This article can be used to troubleshoot Platform Single Sign-On (PSSO).

• Okta Identity Engine (OIE)
• Okta Device Access (ODA)
• Platform Single Sign On (PSSO)
• macOS 

If there is a problem with either the Policy or Configuration Profile, errors can occur during the registration process. Many values require manual entry, so there is a chance for mistakes. Double-check all manually entered values, such as domains and application identifiers, for typos.

User is not prompted for PSSO registration.

Validate all the prerequisites mentioned below:

1. 1. Verify the macOS version.
      1. Okta supports PSSO 2.0 only on macOS 14 and later.
      2. macOS 15.4 and 15.5 contain a bug that blocks PSSO enrollment.
   2. Verify the macOS Okta Verify version.
      1. Always enforce the latest client when troubleshooting issues.
      2. Download Okta Verify from the Okta Admin Console, not from the Mac App Store.
   3. Verify the SCEP profile and certificate configuration.
      1. Verify the SCEP configuration resides under the Device Access tab and not endpoint management in the Okta Admin Console (Security > Device Integration > Device Access).
      2. Verify certificate deployments.
      3. Check that Allow all apps access is enabled in the SCEP profile. If the administrator does not select this option, the user receives a prompt to allow keychain access to install the certificate.
   4. Verify the MDM configuration profiles. Confirm the plist settings for the following preference domains:
      • com.okta.mobile.auth-service-extension
      • com.okta.mobile. To avoid MDM configuration errors, ensure the MDM pushes only one property list (plist) for com.okta.mobile to the device. If the organization already uses Okta Verify, check for an existing plist and update the OktaVerify.OrgUrl key to include the full organization URL (starting with https://) to prevent duplicate key errors.
        

        <key>OktaVerify.OrgUrl</key>
        <string>https://<domain>.okta.com</string>

      • com.okta.deviceaccess.servicedaemon (optional for DBSSO).
   5. Create a single sign-on extension profile. Make sure Shared Device Keys is enabled. Verify that the links in this configuration do not contain whitespaces at the beginning or end of URLs. Ensure the Registration Token has a value (e.g., <abc123>).
   6. Verify the associated domains profile.
      1. Verify the presence of a com.apple.associated-domains profile.
      2. Ensure the profile includes both application identifiers (<B7F62B65BN.com>.okta.mobile.auth-service-extension and <B7F62B65BN.com>.okta.mobile) and maps them correctly to the authsrv:<customerorg.okta.com> domain.
      3.  Ensure there are no extra spaces before or after application identifiers.
   7. Install macOS Okta Verify. The installation of macOS Okta Verify must occur last. If the administrator installs it earlier, they must reinstall a newer version of Okta Verify. Deleting and reinstalling Okta Verify does not cause loss of FastPass enrollments.
      NOTE: If all configurations are correct and the user does not receive a prompt to register for PSSO, verify there are no typing errors or white spaces for manually entered values like domains or application identifiers.

User is prompted for PSSO registration but registration failed.

Verify the phase where registration fails, check application assignments, verify username mapping, and review password policies.

1. User is not assigned to the application.

• Verify the application assignment for the user. Ensure the user attempting password sync has an assignment to the Desktop Password Sync or Platform Single Sign-On for macOS App Instance of the org. 
• Users lacking application assignment cannot complete the registration. Removing the user assignment or deleting the AppInstance after completing the registration causes subsequent password syncs to fail.
• Example API Error responses in logs:
  "API": {"message": "Request URL: https://<Okta tenant URL>/device-access/api/v1/platform-sso/user-registration Response Code: 400 Debug Headers: { x-okta-request-id:b716b1def3a2c8bdaa8dff9efb70bc99 x-rate-limit-reset:1772692133 x-rate-limit-limit:600 x-rate-limit-remaining:599} Error Response: {Error Code: user_not_assigned, Error Id: oaebJspNKh-TfWYwMyD8tJx9A, Error Summary: User is not assigned to Platform Single Sign-On for macOS App}", "defaultProperties": "", "location": ....

2. Verify the username mapping configuration for the Platform SSO application.

An incorrect username mapping configuration for the Platform SSO app within the Okta Admin Console causes an error indicating a missing user.

3. Verify the password policy.

If the user attempts to enter their Okta password and the dialog shakes as if the password is incorrect,

Check if system logs show an invalid password event: eventType eq "device.platform_sso.authentication" and outcome.result eq "FAILURE".

• Scenario 1: The user entered an old or wrong password instead of their current Okta password during password sync.
  • Verify the current Okta password by having the user log in to their Okta tenant URL in a browser and confirming the password works.
• Scenario 2: MDM Password Policy and Okta Password Policy Mismatch.
  • A mismatch between the Okta password and the password policy enforced by Jamf or WorkspaceOne causes the password sync to fail.
  • It is recommended to disable the macOS password expiration policy from MDM before deploying PSSO.
  • Examples of where users in Okta are invalid for password sync include:
    • An expired password
    • A passwordless user
    • Or a locked-out user.

How are logs gathered for Platform Single Sign-On?

View system logs in the Admin Dashboard and analyze local client logs to confirm successful enrollment.

1. View system logs in the Admin Dashboard by navigating to Reports > System Log.
   Platform SSO logs three main events:
   • device.platform_sso.keys.register: Enrolls the PSSO keys (only fired in PlatformSSO 2.0 enrollment flows).
   • device.platform_sso.enrollment.create: Enrolls the user into Platform SSO.
   • device.platform_sso.authentication: Authenticates a user-entered password and performs the sync if the local password is out of sync. The reason and outcome properties provide insight into success or failure and the reason behind that failure.
2. Analyze Local Client Logs.
   • The path is  ~/Library/Group Containers/<B7F62B65BN>.group.okta.macverify.shared/Logs/.
   • The filename uses the format SSOExt_OktaVerify <DATE TIME>.log
     For example: SSOExt_OktaVerify 2026-06-11 00-20-49.log
3. Review indicators of successful enrollment.
   The following log markers confirm that the registration process completes as expected:
   
   • Initiating Device Registration: Logs show Initiating device registration v2.
   • Device Enrollment Complete: Log shows as DEVICE registration succeeded.
   • User registration: Log shows as Initiating user registration.
   • User Enrollment Complete: Confirms that USER registration succeeded.

Checking Platform Single Sign-On status on a machine.

Run the following command in the terminal to check the status of PSSO on a machine.

1. Run the command app-sso platform -s in the terminal.
2. Review the output. If any of the sections display Device Configuration: (null), Login Configuration: (null), or User Configuration: (null), it indicates either there is no registration or the registration resides in an invalid state. The user must go through the steps to reset or repair the Platform SSO enrollment.
   

   Time: 2025-05-09 15:40:58 +0000
   Device Configuration:
     (null)
   Login Configuration:
     (null)
   User Configuration:
     (null)   

Related References

• Troubleshooting Okta Desktop Password Sync Issues for macOS
• Working with Okta Device Access Logs
• Just-In-Time Local Account Creation for macOS