Skip to main content
This article covers Macs where Mac login with Primo is deployed and the registration or the sign-in fails. For a forgotten Mac password, see Unblock lost passwords.

​
Identify common causes

  • A page blocked by the Mac’s profile — the sign-in window shows Sign-in site not allowed. The Mac runs an older profile than the current sign-in page needs, usually until the control is saved again.
  • A Mac password rule stricter than the Primo password — the sign-in fails right after the employee enters their Primo password, because macOS refuses to make it the Mac password.
  • A registration that does not complete — the Mac shows Registration failed and will automatically retry and keeps asking the employee to register.
  • A login method the control does not offer — the employee does not see Google or Microsoft on the sign-in page.

​
Verify the situation

1

Check the control in the cockpit

Open the Mac login with Primo control. Check its Login methods, and check that the Mac is in its targeting and runs macOS 27 or later.
2

Check the registration on the Mac

On the Mac, open Terminal and run:
A registered account shows the state POUserStateNormal. POUserStateNeedsRegistration means the registration has not completed.
3

List the blocked pages

For Sign-in site not allowed, list the pages the Mac blocked:
Each blocked page appears as Navigation blocked: host=… url=….
4

Read the sign-in log

For a failed sign-in, read the Mac’s sign-in log:
Password does not meet local policy confirms a Mac password rule stricter than the Primo password.
Type /usr/bin/log, not log: in the default macOS shell, log is a different, built-in command.

​
Resolve the issue

Choose the option that matches the cause.

​
Option 1 — Save the control again

For Sign-in site not allowed and for a missing login method. Requirements:
  • The Mac is online and enrolled.
1

Open the Mac login with Primo control

2

Check the login methods, then click Save

Check the Login methods, then click Save. Each save pushes an updated profile to the targeted Macs.
3

Ask the employee to sign in again

Wait until the Mac has the new profile first.
If the Mac still blocks a page, contact support with the Navigation blocked line.

​
Option 2 — Align the Mac password rules

For a sign-in that fails with Password does not meet local policy. Requirements:
  • You can edit the controls that target the Mac.
1

Find the stricter password rule

Find the password rule that is stricter than the Primo password rules (at least 8 characters, upper and lower case, a number and a special character). The macOS Password and screenlock controls already follow these rules; look for a password policy in a Custom file or in another profile.
2

Remove or relax the rule

Remove that rule from the Mac, or make it no stricter than the Primo password rules.
3

Ask the employee to sign in again

The employee can also change their Primo password to one that meets the Mac’s rules, then sign in again.

​
Option 3 — Reset the registration

For a registration that keeps failing. Requirements:
  • The Mac is online and enrolled.
  • The employee can unlock the Mac with their Mac password.
1

Remove the Mac from the control's targeting

For example, take it out of the targeted device group.
2

Wait for the profile to be removed

Wait until the Mac has checked in and the profile is removed.
3

Add the Mac back to the targeting

The Mac receives the profile again and asks the employee to register.
Do not rely on the Repair button in System Settings > Users & Groups: on macOS 27.0, it does not recover a registration once the Mac password has been synced.

​
Prevent future incidents

  • Keep a local administrator account on every Mac the control covers, with Admin management. It still opens the Mac when a Primo sign-in fails.
  • Do not push a password rule stricter than the Primo password rules to these Macs.
  • Roll the control out to a device group first, then widen the targeting.

​
What if the Mac is offline?

The employee unlocks the Mac with their Mac password during the Offline grace period set on the control, counted from their last successful Primo sign-in. They sign in with Primo again once the Mac is back online.

​
Contact

If none of the options above works, contact support@getprimo.com with:
  • The Mac’s serial number and macOS version
  • The time of the failed registration or sign-in
  • The output of app-sso platform -s
  • The Navigation blocked line, if the Mac shows Sign-in site not allowed