0.59475 (Customer) asked a question.
Platform Single Sign-On for macOS device registration fails consistently
in Preview Sandbox org, even with Device Access (Dynamic SCEP, Okta CA)
configured.
Please confirm whether macOS Platform SSO device enrollment is supported
in Preview Sandbox (oktapreview.com) tenants.
Platform SSO is partially working.
On macOS login, the Platform Single Sign-On notification appears as expected.
When the user clicks the notification and enters the local macOS password,
device registration fails with the error:
"could not register your mac"
This indicates that the SSO extension is deployed and invoked correctly,
but device enrollment never completes.
Hello @0.59475 (Customer) Thank you for posting on our Community page!
This error usually means a problem with the Okta Verify app, its SSO extension, or underlying macOS settings like certificates or outdated software.
You might want to review our article below which might resolve your issue:
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
@Paul S. (Okta, Inc.) Thanks for the article, however this does not appear to apply to our case.
Our affected devices are running macOS 14.x (Sonoma), not macOS 15.4.
Additionally, Platform SSO is partially functioning:
- The Platform SSO notification appears on macOS login
- The user can click the notification and enter the local macOS password
- Registration then fails with: "could not register your mac"
This indicates that the SSO extension is deployed and invoked correctly,
and the failure occurs during device enrollment, not during OS-level
Device Access initialization.
Given that this occurs consistently in a Preview Sandbox
(oktapreview.com) org, can you please confirm:
Is macOS Platform SSO device enrollment fully supported
in Preview Sandbox tenants?
Hello @0.59475 (Customer) Preview environment should support this, however I can not confirm if there are Features that are not enabled which could cause these issues. In this case I would recommend to Open a case with Support for additional investigation.
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
hello @Paul S. (Okta, Inc.)
Thanks for the response.
We are unable to find the option to open a Support case
from our Preview Sandbox org Admin Console.
Could you please advise how we can open a Support case
or escalate this for internal investigation?
Hello @0.59475 (Customer) If the Preview environment is linked with a Paid Okta Service then you should be able to follow the instructions below to open a case:
https://support.okta.com/help/s/article/How-to-Create-a-Support-Case?language=en_US
Thank you for reaching out to our Community and have a great day!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Updating this response for ease of access and reference:
Okta fully supports macOS Platform Single Sign-On (SSO) device enrollment in Preview Sandbox tenants. Missing XML declarations in the Mobile Device Management (MDM) profile, an incorrect Simple Certificate Enrollment Protocol (SCEP) certificate location, or incorrect Associated Domain syntax cause the "could not register your mac" error. The Platform SSO notification appears on macOS login, and the user provides the local macOS password. However, the registration fails with the following error:could not register your mac
Applies To
Cause
Formatting issues in the MDM payload, incorrect SCEP certificate placement in the Okta Admin Console, or an invalid Associated Domain syntax cause the failure during device enrollment.
Solution
How is the macOS Platform Single Sign-On device registration failure resolved?
Resolve the device registration failure by verifying the XML declarations in the MDM profile, confirming the SCEP certificate location in the Okta Admin Console, and checking the Associated Domain syntax.
?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Related References
We use cookies to provide the best website experience and to help understand marketing efforts. We may also share data with ad partners to reach potential customers across the web. To learn more, visit our Privacy Policy. Click here for Your Privacy Choices. You may also opt out of this sharing by signaling your preference via GPC, applicable only to the browser signaling the opt-out.
More information
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Select All
We use cookies to provide the best website experience and to help understand marketing efforts. We may also share data with ad partners to reach potential customers across the web. To learn more, visit our Privacy Policy. Click here for Your Privacy Choices. You may also opt out of this sharing by signaling your preference via GPC, applicable only to the browser signaling the opt-out.
More information
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Select All
Updating this response for ease of access and reference:
Okta fully supports macOS Platform Single Sign-On (SSO) device enrollment in Preview Sandbox tenants. Missing XML declarations in the Mobile Device Management (MDM) profile, an incorrect Simple Certificate Enrollment Protocol (SCEP) certificate location, or incorrect Associated Domain syntax cause the "could not register your mac" error. The Platform SSO notification appears on macOS login, and the user provides the local macOS password. However, the registration fails with the following error:could not register your mac
Applies To
Cause
Formatting issues in the MDM payload, incorrect SCEP certificate placement in the Okta Admin Console, or an invalid Associated Domain syntax cause the failure during device enrollment.
Solution
How is the macOS Platform Single Sign-On device registration failure resolved?
Resolve the device registration failure by verifying the XML declarations in the MDM profile, confirming the SCEP certificate location in the Okta Admin Console, and checking the Associated Domain syntax.
?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
Related References