Last Updated 07/23/2026
Introduction
This is part four of a six part blog series on how to configure Apple Platform SSO using Omnissa Workspace ONE Unified Endpoint Management (UEM). Each part of the blog covers the various vendor configuration options and the series wraps up with a blog dedicated to troubleshooting. As each vendor continues to change their implementation these blogs will be updated.
Part 1 – What is Apple Platform SSO
Part 2 – How to configure Apple Platform SSO for Kerberos with Microsoft AD or Microsoft Entra
Part 3 – How to configure Apple Platform SSO with Microsoft EntraID
Part 4 – How to configure Apple Platform SSO with Okta Desktop Password Sync
Part 5 – How to configure Apple Platform SSO with Omnissa Access
Part 6 – Troubleshooting
The Apple PSSO Configuration Cheat Sheet for Okta
## The Apple PSSO Configuration Cheat Sheet for Okta
**Pre-requisites:**
For PSSO with Okta you must purchase a license from Okta to use this feature. Currently the license is available through the Okta Device Access SKU which includes Okta’s Desktop MFA for macOS and Okta Desktop Password Sync.
Okta has implemented Platform SSO within the Okta Device Access technology. Okta Device Access includes a technology named Password Sync that synchronizes the macOS local account password with the end user’s Okta password. This allows the end user to use their Okta password to login. This blog does not cover configuring and deploying Okta Desktop Password Sync which is done from the Okta Admin console. Okta has more details on how to enable this feature on their website but this is a pre-requisite to continue:
**To Configure Apple Platform SSO with Okta Desktop Password Sync:**
1. Configure SCEP for Device Access
2. Configure the Certificate Authority in Okta
3. Configure the Platform SSO app in Okta
4. Deploy the Okta Verify App
5. Configure the SSO Extension Payload (Custom Settings recommended)
6. Create the SCEP profile
7. Add Okta Verify to UEM
8. Configure the Four Custom Settings Payloads
9. Configure a UEM Freestyle Workflow to Deploy PSSO
## Configuration Steps in Detail
### Step 1 of 9: Configure SCEP for device access
Omnissa has published a guide on Techzone which can be found here:
This step has two halves: first you configure the certificate authority on the Okta side, then you build the matching certificate authority, template, and SCEP profile in Workspace ONE UEM.
#### Step 2 of 9: Configure the certificate authority in Okta
You have two options: let Okta act as the CA, or use your own CA. Pick one.
**Option A – Use Okta as the certificate authority**
Guide:
1. In the Admin Console, go to **Security > Device integrations**. Select the **Device Access** tab instead of the **Endpoint management** tab.
2. Select **Desktop (Windows and macOS only)**, then click **Next**.
3. On the **Add device management platform** page, select the following options:
– **Certificate authority**: **Use Okta as certificate authority**
– **SCEP URL challenge type**: **Static SCEP URL**
4. Click **Generate**.
5. Copy and save the SCEP URL and the secret key in a safe place. This is the only time that they appear in the Okta Admin Console and they will be used when adding the CA to Workspace ONE UEM.
6. Click **Save**.
**Option B – Use your own certificate authority**
Guide:
Download the Okta intermediate certificate:
1. Go to **Device Integrations > Cert Authority** and download the Okta CA intermediate certificate. You will upload this to UEM later in the SCEP profile’s Credentials payload.
#### Step 3 of 9: Configure the Platform SSO app in Okta
Guide:
1. Sign in to your Okta org as a super admin.
2. In the Admin Console, go to **Applications > Applications > Browse App Catalog**.
3. Search for **Platform Single Sign-on** and select the app. This is the new name for Desktop Password Sync within the Admin Console.
4. Click **Add integration**. If you get an error message saying this feature isn’t enabled, contact your Okta account representative.
5. Open **Platform Single Sign-on** from your **Applications** list.
6. On the **General** tab, you can edit the app label or use the default label.
7. On the **Sign on** tab, make note of the **Client ID**. You need this when creating the managed app configuration in your MDM (it goes into the Custom Settings payloads in Step 4).
8. To use Desktop Password Sync, users must have the **Platform Single Sign-on** app assigned. Assign the app to individual users or groups on the **Assignments** tab.
9. Click **Save**.
#### Step 4 of 9: Create the Certificate Authority in Workspace ONE UEM
1. In the Workspace ONE UEM console, select **Groups & Settings**, then click **All Settings**.
2. From the menu, expand **System**, then **Enterprise Integration**. Click **Certificate Authorities**.
3. Click **Add**.
4. Give the new certificate authority a name. For example, enter `Okta SCEP CA`.
5. From the **Authority Type** dropdown, select **Generic SCEP**.
6. Enter the SCEP URL for your Okta instance (the one you saved in step 2a).
7. Select **Static** for the **Challenge Type**.
8. For **Static Challenge**, enter the secret key you noted earlier. Confirm this by entering the same secret key in the **Confirm Challenge Phrase** field.
9. Set your preferred **Retry Timeout in Milliseconds** and your **Max Retries When Pending** values.
10. Click **Save**.
#### Step 5 of 9: Create the Certificate Template
1. On **Certificate Authorities**, click the **Request Templates** tab, then click **Add**.
2. Enter a name for the certificate template. For example, enter `Okta SCEP Template`.
3. Select the CA you just created from the **Certificate Authority** dropdown. For this example, select `Okta SCEP CA`.
4. Enter the **Subject Name**. This is the subject given to the device when it generates its key pair. You can click the plus sign (+) to look up available dynamic values. For this example, enter `CN={EmailAddress} managementAttestation {DeviceUid}`.
5. Select **Signing** for the **Private Key Type**.
6. Select **Enabled** for **Automatic Certificate Renewal**, and set the **Auto Renewal Period (days)** to your preferred timeframe.
7. Click **Save**.
#### 6 of 9: Create the SCEP profile
1. In the Workspace ONE UEM console, select **Resources**, then click **Profiles**.
2. From the **Add** drop-down menu, select **Add Profile**.
3. Select the profile platform by clicking **macOS**.
4. For the **Management Type** select **Imperative**, and for **Context** select **Device**.
5. Enter `Okta SCEP` for the profile name.
6. Scroll down the list of payloads until you find **SCEP**. Click **Add**.
7. From the **Credential Source** dropdown, click **Defined Certificate Authority**.
8. Select the Okta certificate authority and template created earlier. Make sure **Allow access to all applications** is selected.
9. Scroll through the list of available payloads until you find **Credentials**. Click **Add**.
10. For **Credential Source**, click the **Upload** button and upload the CA certificate you downloaded from Okta. Make sure **Allow access to all applications** is selected.
11. Click **Next**.
12. Click in the **Smart Group** field. From the list of assignment groups that appear, select the appropriate group. For example, select `All Corporate macOS Devices`.
13. Select **Auto** for the **Assignment Type**.
14. Click **Save and Publish**.
15. You should now see your Okta SCEP device profile within the list on the Profiles window.
### Step 7 of 9: Add Okta Verify to UEM
The Okta Verify app must be installed on macOS to enable PSSO. In October 2025, the Okta Verify app for macOS was updated to version 9.52.0 to support Simplified Setup. Unfortunately Workspace ONE UEM does not support Simplified Setup at this time but will do so in a future UEM Console upgrade. The recommendation is to always use the latest vendor supplied version of the application.
1. Download Okta Verify 9.52.0 or higher from Okta’s website.
2. Run the app through the Workspace ONE UEM Admin Assistant tool. This produces a DMG file, a metadata PLIST file, and a PNG icon in a single folder.
3. Add the Okta Verify app to UEM as a fully managed internal app:
– In the UEM console, select **Resources > Native Apps**, then click **Internal**.
– From the **Add** drop-down menu, select **Application File**.
– Click **Upload > Choose File**, navigate to the folder created by the Admin Assistant, choose the **DMG** file, and click **Upload**, then **Continue**.
– Upload the metadata by clicking **Upload** and choosing the **PLIST** file from the same folder. Click **Save**, then **Continue**.
– Click **Images**, then add the **PNG** icon from the same folder.
– Click **Save & Assign**.
4. Assign this app to a Smart Group that targets all macOS devices, but change the assignment from **Auto** to **Manual**. (After building the remaining PSSO profiles, a Freestyle Workflow will install Okta Verify only on devices that require PSSO — see Step 5.)
5. Click **Create**, then **Publish**.
### Step 8 of 9: Configure the Four Custom Settings Payloads
In the Workspace ONE UEM Console create 4 new Profiles, each with a single Custom Settings Payload. Using the payloads below for guidance, make the changes described above each block.
**Okta Custom Settings Payload 1 of 4:**
1. Replace `acme.oktapreview.com` with your Okta domain name.
2. In the Okta Admin console the Platform Single Sign-On app will include a Client ID. Replace the string value `0asdvkgomgeTHTnf3ssg` with your actual Client ID.
3. In this example the Okta username is the email address, so the value `{EmailAddress}` is used. If you use a different format for your Okta username, edit this string accordingly.
“`xml
“`
**Okta Custom Settings Payload 2 of 4:**
1. Replace `acme.oktapreview.com` with your Okta domain name.
2. In the Okta Admin console the Platform Single Sign-On app will include a Client ID. Replace the string value `0asdvkgomgeTHTnf3ssg` with your actual Client ID.
3. In this example the Okta username is the email address, so the value `{EmailAddress}` is used. If you use a different format for your Okta username, edit this string accordingly.
“`xml
“`
**Okta Custom Settings Payload 3 of 4:**
1. Replace `acme.oktapreview.com` with your Okta domain name.
“`xml
“`
**Okta Custom Settings Payload 4 of 4:**
1. Replace `acme.oktapreview.com` with your Okta domain name.
2. In this example the string `Okta Platform SSO Dev` is what will be displayed to users for account notifications and authentication requests. Edit this accordingly.
“`xml
“`
### Step 9 of 9: Configure a UEM Freestyle Workflow to Deploy PSSO
Back in part three of this blog series, step seven of the eight steps walks through how to build a UEM Freestyle workflow to deploy PSSO. Using that template as a guideline, build a Freestyle Workflow to install the Okta Verify app first, then the custom payloads defined above.
## Acknowledgements
A huge thank you to Bo Leksono and Cameron Megaw for helping to sort this out and come up with a working solution. I personally do not test with Okta.
With the configuration out of the way the next step would be to review Part 6 for some tips on troubleshooting.
Part 1 – What is Apple Platform SSO
Part 2 – How to configure Apple Platform SSO for Kerberos with Microsoft AD or Microsoft Entra
Part 3 – How to configure Apple Platform SSO with Microsoft EntraID
Part 4 – How to configure Apple Platform SSO with Okta Desktop Password Sync
Part 5 – How to configure Apple Platform SSO with Omnissa Access
Part 6 – Troubleshooting
5 thoughts on “How to Configure Apple Platform SSO with Okta Desktop Password Sync”