Microsoft has released Company Portal 5.2401.2 with support for Platform SSO.
Users with SSO profiles receive a pop-up requesting registration with Azure Account to synchronize the local Mac password.
Has anyone had this experience?
1 ACCEPTED SOLUTION
I disabled the Platform SSO setting in our Microsoft Enterprise SSO profile and this seems to have fixed the issue. When you read what the setting does, it is only related to the sign-in window.
We actually can't support Platform SSO at the sign-in window, so not sure why this was even enabled. To be honest, after testing on my own Mac SSO seems a little better system wide with this setting disabled. Doing further testing now with a new enrollment and older version of CP, then will allow CP to update to see if the issues reappears.
Microsoft really screwed alot of us with this and has been zero help so far. But that isn't a surprise. Anyway....
Here is what we have found. Anyone that incorrectly clicked to do the PSSO is probably never going to get fully straightened out just by redoing the Intune Integration registration from Self Service. If a user didn't click it and you disabled the “use Platform SSO” setting in your profile then they are probably good to go. Anyone that had already accidentally enabled it, it will stay enable no matter what the profile says. Reboots don't help.
What I found is that anyone who clicked and technically enabled PSSO there is appears that there is no way to get rid of it....but there is.
If you look at the user's System Settings>Users & Groups> {user's account} and click the i....
This is bad, it means the PSSO is enabled and Enterprise SSO is going to continue to have issues. If they show the Platform single Sign On section in their account then it is already enabled and messing with SSO.
This is good, it means that the user didn't click and didn't enable PSSO. These users probably aren't having issues or just need to register again from Self Service.
The only way I have found to get rid of the "bad" is to exclude the user's computer or some smart group from the SSO profile so it is removed from their Mac. This will disable the SSO extension and get rid of the PSSO. Wait a few minutes, then remove the exclusion so the SSO profile is installed on their Mac again which will reenable the SSO extension including not enabling PSSO since you probably/hopefully already disabled the setting. After getting the profile back on the Mac, confirm the PSSO section is removed from their account info. After this the user should be able to register again via the Self Service policy, wait a few minutes for Entra/Intune to catch up, then they should be able to sign in again, use SSO and all of their problems should be solved. No restart was need in my experience.
Hope this makes sense and helps those pulling their hair out with the mess.
I can confirm the behavior.
The only way to disable PSSO is to remove the SSOe profile completely. Disabling PSSO in the SSOe profile is not enough.
Once removed, you can deploy SSOe without PSSO
We have a different issue but very similar, we got the error attached after the 5.2401.2 update.
Think that a downgrade will work for me, but I can't find any PKG
To remove the notification, it is necessary to remove the SSOe profile completely, then deploy it again without PSSO.
it is not sufficient to remove only PSSO
Based on my testing with different environments and assistance from Jamf support, here is what I learned:
Problem
On Macs with Company Portal 5.24+ and PSSO enabled, users are prompted to register in Entra ID.
How to turn off the registration notification:
1. Remove the SSOe profile.
2. Disable PSSO in the SSO Extension profile.
3. Reinstall the SSOe profile without PSSO.
Manage device compliance registration (3 different scenarios):
1. If the end user entered his credentials in the PSSO window, he probably lost the WPJ key and needs to re-register for device compliance.
2. If the end user attempted to register before the PSSO settings were removed and the WPJ key is still present, they will need to manually delete the WPJ key, delete multiple records in Entra ID, and then register again.
3. If the end user has not attempted to re-register with PSSO, he only needs to try logging into a managed application after restarting the Mac. Perhaps he needs to re-register with device compliance.
This is not official information and may not cover all scenarios, but is just information based on my experience in these few days after the Company Portal upgrade.
