How to Configure Okta Platform SSO (Desktop Password Sync)

Okta Desktop Password Sync uses Apple's Platform Single Sign-On (Platform SSO) to keep a user's local macOS password in sync with their Okta password. Once configured, users sign in at the macOS login window with their Okta credentials.

This guide walks through setting up Okta Platform SSO 2.0 in Addigy.

Before You Begin

Okta

• Okta Identity Engine (OIE) org with the Device Access SKU enabled
• Okta Verify authenticator configured in your org
• Platform Single Sign-on app visible in your App Catalog

Addigy

• Addigy account with MDM enrollment
• Ability to upload Custom Profiles

Devices

• macOS 14 Sonoma or later (required for Platform SSO 2.0)
• Physical Mac hardware — virtual machines are not supported

What You Will Create

By the end of this guide you will have deployed five items to your Addigy policy:

Step 1 — Add the Platform Single Sign-on App in Okta

1. In the Okta Admin Console, go to Applications > Applications.
2. Click Browse App Catalog.
3. Search for Platform Single Sign-on for macOS and select it.
4. Click Add Integration, then click Done.
5. On the Sign On tab, copy the Client ID. You will need this later.
6. On the Assignments tab, assign the app to your target users or groups.

Step 2 — Generate SCEP Credentials in Okta

1. In the Okta Admin Console, go to Security > Device Integrations.
2. Click the Device Access tab.
3. Click Add SCEP configuration.
4. Select Static SCEP URL and click Generate.
5. Copy the SCEP URL and the Secret Key. You will need both later.
6. Click Save.

The secret key is shown only once. Store it somewhere secure before leaving this page.

Step 3 — Deploy Okta Verify

There are two ways to deploy Okta Verify in Addigy: via Prebuilt Apps or by creating a Smart Software. 

Prebuilt Apps

1. In your policy navigate to Software > Prebuilt Apps.
2. Search for Okta Verify.
3. Click on the empty box > Actions > Add to Policy. 
4. Set the App Settings > Assign.

Smart Software

1. In the Okta Admin Console, go to Settings > Downloads.
2. Download Okta Verify for macOS.
3. In Addigy, go to Catalog > Smart Software.
4. Upload the Okta Verify .pkg and assign it to your target policy.
5. Confirm that Okta Verify installs to /Applications on the device before continuing.

You must use the package from the Okta Admin Console. The Apple App Store version does not include the SSO extension required for Platform SSO.

Step 4 — Create the Extensible SSO Profile

Navigate to Catalog > Device Settings > New > select Extensible SSO

Replace <your-org> with your Okta ORG ID

Platform SSO section of the same profile:

Optional — macOS 15 Sequoia and later:

Optional — macOS 26 Tahoe:

Step 5 — Create the Associated Domains Profile

Navigate to Catalog > Device Settings > New > select Associated Domains

Replace <your-org> with your Okta ORG ID

After entering the Application Identifier enter the Domains, click Add, then click Add Configuration. You will need to follow these steps once per Application Identifier. 

The second entry is required for macOS 15 and later. Without it, registration will fail silently.

The authsrv: prefix (no https://) is correct here. This is the only profile where authsrv: should appear.

Step 6 — Create the Managed App Configuration Profile

Attached at the bottom of the article is a Managed App Configuration .mobileconfig file that you can download, edit, and upload to Addigy as a Custom Profile. Additionally, you can also use a profile editor of your choice to create the .mobileconfig file. 

This profile must contain two separate payload entries in a single .mobileconfig — one for each Okta preference domain.

Replace <your-org> with your Okta ORG ID

Payload 1 — com.okta.mobile

Payload 2 — com.okta.mobile.auth-service-extension

Both payloads are required. If the com.okta.mobile payload is missing, Okta Verify will not receive its org configuration and registration will fail silently with no error.

The OrgUrl here must use https://. Do not use authsrv: — that format is only for the Associated Domains profile in Step 5.

Upload to Addigy: Catalog > MDM Profiles > New > Custom Profile.

Step 7 — Create the SCEP Certificate Profile

Navigate to Catalog > Device Settings > New > select SCEP. 

The credentials from step 2 will be used in this profile

Increase the priority from the default of 9 to a smaller number as this profile needs to be installed before the other profiles

Step 8 — Assign Everything to Your Policy

1. In Addigy, navigate to your target Policy.
2. Add all four Profiles (Steps 4–7) to the policy.
3. Confirm Okta Verify (Step 3) is also assigned to the same policy.
4. Deploy the policy.

Start with a test policy targeting a single device before deploying to production.

Step 9 — Verify Registration on the Device

1. Wait up to 30 minutes for profiles to reach the device, or use GoLive to push immediately.
2. A notification will appear: "Registration Required." Click Register and sign in with Okta credentials.
3. If the notification does not appear, go to System Settings > Users & Groups > click Edit next to Network account server > click Register. If nothing appears here then make sure it's setup right and deployed to the device.
4. Open Terminal and run:

app-sso platform -s

A successful setup shows Registered status with the Password method and an active SSO token.

5. You can also confirm in the Okta Admin Console under Directory > People > select the user > Devices tab.

References

Okta

• Desktop Password Sync for macOS
• Configure Device Management Profiles
• Configure for macOS 14
• Configure for macOS 15
• Configure for macOS 26

Apple

• Platform SSO for macOS
• Extensible SSO Payload Settings

Addigy

• Create or Import MDM Profiles
• Custom MDM Profile
• Addigy Identity vs Platform SSO