> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Resolve Mac login with Primo issues

> Fix a Mac login with Primo registration or sign-in that fails: read the message the Mac shows, check its registration in Terminal, then save the control again, align the Mac password rules or reset the registration.

This article covers Macs where [Mac login with Primo](/mdm/policies/mac-login-primo) is deployed and the registration or the sign-in fails. For a forgotten Mac password, see [Unblock lost passwords](/guides/device-management/resolve-login-issue).

## Identify common causes

* **A page blocked by the Mac's profile** — the sign-in window shows **Sign-in site not allowed**. The Mac runs an older profile than the current sign-in page needs, usually until the control is saved again.
* **A Mac password rule stricter than the Primo password** — the sign-in fails right after the employee enters their Primo password, because macOS refuses to make it the Mac password.
* **A registration that does not complete** — the Mac shows **Registration failed and will automatically retry** and keeps asking the employee to register.
* **A login method the control does not offer** — the employee does not see **Google** or **Microsoft** on the sign-in page.

## Verify the situation

1. In the cockpit, open the Mac login with Primo control. Check its **Login methods**, and check that the Mac is in its targeting and runs macOS 27 or later.
2. On the Mac, open **Terminal** and run:

   ```sh theme={null}
   app-sso platform -s
   ```

   A registered account shows the state `POUserStateNormal`. `POUserStateNeedsRegistration` means the registration has not completed.
3. For **Sign-in site not allowed**, list the pages the Mac blocked:

   ```sh theme={null}
   sudo /usr/bin/log show --last 1h --predicate 'subsystem == "com.apple.AppSSO" AND category == "WebLoginAllowList"'
   ```

   Each blocked page appears as `Navigation blocked: host=… url=…`.
4. For a failed sign-in, read the Mac's sign-in log:

   ```sh theme={null}
   /usr/bin/log show --predicate 'subsystem == "com.apple.AppSSO"' --info --debug --style compact --last 30m
   ```

   `Password does not meet local policy` confirms a Mac password rule stricter than the Primo password.

<Info>
  Type `/usr/bin/log`, not `log`: in the default macOS shell, `log` is a different, built-in command.
</Info>

## Resolve the issue

Choose the option that matches the cause.

### Option 1 — Save the control again

For **Sign-in site not allowed** and for a missing login method.

**Requirements:**

* The Mac is online and enrolled.

1. Open the Mac login with Primo control.
2. Check the **Login methods**, then click **Save**. Each save pushes an updated profile to the targeted Macs.
3. Once the Mac has the new profile, ask the employee to sign in again.

If the Mac still blocks a page, contact support with the `Navigation blocked` line.

### Option 2 — Align the Mac password rules

For a sign-in that fails with `Password does not meet local policy`.

**Requirements:**

* You can edit the controls that target the Mac.

1. Find the password rule that is stricter than the Primo password rules (at least 8 characters, upper and lower case, a number and a special character). The macOS [Password and screenlock](/mdm/policies/password-policy) controls already follow these rules; look for a password policy in a [Custom file](/mdm/policies/custom-file) or in another profile.
2. Remove that rule from the Mac, or make it no stricter than the Primo password rules.
3. Ask the employee to sign in again.

The employee can also change their Primo password to one that meets the Mac's rules, then sign in again.

### Option 3 — Reset the registration

For a registration that keeps failing.

**Requirements:**

* The Mac is online and enrolled.
* The employee can unlock the Mac with their Mac password.

1. Remove the Mac from the control's targeting, for example by taking it out of the targeted device group.
2. Wait until the Mac has checked in and the profile is removed.
3. Add the Mac back to the targeting. The Mac receives the profile again and asks the employee to register.

<Info>
  Do not rely on the **Repair** button in **System Settings > Users & Groups**: on macOS 27.0, it does not recover a registration once the Mac password has been synced.
</Info>

## Prevent future incidents

* Keep a local administrator account on every Mac the control covers, with [Admin management](/mdm/policies/manage-admin-accounts). It still opens the Mac when a Primo sign-in fails.
* Do not push a password rule stricter than the Primo password rules to these Macs.
* Roll the control out to a device group first, then widen the targeting.

## What if the Mac is offline?

The employee unlocks the Mac with their Mac password during the **Offline grace period** set on the control, counted from their last successful Primo sign-in. They sign in with Primo again once the Mac is back online.

## Summary

1. Read the message the Mac shows, then check the registration with `app-sso platform -s` and the Mac's sign-in log.
2. **Sign-in site not allowed** or a missing login method: save the control again.
3. `Password does not meet local policy`: remove the stricter Mac password rule, or change the Primo password.
4. A registration that keeps failing: take the Mac out of the targeting, then add it back.

## Contact

If none of the options above works, contact [support@getprimo.com](mailto:support@getprimo.com) with:

* The Mac's serial number and macOS version
* The time of the failed registration or sign-in
* The output of `app-sso platform -s`
* The `Navigation blocked` line, if the Mac shows **Sign-in site not allowed**

## Related articles

* [Mac login with Primo](/mdm/policies/mac-login-primo)
* [Mac login with Primo guide & FAQ](/guides/device-management/mac-login-primo-guide)
* [Password and screenlock](/mdm/policies/password-policy)