Skip to main content
Make sure the right macOS accounts hold a secure token: macOS requires it for local user management actions such as changing user passwords or creating new user accounts.

​
What is the secure token?

The secure token is a security identifier generated by macOS and linked to a local user account. It applies to macOS 10.13 and later on APFS volumes. It enables data encryption and decryption through FileVault. A user with a secure token is considered “authorized” to perform sensitive system actions such as:
  • Enabling or disabling FileVault
  • Changing another local user’s password (if the user has a secure token)
  • Creating a new local user
  • Granting a secure token to another account
  • Deleting a local user account
Only accounts with a secure token appear on the FileVault unlock screen when the Mac starts. An administrator account without a token can’t unlock the disk after a restart. It can log in once another account has unlocked the disk.
An account without a secure token still works as a regular administrator once the disk is unlocked: sudo, app installs, and settings unrelated to FileVault or startup security. MDM commands such as Lock and Wipe don’t go through this account and work either way.
Without a secure token, these operations fail, even when run from an administrator account. A secure token is granted, not transferred. Several accounts on the same device can hold a secure token at the same time, so you never have to remove one account’s token to give a token to another account.

​
Why the secure token matters

Primo relies on the secure token to manage macOS users securely. When you reset a password or create a new user from the cockpit, macOS requires an account that holds a secure token to run the action. If no account on the device has one, the action fails.

​
Check the secure token status from the cockpit

The cockpit displays the secure token status under the Users tab of the relevant device. Use it to verify whether the macOS administrator account used by Primo holds an active secure token.
To ensure proper user management, make sure the administrator account linked to the device has a secure token.
To check the status locally on the device, run:

​
Grant a secure token to the Primo admin account

Accounts created by the Admin Management control have no secure token until they log in once. Do this once per Mac.
1

Check the bootstrap token

On the Mac, run:
The output must show Bootstrap Token escrowed to server: YES. If it shows NO, escrow the bootstrap token first.
2

Get the admin password

In the device panel, open the Users tab. On the admin account card, click Actions > Display password and copy it.
3

Log in at the login window

Log in as the admin account from the Mac’s login window and type the password. SSH sessions, scripts run through Primo, su and sudo don’t grant a token.
4

Check the result

You can log out. The token stays on the account. The cockpit shows the new status within 24 hours.
There is no bulk action in the cockpit to grant the token to the admin account on several devices at once. On a large fleet, start with Macs where FileVault is on and Macs with Apple silicon: that’s where a missing token blocks startup unlock and software updates.

​
Grant or revoke a secure token

Both commands run locally on the device. To grant a secure token to an account:
To revoke the secure token of an account:
The - makes sysadminctl prompt for each password, so they don’t end up in your shell history. Never paste these passwords into a ticket or a chat. In both cases you need the password of the account concerned and the password of an administrator account that already holds a secure token. This is an Apple requirement: changing the secure token status of a user with sysadminctl always requires the user name and password of an existing secure token-enabled administrator. There is no way to do it remotely without these passwords.
Every device must keep at least one account with a secure token. If the last one is revoked, nobody can unlock the disk at startup and the device becomes inaccessible.
If no account with a secure token is left, only the FileVault recovery key can unlock the disk. Find it in the device panel, under Information > Host information > Recovery key.
Both sysadminctl and System Settings prevent the deletion of the last administrator or secure token-enabled user. The cockpit can take up to 24 hours to update the local account status on the device’s users tab.

​
Bootstrap token and volume ownership

The bootstrap token is the mechanism that lets macOS grant a secure token at first login, without anyone entering credentials manually. Apple documents the following behavior:
  • On macOS 11 and later, setting the initial password for the very first user on the device results in that user being granted a secure token.
  • On macOS 11 and later, if macOS doesn’t grant a secure token at creation, and if a bootstrap token is available from the device management service, it grants a secure token to the local user when they log in.
  • On macOS 10.15.4 and later, macOS generates and escrows a bootstrap token to the device management service on the first login by any secure token-enabled user, if the service supports the feature.
On a device with Apple silicon, the secure token also determines volume ownership, which controls startup security settings and authorizes software updates and erasing all content and settings:
  • The user that first claimed the device by configuring it for their use is granted a secure token and becomes the first volume owner.
  • When a bootstrap token is available and in use, it also becomes a volume owner, and it grants volume ownership status to additional accounts as it grants them secure tokens.
To check volume owners and the bootstrap token state locally:
listUsers returns volume owners by GUID. To map a GUID back to an account, search for its GeneratedUID:

​
Escrow a missing bootstrap token

If profiles status returns escrowed to server: NO, run this on the Mac with the credentials of an account that already holds a secure token, usually the device’s main user:
The command prompts for that account’s name and password. Run profiles status -type bootstraptoken again to confirm.

​
Secure token behaviors (macOS only)

[¹] Without an escrowed bootstrap token, the first login doesn’t grant a token. See Escrow a missing bootstrap token. In the Users tab, accounts created by the Admin management control show Source: MDM Control. Other accounts show no source.

​
Troubleshoot secure token issues