← Field Notes
Platform SSO · Deep dive

Platform SSO can be passwordless. It can also satisfy MFA.

R Rob Flanagan · · 3 min read

Platform SSO is a set of choices, not one passwordless-MFA switch. The method changes the credential, the policy surface, and the recovery path.

Platform SSO can be passwordless. It can also satisfy MFA. Neither result is automatic.

Apple's framework supports several authentication methods, and the identity-provider extension decides which ones it implements. The method changes the credential, the local-password behavior, and which policies are available.

I have deployed Jamf Connect at the login window, including OIDC account mapping, password sync, FileVault escrow, and Require Network Authentication. That work is why I separate app SSO, FileVault unlock, the Lock Screen, and the login window during design and testing.

Passwordless app sign-in does not remove the local password

Microsoft calls its Secure Enclave method passwordless and says it meets phishing-resistant MFA requirements. Okta also describes its Secure Enclave flow as passwordless after the user signs in to macOS.

The local password does not disappear. Apple says macOS requires it by default at FileVault unlock, the Lock Screen, and the login window. Microsoft says users must enter it after a reboot before Touch ID becomes available.

The Password method behaves differently. It synchronizes the identity-provider password with the local account. It is also the only method Apple marks as compatible with login policies, and those policies need macOS 15 or later.

Login policy and recovery

With Require Authentication, an online Mac must reach the identity provider even when an offline grace period is configured. A registered Platform SSO user on an offline Mac cannot use the local password unless the offline grace period is configured and still valid. The Lock Screen is the one surface where Apple can allow Touch ID or an Apple Watch instead.

Apple lets administrators configure the policy separately for FileVault unlock on Apple silicon, the Lock Screen, and the login window. Test all three. The local-account grace period is temporary and starts when the policy applies or updates, so exempt a break-glass account from the policy rather than leaning on that window. Have the documented recovery path ready before enforcement.

FileVaultPolicy applies at FileVault unlock on a Mac with Apple silicon, UnlockPolicy at the Lock Screen, and LoginPolicy at the login window. All three arrived in macOS 15 and apply only when the authentication method is Password. RequireAuthentication is a value for each surface, not a global switch.

Only UnlockPolicy accepts AllowTouchIDOrWatchForUnlock, which lets Touch ID or an Apple Watch unlock the screen saver instead of Platform SSO authentication while RequireAuthentication is enabled. FileVaultPolicy and LoginPolicy have no equivalent, so the Lock Screen can behave differently under the same policy value.

AllowOfflineGracePeriod and OfflineGracePeriod cover a registered user who is offline. AllowAuthenticationGracePeriod and AuthenticationGracePeriod temporarily preserve access for unregistered local accounts, and that clock starts when a policy is applied or updated. For an account that has to keep working after the window closes, list it in NonPlatformSSOAccounts, which exempts it from all three policies and stops the registration prompt.

Apple documents a Personal Recovery Key path and security platformsso bypass-login-policy in recoveryOS. The bypass lasts for 12 hours or until the next successful identity-provider authentication.

macOS 27 features were preview material

Apple's macOS 27 material adds web-based multi-factor flows, a required Touch ID factor, and captive-portal access at FileVault unlock, the Lock Screen, and the login window. Apple labels features on the page as pre-release. Treat them as a preview until the shipping release and your identity provider support them.

For the device-management context behind these settings, start with what macOS 27 moved to declarative management. The PPPC transition is a useful contrast: both features change a management workflow, but their user and device scopes are different.

Start with the method, then prove app sign-in, FileVault unlock, the Lock Screen, the login window, and recovery on real hardware.

Which method are you testing: Secure Enclave, password synchronization, smart card, or web-based authentication?

Sources

Sources were revalidated on 2026-07-29 from the original verified publication package:

← Back to Field Notes