macOS Foundation – Platform SSO (Password)

Overview

This configuration enables Platform SSO with Microsoft Entra ID, using the user's Entra ID password as the method for authentication.  
- Replaces the local account password with the Microsoft Entra ID password, and ensures that the two passwords are kept in sync
- Enables SSO to be used for authentication across all supported apps and websites.

Note: An alternate Platform SSO configuration is available, that uses the Secure Enclave authentication method. The Secure Enclave method will leave the local account password as-is, and instead uses hardware-bound cryptographic keys to authenticate with Microsoft Entra ID. This configuration is suggested for organisations pursuing password-less authentication for their users.
🔎 For further information about Platform SSO with Secure Enclave, check out macOS Foundation - Platform SSO using Secure Enclave Authentication

User Experience

Shortly after first login, users will be prompted to register with Platform SSO.
To register, they must sign in with Microsoft Entra ID and complete multi-factor authentication (MFA), if required.
They are then asked to authenticate with their local computer password. This will update the computer password to be the same as their Entra ID password, and finalise registration.

On completion all SSO enabled browsers and apps will automatically authenticate the user into Entra ID. This applies to all Microsoft and Apple applications, and any third-party applications that support SSO.
Both Google Chrome and Firefox need to have SSO enabled via configuration policy, which is covered in Devicie's standard policy offering for both apps.

Pre-requisites 

Users cannot have per-user MFA enabled. Use Conditional Access MFA instead.
🔎 More information available here: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/recommendation-turn-off-per-user-mfa  

Only available for Microsoft Entra join deployments. Hybrid-join unsupported.

Troubleshooting Notes

Ensure that if you configure any password complexity requirements to your Mac that it matches your Entra ID password requirements.

Ensure that users have the permission to both join and register devices to Entra ID.
From your Microsoft Entra admin centre, under Microsoft Entra ID join and registration settings, ensure that the All option is selected in the toggle menu for Users may join devices to Microsoft Entra

If a user's password is reset by an IT admin they must use another device to log in and set up their new password. Logging in with a temporary password is not supported.