AzureFeeds

By Iris Yuning Ye, Product Manager – Microsoft Intune & Justin Ploegert, Principal Product Manager – Microsoft Entra

A new setting ‘Enable Registration During Setup’ for Platform single sign-on (PSSO) during Automated Device Enrollment (ADE) is now generally available for macOS devices in Microsoft Intune. With this new setting and a compatible version of the Intune Company Portal (5.2604.0 and newer), this feature enables users sign in with their Microsoft Entra account during Setup Assistant, complete device registration before reaching the desktop, and get immediate access to work resources and ready to be productive sooner.

Why this matters

Previously, Platform SSO registration occurred only after users completed Setup Assistant and reached the desktop. They then had to notice and act on a separate notification to finish Platform SSO registration. When Platform SSO registration isn’t completed, it can cause issues with app authentication or lead to noncompliance, delaying users from getting started on the device:

• Missed notifications – Users dismiss or ignore the post-enrollment PSSO prompt, leaving devices in an incomplete device registration state.


• Broken app authentication – Apps like Microsoft Outlook could fail to authenticate because SSO isn’t fully configured.


• Compliance gaps – Devices are flagged as noncompliant in the Intune Company Portal because Platform SSO registration isn’t completed.


• Helpdesk burden – IT teams field repeated tickets for issues that should have been handled automatically during provisioning.


• Migration blocker – Incomplete Platform SSO setup slows down migrating macOS devices to Intune.

Platform SSO during ADE with EnableRegistrationDuringSetup key eliminates these issues. Device registration, identity bootstrap, and credential setup all happen inline during Setup Assistant before the user ever reaches the desktop.

What the feature enables

How it works

This feature requires three policies that work together. All three must be configured correctly before enrollment starts and assigned to the same static user groups:

1. A Platform SSO settings catalog policy with “Enable Registration During Setup” configured to Enabled.


2. Intune Company Portal (version 5.2604 or newer) deployed as a line-of-business (LOB) app, which provides the Microsoft Enterprise SSO extension.


3. An ADE enrollment profile configured with Setup Assistant with modern authentication and Await final configuration = Yes.

When a device enrolls with these three policies in place, here’s what happens:

1. The device powers on and begins the ADE enrollment flow.


2. Intune delivers the Platform SSO settings catalog policy with Enable Registration During Setup enabled.


3. Intune Company Portal is installed automatically as a LOB app, providing the Microsoft Enterprise SSO plug-in.


4. During Setup Assistant, the user signs in with their Microsoft Entra credentials. This first sign-in starts the regular enrollment process.


5. A second sign-in authenticates the identity in Intune Company Portal and fetches the SSO extension.


6. The device registers with Microsoft Entra ID, and a Microsoft Entra device registration certificate is issued.


7. The user arrives at the desktop fully authenticated, with SSO active and Conditional Access satisfied.

Note: During enrollment, users are prompted to enter their Microsoft Entra credentials at least twice. We’re working on improvements to reduce the number of sign-ins in a future update.

Prerequisites

Important: Review the full Platform SSO prerequisites in the Platform SSO configuration guide before you begin.

High level step-by-step configuration

Step 1: Create or update the Platform SSO settings catalog policy

1. In the Microsoft Intune admin center, go to Devices > Manage devices > Configuration. If this is your first time configuring Platform SSO, follow the full Platform SSO configuration guide.


2. Add and configure the following setting:
   
   

   Setting	Value	Description
   Authentication > Extensible Single Sign On > Platform SSO > Enable Registration During Setup	Enabled	Enables the Platform SSO registration process during Setup Assistant.

   
   
    
   
   


3. 
   
   If using the Password authentication method, it’s recommended to add for password sync function:
   

   Setting	Value	Description
   Authentication > Extensible Single Sign On > Platform SSO > Enable Create First User During Setup	Enabled	Enables the password synchronization experience during Setup Assistant. Only configure this if using the Password authentication method.

   
   

Tip: Microsoft recommends using Secure Enclave as the authentication method for the strongest hardware-backed security. Enable Create First User During Setup setting will be available soon in settings catalog.

Assign the policy to your static user groups. Filter is also supported with correct static group setting.

Step 2: Install Intune Company Portal as a LOB app

1. Download the Company Portal for macOS PKG from https://go.microsoft.com/fwlink/?linkid=853070.


2. In the Intune admin center, go to Apps > All Apps > Create.


3. Add Intune Company Portal as a macOS LOB app.


4. Make it a required app and assign it to the same groups as the Platform SSO policy from Step 1.

Important: Company Portal 5.2604.0 and newer is required. If you install an older version, Platform SSO fails. When Intune detects Company Portal as a deployed policy, it sends it with priority during enrollment.

And clean up the App bundle ID that are not related to Company Portal, make sure only com.microsoft.CompanyPortalMac as the relevant App bundle ID is kept.

Step 3: Set up the enrollment profile

1. In the Intune admin center, go to Devices > Device onboarding > Enrollment > Apple tab.


2. Create or edit an Automated Device Enrollment profile with these Management settings:
   
   

   Setting	Value
   User affinity	Enroll with User Affinity
   Authentication	Setup Assistant with modern authentication
   Await final configuration	Yes
   Locked enrollment	Yes

   
   


3. Assign the profile to the same groups as Steps 1 and 2.

Critical: You must assign all three policies to the same static user groups. If any policy is assigned to a different group, or if any step is misconfigured, enrollment will fail. In that case, wipe the device and re-enroll with all steps correctly configured.

Key things to remember

• ✅ Three policies, one group: Settings catalog, Company Portal LOB app, and ADE enrollment profile, all assigned to the same static user groups.


• ✅ Static groups only: This feature does not work with device groups or dynamic groups.


• ✅ One SSO policy per device: If you already have a Platform SSO policy assigned to enrolled devices, make sure device is wiped appropriately before kicking of enrollment with new PSSO flow.


• ✅ Latest Intune Company Portal: Version 5.2604.0 or newer is required.


• ✅ macOS 26 required: This feature is supported on macOS 26 and newer.


• ✅ Secure Enclave recommended: For the strongest hardware-backed credential protection.

For more details, refer to Configure Platform Single Sign-On (PSSO) during Automated Device Enrollment for macOS devices.

Looking ahead: Reducing Platform SSO sign-in prompts

Signing in multiple times during enrollment isn’t the ideal experience, and we’re actively working to streamline it with a new enrollment setting that enables users to complete both Intune enrollment and Platform SSO device registration with a single sign-in. This will further simplify the onboarding experience, reduce friction for users, and bring macOS enrollment closer to a truly seamless, zero-touch provisioning flow. Stay tuned to What’s new in Intune for the release.

Related resources

• SSO in ADE profile (new article): Add Platform SSO policy to ADE Profile on macOS devices – Microsoft Intune | Microsoft Learn


• SSO scenarios: Platform SSO scenarios for macOS devices – Microsoft Intune | Microsoft Learn


• Platform SSO configuration guide for macOS devices using Microsoft Intune


• Common Platform SSO scenarios for macOS devices


• Install Company Portal for macOS as a macOS LOB app


• Set up automated device enrollment (ADE)


• Troubleshoot the Microsoft Enterprise SSO Extension plugin on Apple devices


• macOS Platform single sign-on known issues and troubleshooting

As always, we’d love your feedback. If you’ve piloted Platform SSO during Setup Assistant, share your tips and lessons learned in the comments below or reach out to us on X @IntuneSuppTeam.