

---

🤔 Why Not Use Secure Enclave?

Secure Enclave mode is great for newer Macs and token-based login — but:

• It doesn’t sync passwords
• FileVault unlock relies on cached tokens, not Entra passwords
• It’s less intuitive for users who expect password changes to apply everywhere

Password Sync is ideal if:

• You want Entra ID as the true source of password
• You want users to have a consistent login experience
• You want compatibility with FileVault unlock using cloud credentials

---

🧩 Wrap-Up

Platform SSO with Password Sync is a game changer for macOS in Microsoft 365 environments. It gives users a consistent, secure, and seamless login experience — and gives IT a reliable, native solution without third-party tools or local directory hacks.

And yes — you can finally unlock FileVault with an Entra ID password.