> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Resolve Mac login with Primo issues

> Fix a failed Mac login with Primo registration or sign-in by reading the Mac's message, checking its registration in Terminal, and applying the matching fix.

This article covers Macs where [Mac login with Primo](/mdm/policies/mac-login-primo) is deployed and the registration or the sign-in fails. For a forgotten Mac password, see [Unblock lost passwords](/guides/device-management/resolve-login-issue).

## Identify common causes

* **A page blocked by the Mac's profile** — the sign-in window shows **Sign-in site not allowed**. The Mac runs an older profile than the current sign-in page needs, usually until the control is saved again.
* **A Mac password rule stricter than the Primo password** — the sign-in fails right after the employee enters their Primo password, because macOS refuses to make it the Mac password.
* **A registration that does not complete** — the Mac shows **Registration failed and will automatically retry** and keeps asking the employee to register.
* **A login method the control does not offer** — the employee does not see **Google** or **Microsoft** on the sign-in page.

## Verify the situation

<Steps>
  <Step title="Check the control in the cockpit">
    Open the Mac login with Primo control. Check its **Login methods**, and check that the Mac is in its targeting and runs macOS 27 or later.
  </Step>

  <Step title="Check the registration on the Mac">
    On the Mac, open **Terminal** and run:

    ```sh theme={null}
    app-sso platform -s
    ```

    A registered account shows the state `POUserStateNormal`. `POUserStateNeedsRegistration` means the registration has not completed.
  </Step>

  <Step title="List the blocked pages">
    For **Sign-in site not allowed**, list the pages the Mac blocked:

    ```sh theme={null}
    sudo /usr/bin/log show --last 1h --predicate 'subsystem == "com.apple.AppSSO" AND category == "WebLoginAllowList"'
    ```

    Each blocked page appears as `Navigation blocked: host=… url=…`.
  </Step>

  <Step title="Read the sign-in log">
    For a failed sign-in, read the Mac's sign-in log:

    ```sh theme={null}
    /usr/bin/log show --predicate 'subsystem == "com.apple.AppSSO"' --info --debug --style compact --last 30m
    ```

    `Password does not meet local policy` confirms a Mac password rule stricter than the Primo password.
  </Step>
</Steps>

<Info>
  Type `/usr/bin/log`, not `log`: in the default macOS shell, `log` is a different, built-in command.
</Info>

## Resolve the issue

Choose the option that matches the cause.

### Option 1 — Save the control again

For **Sign-in site not allowed** and for a missing login method.

**Requirements:**

* The Mac is online and enrolled.

<Steps>
  <Step title="Open the Mac login with Primo control" />

  <Step title="Check the login methods, then click Save">
    Check the **Login methods**, then click **Save**. Each save pushes an updated profile to the targeted Macs.
  </Step>

  <Step title="Ask the employee to sign in again">
    Wait until the Mac has the new profile first.
  </Step>
</Steps>

If the Mac still blocks a page, contact support with the `Navigation blocked` line.

### Option 2 — Align the Mac password rules

For a sign-in that fails with `Password does not meet local policy`.

**Requirements:**

* You can edit the controls that target the Mac.

<Steps>
  <Step title="Find the stricter password rule">
    Find the password rule that is stricter than the Primo password rules (at least 8 characters, upper and lower case, a number and a special character). The macOS [Password and screenlock](/mdm/policies/password-policy) controls already follow these rules; look for a password policy in a [Custom file](/mdm/policies/custom-file) or in another profile.
  </Step>

  <Step title="Remove or relax the rule">
    Remove that rule from the Mac, or make it no stricter than the Primo password rules.
  </Step>

  <Step title="Ask the employee to sign in again" />
</Steps>

The employee can also change their Primo password to one that meets the Mac's rules, then sign in again.

### Option 3 — Reset the registration

For a registration that keeps failing.

**Requirements:**

* The Mac is online and enrolled.
* The employee can unlock the Mac with their Mac password.

<Steps>
  <Step title="Remove the Mac from the control's targeting">
    For example, take it out of the targeted device group.
  </Step>

  <Step title="Wait for the profile to be removed">
    Wait until the Mac has checked in and the profile is removed.
  </Step>

  <Step title="Add the Mac back to the targeting">
    The Mac receives the profile again and asks the employee to register.
  </Step>
</Steps>

<Info>
  Do not rely on the **Repair** button in **System Settings > Users & Groups**: on macOS 27.0, it does not recover a registration once the Mac password has been synced.
</Info>

## Prevent future incidents

* Keep a local administrator account on every Mac the control covers, with [Admin management](/mdm/policies/manage-admin-accounts). It still opens the Mac when a Primo sign-in fails.
* Do not push a password rule stricter than the Primo password rules to these Macs.
* Roll the control out to a device group first, then widen the targeting.

## What if the Mac is offline?

The employee unlocks the Mac with their Mac password during the **Offline grace period** set on the control, counted from their last successful Primo sign-in. They sign in with Primo again once the Mac is back online.

## Contact

If none of the options above works, contact [support@getprimo.com](mailto:support@getprimo.com) with:

* The Mac's serial number and macOS version
* The time of the failed registration or sign-in
* The output of `app-sso platform -s`
* The `Navigation blocked` line, if the Mac shows **Sign-in site not allowed**

## Related articles

* [Mac login with Primo](/mdm/policies/mac-login-primo)
* [Mac login with Primo guide & FAQ](/guides/device-management/mac-login-primo-guide)
* [Password and screenlock](/mdm/policies/password-policy)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.