Migrate From Addigy Identity To Platform SSO – Addigy

Migrating from Addigy Identity to Platform SSO sounds like a daunting task but in reality the workflow is fairly straight forward. There are two workflows that you can do which will both achieve the same outcome so the choice is based on personal preference.

Uninstall Addigy Identity Then Enable Platform SSO

Uninstall Addigy Identity
- Addigy Identity automatically uninstalls when a device is removed from the policy deploying Addigy Identity or the Addigy Identity configuration is removed from the policy. Both methods will cause Addigy Identity to uninstall. To verify Addigy Identity has uninstalled you can check the Addigy Identity Installed device fact and verify the output reads False.

Once the output reads False for all devices in the policy you can move onto step 2.

Enable Platform SSO
- To enable Platform SSO we recommend following our articles based on your Identity Provider:
  - Entra
  - Okta

To verify if a user has registered with Platform SSO you can save this script as a Custom Fact and deploy the fact to the policy. When the end user has registered the Custom Fact will output the email they used to register. To learn more about Custom Facts you can view this article.

#!/usr/bin/env bash
# get_psso_email.sh
# Retrieves the Entra ID / IdP email used to register this Mac via Platform SSO.
# Works in MDM system context (runs as root) — no user session required.
# Requires macOS 13 (Ventura) or later.

set -euo pipefail

# ── Resolve the console user ──────────────────────────────────────────────
CONSOLE_USER="$(scutil <<< "show State:/Users/ConsoleUser" \
  | awk '/Name :/ && !/loginwindow/ { print $3; exit }')"

if [[ -z "$CONSOLE_USER" || "$CONSOLE_USER" == "root" ]]; then
  echo "Error: Could not determine a logged-in console user." >&2
  exit 1
fi

# ── Primary: AltSecurityIdentities (written at PSSO registration time) ────
# Format in dscl: "PlatformSSO:user@domain.com"
# This attribute is available in system context and is the most reliable source.
EMAIL="$(dscl . -read "/Users/${CONSOLE_USER}" AltSecurityIdentities 2>/dev/null \
  | grep -i "PlatformSSO:" \
  | sed 's/.*PlatformSSO://' \
  | tr -d '[:space:]')"

# ── Fallback: RecordName (Entra ID password-sync sets UPN as record name) ─
if [[ -z "$EMAIL" ]]; then
  RECORD_NAME="$(dscl . -read "/Users/${CONSOLE_USER}" RecordName 2>/dev/null \
    | awk 'NR==1{print $NF}')"
  if [[ "$RECORD_NAME" =~ ^[^@]+@[^@]+\.[^@]+$ ]]; then
    EMAIL="$RECORD_NAME"
  fi
fi

# ── Fallback: EMailAddress attribute (set by some IdPs e.g. Okta) ─────────
if [[ -z "$EMAIL" ]]; then
  DSCL_EMAIL="$(dscl . -read "/Users/${CONSOLE_USER}" EMailAddress 2>/dev/null \
    | awk '/EMailAddress:/{print $2}')"
  if [[ "$DSCL_EMAIL" =~ ^[^@]+@[^@]+\.[^@]+$ ]]; then
    EMAIL="$DSCL_EMAIL"
  fi
fi

# ── Output ────────────────────────────────────────────────────────────────
if [[ -n "$EMAIL" ]]; then
  echo "$EMAIL"
else
  echo "Error: Could not determine the registered Platform SSO email for '${CONSOLE_USER}'." >&2
  exit 1
fi

Enable Platform SSO Then Uninstall Addigy Identity

Enable Platform SSO
- To enable Platform SSO we recommend following our articles based on your Identity Provider:
  - Entra
  - Okta

To verify if a user has registered with Platform SSO on their device you can save this script as a Custom Fact and deploy the fact to the policy. When the end user has registered the Custom Fact will output the email they used to register. To learn more about Custom Facts you can view this article.

#!/usr/bin/env bash
# get_psso_email.sh
# Retrieves the Entra ID / IdP email used to register this Mac via Platform SSO.
# Works in MDM system context (runs as root) — no user session required.
# Requires macOS 13 (Ventura) or later.

set -euo pipefail

# ── Resolve the console user ──────────────────────────────────────────────
CONSOLE_USER="$(scutil <<< "show State:/Users/ConsoleUser" \
  | awk '/Name :/ && !/loginwindow/ { print $3; exit }')"

if [[ -z "$CONSOLE_USER" || "$CONSOLE_USER" == "root" ]]; then
  echo "Error: Could not determine a logged-in console user." >&2
  exit 1
fi

# ── Primary: AltSecurityIdentities (written at PSSO registration time) ────
# Format in dscl: "PlatformSSO:user@domain.com"
# This attribute is available in system context and is the most reliable source.
EMAIL="$(dscl . -read "/Users/${CONSOLE_USER}" AltSecurityIdentities 2>/dev/null \
  | grep -i "PlatformSSO:" \
  | sed 's/.*PlatformSSO://' \
  | tr -d '[:space:]')"

# ── Fallback: RecordName (Entra ID password-sync sets UPN as record name) ─
if [[ -z "$EMAIL" ]]; then
  RECORD_NAME="$(dscl . -read "/Users/${CONSOLE_USER}" RecordName 2>/dev/null \
    | awk 'NR==1{print $NF}')"
  if [[ "$RECORD_NAME" =~ ^[^@]+@[^@]+\.[^@]+$ ]]; then
    EMAIL="$RECORD_NAME"
  fi
fi

# ── Fallback: EMailAddress attribute (set by some IdPs e.g. Okta) ─────────
if [[ -z "$EMAIL" ]]; then
  DSCL_EMAIL="$(dscl . -read "/Users/${CONSOLE_USER}" EMailAddress 2>/dev/null \
    | awk '/EMailAddress:/{print $2}')"
  if [[ "$DSCL_EMAIL" =~ ^[^@]+@[^@]+\.[^@]+$ ]]; then
    EMAIL="$DSCL_EMAIL"
  fi
fi

# ── Output ────────────────────────────────────────────────────────────────
if [[ -n "$EMAIL" ]]; then
  echo "$EMAIL"
else
  echo "Error: Could not determine the registered Platform SSO email for '${CONSOLE_USER}'." >&2
  exit 1
fi

Once all users have registered with Platform SSO you can proceed to uninstall Addigy Identity from devices.

Uninstall Addigy Identity
- Addigy Identity automatically uninstalls when a device is removed from the policy deploying Addigy Identity or the Addigy Identity configuration is removed from the policy. Both methods will cause Addigy Identity to uninstall. To verify Addigy Identity has uninstalled you can check the Addigy Identity Installed device fact and verify the output reads False.

Frequently Asked Questions

Can I proceed with the migration if there are still some devices in my fleet that have not registered with Platform SSO or have not been online for Addigy Identity to uninstall?
- You can proceed to migrate devices even if some devices have not registered with Platform SSO or have not been online for Addigy Identity to uninstall. Users will not have any issues signing into their device if both Addigy Identity and Platform SSO are on the device.
Will uninstalling Addigy Identity delete the local account that the user synced to?
- No, uninstalling Addigy Identity will not delete the local user that the user synced to even if Addigy Identity created the local user. When Addigy Identity uninstalls the users email is removed as an alias from the local user but the local user and all data stays on the device.