KBY Technologies Logo
runbooks/macos-ios-mdm/platform-sso-configuration-failure-local-account-sync.md
HIGH SEVERITYmacOS & iOS MDMmacOS

Platform SSO Configuration Failure: Local Account Sync

Severity
HIGH
Target Time
45m
DomainmacOS & iOS MDM
Verified
Overview

Diagnose and repair Microsoft Entra Platform SSO on macOS when incorrect registration or conflicting SSO extension payloads leave the local account password out of sync.

Share

Destructive Operation

This intervention contains destructive operations. Proceed with extreme caution and ensure database backups exist before execution.

01 // Diagnose

Symptom

Incident signalWhat responders observe

A macOS device enrolled for Microsoft Entra Platform SSO shows the local account password out of sync with the Microsoft Entra password, or users cannot rely on expected local password synchronisation. This commonly appears when Platform SSO registration is incomplete, the configured authentication method does not synchronise the local password in the same way, or another SSO extension conflicts with the intended domain handling.

Detection Signature

Detection evidenceMetrics, logs, and confirmation commands

  1. Confirm the exact symptom with the user: whether the issue is local unlock failure, password mismatch after a Microsoft Entra password change, missing registration prompts, or app SSO failure.

  2. Capture macOS version with a read-only command: sw_vers

  3. Capture the Company Portal version with a read-only command: mdls -name kMDItemVersion /Applications/Company\ Portal.app

  4. Record the configured authentication method from the applied management configuration by inspecting the relevant Intune Settings Catalog policy in the management console.

  5. Inspect Platform SSO registration state using the supported macOS user interface in System Settings, where users and administrators can inspect or repair registration on supported macOS versions.

  6. Confirm that Intune enrolment and Microsoft Entra join completed successfully before diagnosing password sync as a Platform SSO fault.

  7. Inspect applied Extensible SSO profiles and identify extension and team identifiers using a read-only command: profiles show

  8. Determine whether more than one SSO extension payload is present for the same domain. Record any duplicate or overlapping Extensible SSO payloads.

  9. If a Kerberos SSO extension is present alongside Platform SSO, verify whether its syncLocalPassword setting is false in the deployed configuration.

  10. Record FileVault state with a read-only command: fdesetup status

  11. Record the exact local-versus-Entra password symptom, including whether app sign-in works, whether local unlock works, and whether the issue occurs before or after sign-out, sign-in or reboot.

  12. If registration was missed, note whether the device has already been signed out and back in since enrolment or profile changes.

Root Cause Analysis

Causal chainWhy the incident occurred

  1. Platform SSO requires a compatible extension, supported device management configuration, and both device and user registration.

  2. Password authentication synchronises the Microsoft Entra password with the local account password, but Secure Enclave and Smart Card authentication do not synchronise the local account password in the same way.

  3. A device may therefore appear misconfigured when it is actually using a method with different local password behaviour.

  4. A true fault commonly occurs when registration is incomplete or when multiple SSO extension payloads exist for the same domain, which can produce error 10002.

  5. Another conflict condition exists if Kerberos SSO is combined with Platform SSO and syncLocalPassword is not false.

02 // Contain & Prevent

Blast Radius

  • Affected user cannot rely on expected local password synchronisation on the impacted Mac.

  • Platform SSO registration-dependent sign-in flows may fail or remain incomplete.

  • App SSO may be degraded on the impacted device.

  • If profile conflicts are broadly deployed, multiple managed Macs using the same domain may be affected.

Prevention Measures

Prevent recurrenceControls and architectural guardrails

  • Deploy only the intended Extensible SSO Settings Catalog profile for the target domain, validate that duplicate SSO extension payloads are removed after testing, ensure enrolment and Microsoft Entra join complete before expecting Platform SSO registration, and document the expected local password behaviour for the chosen authentication method.

  • Use the supported registration inspection and repair controls in System Settings on supported macOS versions.

03 // Fix & Intervention

Pre-Flight Checks

Change gateChecks required before intervention

  1. Start with read-only validation only.

  2. Confirm the configured authentication method because only password authentication is stated to synchronise the Microsoft Entra password with the local account password.

  3. Confirm the device is enrolled in Intune and joined to Microsoft Entra before attempting repair.

  4. Inspect System Settings for Platform SSO registration state and availability of the supported repair control.

  5. Inspect applied profiles with: profiles show

  6. Identify whether multiple Extensible SSO payloads target the same domain and whether a Kerberos SSO extension is also present.

  7. Record current FileVault state with: fdesetup status

  8. Ensure an approved recovery administrator path is available before any change that could affect sign-in behaviour.

  9. Stop and escalate if the issue is only an expectation mismatch caused by Secure Enclave or Smart Card authentication, because local password behaviour may be by design.

  10. Do not reset the user's password, remove FileVault credentials, delete the local account, or remove Company Portal automatically.

  11. Before any Intune profile reassignment, confirm the operator is in the correct tenant and has Device Configuration Read, Create, Update and Assign permissions for the exact Platform SSO profile and pilot group recorded in the approved change.

  12. Capture the current assignments and have a second authorised reviewer compare the proposed diff; otherwise stop and escalate.

  13. Before any broad assignment change, stage the proposed profile only to an isolated non-production test device or pilot group containing no production users.

  14. Verify registration, sign-in, SSO and FileVault recovery state in that ring, and stop if any regression appears. Broad rollout is outside this runbook and requires its owning approved change procedure.

Execution CommandsCOMMANDS

grep -R -i "PlatformSSO" /Library/Managed\ Preferences 2>/dev/null
Stop condition for all state-changing actions: stop immediately if registration becomes healthy in System Settings, if the duplicate SSO payload is no longer present, or if sign-in behaviour worsens and the approved recovery administrator path is at risk.

1. If registration is incomplete or missed, use the supported registration repair control in System Settings on the affected Mac.
Rollback: if repair worsens sign-in state or does not complete, stop further local changes and revert to the prior managed configuration state only through the management console review path; then escalate.

2. If the registration prompt was missed, perform the supported user session retry by signing out and signing back in on the affected Mac.
Rollback: if sign-in fails or the user cannot continue safely, use the approved recovery administrator path and stop further changes.

3. If multiple SSO extension payloads are present for the same domain, reduce the configuration to the intended Settings Catalog profile after validation in the management console.
Rollback: reassign the previously active profile set in the management console if removal of the duplicate payload causes broader SSO regression, then stop and escalate.

4. If a Kerberos SSO extension is intentionally combined with Platform SSO, correct the managed configuration so that Kerberos SSO syncLocalPassword is false.
Rollback: restore the previous Kerberos SSO configuration in the management console if the change causes unexpected authentication regression, then stop and escalate.

5. After any profile correction, allow the device to receive the intended configuration, then re-check registration state in System Settings.
Rollback: if the intended configuration does not arrive or registration remains broken, do not apply unsupported local removals; stop and escalate.

Read-only support commands during intervention: sw_vers ; mdls -name kMDItemVersion /Applications/Company\ Portal.app ; profiles show ; fdesetup status

For a missed or incomplete registration, use the documented path System Settings > Users & Groups > Network Account Server > Edit > Repair. Before any Intune profile reassignment, verify the required Device Configuration permissions, correct tenant, exact profile and pilot group, and obtain second-reviewer approval of the captured assignment diff.

04 // Verify & Recover

Verification Steps

Recovery proofEvidence required before closure

  1. Confirm Platform SSO registration is healthy in System Settings.

  2. Confirm registration status before treating password sync as operational.

  3. Validate token acquisition by confirming the user can complete the expected Microsoft sign-in flow for managed access.

  4. Verify local unlock behaviour is appropriate to the configured authentication method:

  • For password authentication, confirm the local account password now matches the Microsoft Entra password as expected.

  • For Secure Enclave or Smart Card authentication, confirm stakeholders understand that local account password synchronisation does not occur in the same way.

  1. Verify app SSO works for the intended Microsoft-connected workflow.

  2. Perform a post-reboot test and confirm the user can still access the Mac through the approved path.

  3. Re-check FileVault state with: fdesetup status

Rollback Protocol

Safe reversal path

  1. If recovery validation fails after profile correction, restore the previous managed profile assignment in the management console, retain Company Portal, preserve FileVault credentials and the local account, and use the approved recovery administrator path for access while escalating.

  2. If the only remaining issue is a mismatch between expected and actual behaviour for Secure Enclave or Smart Card authentication, roll back no further local changes and update the implementation decision instead.

Escalation

Conditions requiring additional ownership

  • Escalate if the device is not properly enrolled or joined.

  • If System Settings does not offer supported registration inspection or repair on the current macOS version.

  • If duplicate SSO payloads cannot be safely identified.

  • If correcting the intended profile does not clear the conflict.

  • If sign-in or local access degrades after any change.

  • If FileVault access could be jeopardised.

  • Or if the configured authentication method and the desired local password behaviour are incompatible by design.

Authoritative Sources

Authoritative · Apple

Platform Single Sign-on for macOS

Platform SSO requires a compatible extension, supported device management configuration and device and user registration. Only one SSO extension can handle a specific domain, and Kerberos SSO syncLocalPassword must be false when combined with Platform SSO. Users and administrators can inspect or repair registration in System Settings on supported macOS versions.

Authoritative · Microsoft

Configure Platform SSO for macOS devices

Password authentication synchronises the Microsoft Entra password with the local account password. Secure Enclave and Smart Card authentication do not synchronise the local account password in the same way. Multiple SSO extension payloads cause error 10002 and should be reduced to the intended Settings Catalog profile after validation.

Authoritative · Microsoft

Join a Mac with Microsoft Entra ID using Company Portal

Platform SSO registration follows successful Intune enrollment and Microsoft Entra join. A missed registration prompt can be retriggered by waiting, signing out and back in, or using the supported registration repair control. Registration status must be confirmed before treating password sync as operational.

Related Runbooks

HIGH30m

APNs Regional Outage: Fleet Check-In Failure

Suspected Apple Push Notification service disruption delays MDM wake notifications, preventing parts of the fleet from checking in until Apple service or affected network paths recover.

MEDIUM45m

Intune Company Portal Enrollment Loop on iOS 17

Draft runbook for an iOS 17 Microsoft Intune Company Portal enrollment loop where the device repeatedly returns to Company Portal before completing management profile installation.

Platform SSO Configuration Failure: Local Account Sync - Incident Runbook | KBY Technologies