Troubleshooting PSSO Issues

This FAQ addresses common troubleshooting questions related to the PSSO. The issues may have various causes and solutions.

1. How to confirm if the Platform Single Sign-On is enabled on the device?

   On the device terminal, run the following command: app-sso platform -s

   • If the configuration details are missing, then Platform SSO (PSSO) has not been configured.
   • If any of the values are null, the end user will still be prompted to register again via a notification from macOS.

2. Why is Platform SSO Profile not getting deployed on the device?

The most common reasons could be:

1. An earlier SSO Extension profile might still exist on the device.
2. URLs may have been entered incorrectly or may contain unwanted characters.

To identify the issue in UEM, navigate to Devices > [Impacted device] > More > Troubleshooting.

• Check the logs related to the PSSO profile.
• Common / expected issues:
  • An earlier SSO Extension profile might still exist on the device.
  • URLs may have been entered incorrectly or contain unwanted characters.

3. What happens if the user changes their Entra password?

If the Microsoft Entra ID password is updated via self-service password reset (SSPR), the updated password needs to be synced with the macOS password (local). If a user changes their Entra ID password after it has already been synchronized with macOS password, the OS will prompt them to provide the new password within 4 hours.

4. What happens if the user dismisses the notification to register for Platform SSO with Entra?

If the user closes the SSO authentication prompt and cancels or dismisses registration, they will be prompted with the registration notification when they sign back in to their device after a sign-out.

They can also trigger registration by going to the macOS Intelligent Hub. Select Support > Device > Profiles > PSSO Profile (or the name configured by the admin) > Install.

5. Why does the user see Unexpected / Frequent Re-Registration Prompts on macOS Sequoia?

On macOS 15+ (Sequoia), there is a concurrency defect that may corrupt the Platform SSO (PSSO) device configuration.

• The issue is triggered when AppSSOAgent and AppSSODaemon perform simultaneous configuration updates.
• Once corrupted, the system invokes its re-registration remediation process, which causes users to be prompted to re-register unexpectedly.
• Apple is actively investigating this problem.

Example error:

Error Domain=com.apple.PlatformSSO Code=-1001 "Error deserializing device config." UserInfo={NSLocalizedDescription=Error deserializing device config., NSUnderlyingError=0x9480343f0 {Error Domain=NSCocoaErrorDomain Code=3840 "Garbage at end around line 27, column 1." UserInfo={NSDebugDescription=Garbage at end around line 27, column 1., NSJSONSerializationErrorIndex=3052}}}

6. How can a device user re-register for PSSO from the device?

To manually repair or re-trigger PSSO registration from macOS:

1. Go to System Settings > Users & Groups > Network Account Server.
2. Select Edit > Repair.

Users will be presented with the same prompt used during initial registration.

7. What URL's need to be whitelisted to make sure PSSO registration and device authentication flows to complete successfully?

Ensure the following URLs are reachable (e.g., allowed through firewall/proxy) so that PSSO and Conditional Access flows function correctly:

• app-site-association.cdn-apple.com

• app-site-association.networking.apple

• login.microsoftonline.com

• login.microsoft.com

• sts.windows.net

• login.partner.microsoftonline.cn(*)

• login.chinacloudapi.cn(*)

• login.microsoftonline.us(*)

• login-us.microsoftonline.com(*)

• config.edge.skype.com(**)

  (*) Region-specific Microsoft cloud endpoints
  (**) Required by some Microsoft services and configuration flows

8. Once the device is enabled for Conditional Access policy enforcement, how does the admin verify the device for compliance?

   Once the device is registered:

   1. In UEM, go to More > Conditional Access logs and verify that the device is shown as compliant.
   2. In Microsoft Entra, verify that the device is reported as compliant.

   From the UEM Device Details page:

   • On the Device Info tab, verify that the Azure Device ID matches the ID shown in Entra.
   • On the Security tab, verify that Azure Device Directory Registration shows as ✅.

9. Administrator wants to move from ICP-based device registration to registering with AAD tool and vice versa. How can they do that?

   Device registration methods—whether using Intune Company Portal (ICP) or the AAD tool—are controlled by feature flags. To enable ICP-based registration, set MacOSConditionalAccessUsingCompanyPortalFeatureFlag to True using Custom Profiles. To use the AAD tool for registration, set this flag to False. For more details, see Enable Feature Flag for Device Registration and Compliance with Entra ID via Intune Company Portal.