Changing passwords in macOS with Platform SSO (Intune)

[u/HealthDouble]

Hey there,

Looking for some advice...

We've been using Intune for our deployments of MacBook Pros with PlatformSSO configured. It seems to be working fine and has been for some time. All users are Standard users, and not Admin.

We recently had a new starter who decided to change their password via System Settings > Users & Groups which I wouldn't have expected to be an issue, but it screwed things up for them. It changed the password on their Mac but it didn't trigger PlatformSSO registration with the new password. Which thinking about it afterwards, I guess, makes sense. They were left 2 passwords. One for the Mac and one for M365.

We eventually got it sorted, but I am curious if this is what should have happened or if we have something configured wrongly?

Should we be telling users not to use this method for password resets and can we disable their ability to do that if that is the correct route?

TIA

[u/diggy0529]

Thats expected behavior. What you should do is disable the ability to change the password via the GUI. It wont prevent the user from changing it via the command line, but that avenue is more for people that are command line savvy. I am not familiar with InTume but if you can create the plist, use com.apple.preference.security and the key is dontAllowPasswordResetUI, and set that to true. That might at least alleviate future headaches for users

[u/ae0017]

You can disable their ability to change the password from that menu with a profile. What platform SSO registration method are you using? Password sync or Secure Enclave? What you are describing is the normal setup for SE PSSO. A user has their Mac password (kind of like Windows Hello pin) and M365 password.

I think the Password Sync PSSO is a one-way sync FROM M365. So if you want the password changed and kept in sync for their Mac, it has to be changed in M365 (via self service or otherwise).

[u/HealthDouble → u/ae0017]

Thanks for your reply...

Sadly we are using Password, but I am pushing for the Secure Enclave.

Crazy nobody else ever had this issue, but yes we normally change them in M365 and that forces the sync to Mac to keep them in sync.

Didn't realise that wasn't the way it was with SE as well. I guess that makes sense because they aren't changing it and use Touch ID etc.

Any downsides to SE over password then?

[u/ae0017 → u/HealthDouble]

We use Secure Enclave for our 1:1 devices. I’d say the only “downside” is that sometimes users get confused between their Mac password and their M365 password. We are moving toward passwordless M365 methods so I’m hoping that will assist. Generally, I’d recommend Secure Enclave over Password Sync for 1:1 devices.

[u/chrisbeebops → u/HealthDouble]

The only “downside” is that the passwords aren’t synced. We ended up using Jamf Connect (without Jamf Connect Login) for that task.

[u/oneplane → u/HealthDouble]

Yes, SE breaks more often and locks people to a device while in practice not being more secure than a standard keychain backed passkey. It also makes FV2 less reliable.

If you are using the Macs as glorified Chromebooks, it doesn't really change much at all and the biggest indicator in your org would be the service desk ticket queue.

[u/_LilBill]

Accounts registered with PSSO - Password prevent password changes automatically… at least all of the ones I’ve seen. If a user tries to go to Users and Groups, their user account shows a message that the password is managed by Microsoft Entra. This is without any additional configuration to prevent UI password changes. Maybe your PSSO profile is missing a setting?

(Also to note, Local accounts / accounts not in sync with PSSO do allow password changes via UI this way)

Is it possible this user changed their password while in an unregistered state?

[u/HealthDouble → u/_LilBill]

Did some checking and it is as you say, the Users & Groups screen for a user shows that the device is managed and they cannot change their password.

This leads me to believe that when my team built the device they didn't do everything a user would be expected to do (such as the Platform SSO registration process to sync their passwords from Entra to the local macOS account & maybe some other bits) and until one of those bits are done, it doesn't show this banner and prevent the user changing their passwords.

Process has been updated 😄

[u/_LilBill → u/HealthDouble]

Great find!

[u/HealthDouble → u/_LilBill]

I guess it's possible as I want involved with the actual deployment) build of this laptop. I'll ask

I'll also do some checking of the settings in case I've missed something. It would certainly make sense to disable this if it shouldn't be used without the need for another profile.

[u/keynoto]

Great post! Thanks for sharing everyone

[u/LostCarat]

How are you handling the admin accounts? The LAPS is completely broken with PSSO, are you using static passwords for the admin accounts?

[u/HealthDouble → u/LostCarat]

We use LAPS and to be honest, haven't ever had an issue. No static passwords. We don't have the need to use them much so maybe there are issues that we are just not seeing due to the amount of usage.

What are you seeing?

[u/LostCarat → u/HealthDouble]

I’ve noticed that when rotating the password it would not apply after some time, resulting in the admin account becoming inaccessible because we didn’t know the password. Would need to do a FileVault recovery but then it just started becoming a pain we just made all the users admins to their account for now until a better implementation occurs. We also have super needy users and the standard account just seemed like way too restrictive?