Okta Desktop Password Sync Uninstall Instructions (macOS)

This article contains instructions for removing Desktop Password Sync for Mac devices.

• Okta Identity Engine (OIE)
• Device Access
• Mac
• Password Sync

Please follow the steps below:

1. In Mobile Device Management (MDM), look for the Desktop Password Sync configuration profile (not the actual policy created).
2. Open the profile and click Edit.
3. On the Scope tab, remove the target for the device that should be reset.
4. Save the changes.
5. Redistribute the profile to all devices.
6. On the macOS device, confirm that the profile has been removed from Settings > General > Device Management (for older macOS devices, these may be found under Privacy & Security > Profiles).
7. Ensure all Single Sign On (SSO) extension profiles, including credential extensions, have been removed. If any remain, macOS will not remove the registration.
8. If the above were done correctly, Okta Verify should also be removed. If not, please uninstall the application.
9. Restart the device.
10. Verify the registration has been removed by using the terminal command:

    app-sso platform -s  

    There should be no mention of Okta.

NOTE: As this is a Password Sync integration (not SSO), the password that is in Okta has been applied to the macOS user, so when logging in again, it is the Okta password, not the original macOS user password.

This works fine on macOS 15.3.2 and older, but on 15.4 and 15.4.1, after doing these steps, the password is no longer accepted on the Lock Screen. Here are the steps to remediate that:

1. Remove the standard SSO Configuration Profile. Verify it was removed from the Mac.
2. Remove the SCEP Device Access Configuration Profile.
3. Deploy the Okta Verify configuration profile without Password Sync/Platform SSO settings (to be used for FastPass).
4. Reboot the Mac.
5. Re-deploy the standard SSO configuration profile.