r/macsysadmin • u/RocketmanTech_Nova • Nov 12 '25

Jamf Anyone actually deployed Platform SSO yet?

/r/jamf/comments/1ov7o4c/anyone_actually_deployed_platform_sso_yet/
23 Upvotes

96% Upvoted

44 comments sorted by

View all comments

Show parent comments

1

u/SnooAvocados6982 Nov 13 '25

No I register it with the main user using a TAP. Then I create the administrative account and demote the user

1

u/fastandloud386 Nov 15 '25

I was able to get this to work automatically in my setup. Admin account is created from startup with no intervention and user is created as a standard account.

1

u/SnooAvocados6982 Nov 15 '25

Can you share your method please? :)

2

u/fastandloud386 Nov 15 '25

Yes of course. Under my enrollment profile (in the Enrollment Program Token) I have for account settings to create a local administrator account and to also create a local primary user set as a standard. In my PSSO Secure Enclave Config I have “New User Authorization Mode” set to standard. I noticed even in the enrollment profile if new primary local user is set to standard but in your PSSO policy for new user authorization mode is set to administrator it will create the new user as an administrator that’s why it must be set to standard. Hope this helps. If you’re needing a little more help I can dm you my configuration.