How to Troubleshoot Apple Platform SSO

   September 29, 2025  1 Comment on How to Troubleshoot Apple Platform SSO  Posted in Workspace ONE 0 Likes 17 Views

Last updated 9/29/2025

Troubleshooting

This page will be organized by sharing troubleshooting steps that apply to all of the implementations, then it will break out into specific sections unique to each vendor implementation. Expect this page to be updated frequently as we tend to learn more with every implementation of this technology.

Universal Troubleshooting Tips

  1. Does the SSO Extension Profile exist on the device? Validate this by looking at System Settings > Privacy and Security > Profiles. Verify there is an entry for the SSO Extension. Verify that the Hosts configuration matches the correct subdomains.
  2. Did the SSO Extension Registration succeed? Verify this from Terminal by running:

    pluginkit -m | grep -I auto-service-extension
  3. Did the device complete registration? Verify this from Terminal by running:

    app-sso platform -s

    If the device registration was successful you should see a line reading
    Device Configuration.registrationCompleted = true
    and the Login Configuration Object should not be null

Troubleshooting Microsoft Entra ID

  1. The Microsoft Company Portal app includes additional logging capabilities. Open the Company Portal app and choose the Company Portal Menu > Settings > then enable the checkbox “Turn on advanced logging.”
  2. Enable debug log persistence, reproduce the issue then capture the data:

    sudo log config --mode "level:debug,persist:debug" --subsystem "com.apple.AppSSO"
    sudo sysdiagnose

    When you are finished, reset debug logging back to the default settings:

    sudo log config --reset --subsystem "com.apple.AppSSO"

    Additional troubleshooting documentation from Microsoft is available at https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-macos-platform-single-sign-on-extension?tabs=macOS14

Troubleshooting Okta Verify

  1. The Okta Verify app stores its logs in the user’s home directory. You’ll need those logs to figure out what is going wrong if this breaks. Here are some steps to help track that down:

    ~/Library/Group Containers/B7F62B65BN.group.okta.macverify.shared/Logs/[com.okta.mobile *date--time*.log]

    Run the following in Terminal to save a copy of the Okta Verify logs with a time stamp to the current user’s Downloads folder:

    cp -R ~/Library/Group\ Containers/ B7F62B65BN.group.okta.macverify.shared/Logs ~/Downloads/OktaVerifyLogs_$ (date +%Y_%m_%d-%H%M)

    It is also helpful to look for logs labeled with com.okta.mobile.auth-service-extension something

Troubleshooting Omnissa Access

  1. TBD

Next Steps

Thank you for visiting! In case you need to review any of the previous blogs in the series here are the links:

Part 1 – What is Apple Platform SSO

Part 2 – How to configure Apple Platform SSO with Microsoft EntraID

Part 3 – How to configure Apple Platform SSO with Okta Verify

Part 4 – How to configure Apple Platform SSO with Omnissa Access

Part 5 – Troubleshooting