Platform compatibility
Prerequisites
Before deploying this control, connect your Entra tenant in Settings > Integrations.Set up the control
1
Go to MDM > Controls > Add new control
Select Mac login with Entra.
2
Choose an authentication method
Select the authentication method from the dropdown:
- Secure enclave — uses the device’s secure enclave to bind credentials, providing the strongest level of security.
Deploying this control will automatically install the app required for Entra Platform SSO on targeted devices.
3
Select targeting
Choose which devices to apply the control to: all macOS devices, specific device groups, or a custom target.
How it works
Primo uses macOS Platform Single Sign-On (Platform SSO), introduced in macOS 13, to integrate the login window with Entra ID. When an employee logs in, macOS validates the credentials against Entra ID and stores the resulting token in the Keychain for SSO to browser and app sign-ins. Offline login is supported — if the device cannot reach Entra ID, macOS falls back to locally cached credentials.The first login after enabling this control requires an active internet connection to establish the Entra ID binding on the device.