Okta Platform SSO Authentication Failures Occur After Upgrading to macOS 27

Upgrading to macOS 27 causes Okta Platform Single Sign-On (SSO) authentication failures for some users who previously enrolled in Desktop Password Sync. It is advised to delay the macOS 27 update via MDM until this is resolved in future macOS updates, while rebooting the device may resolve the failure loop for affected users.

Impacted users encounter a continuous Okta Platform SSO prompt displaying: 

"Please sign in to Okta Platform SSO"

Upon entering valid credentials, authentication fails with the error message: 

"Authentication failed. Try again or contact your administrator."

• Okta Platform SSO with Password Sync
• macOS 27

During the upgrade to macOS 27, existing Platform SSO device encryption keys become inaccessible for some users. This is suspected to cause macOS to drop the existing keys and attempt a re-registration process, which intermittently fails on macOS 27.

How to avoid Okta Platform SSO authentication failures after the macOS 27 release?

To avoid the authentication issues, Okta recommends pausing the macOS 27 update. 

Alternatively, for users actively facing this issue, a potential workaround is to perform a full system restart, and unlock the keychain to regenerate the necessary device encryption keys. 

1. Perform a full system restart to trigger macOS to regenerate the necessary device encryption keys if the device already runs macOS 27 and experiences the issue.
2. Enter the device password to unlock the keychain and allow password synchronization to recover if a prompt appears after logging in.
3. Reboot the machine a second time, if needed, to generate a new device configuration and encryption key if the prompt persists after the first restart.

Apple has indicated that they have resolved this issue in the 27.2 beta release of macOS 27 and Okta is currently evaluating the beta release. Further updates will be communicated as new information or permanent fixes become available.