IT & Systems · Identity & Access Management · 2026
Apple Platform SSO & Okta Desktop Password Sync
End-to-end beta deployment unifying macOS authentication across Maple — replacing fragmented local passwords with a single, MFA-enforced login.
Problem
Employees were managing separate local Mac passwords
Before the rollout, Maple employees maintained local macOS passwords entirely separate from their Okta credentials. This created friction — more passwords to remember, more reset requests, and a weaker security posture with no consistent MFA enforcement at the device login layer.
Approach
Beta pilot across a small group, end-to-end ownership
I led the full deployment — from Okta SAML/OIDC configuration and Apple Platform SSO setup through to MDM policy enforcement via Iru (formerly Kandji). The beta ran across a small pilot group spanning macOS devices, allowing us to validate compatibility, iron out Okta configuration edge cases, and test the end-user experience before any broader rollout.
Outcome
Unified login with Iru Passport and enforced MFA
Following a successful beta, the deployment moved to a company-wide rollout. Employees now authenticate with a single set of Okta credentials at device login — enforced through Iru Passport with MFA — eliminating the local password layer and significantly tightening Maple's identity perimeter.
Try it: before and after
Click through a morning login both ways to see what changed for employees. Nothing here is real; it's a simplified model of the experience.
- Passwords typed
- 0
- Sign-in prompts
- 0
- MFA before the Mac unlocks
- —
Technical Detail
Apple Platform SSO works by extending Okta's identity layer directly to the macOS login window, syncing credentials so that the device password and Okta password stay in sync — and surfacing MFA at login rather than only at app sign-in. Configuring this end-to-end required setting up the SAML/OIDC integration in Okta, deploying the SSO extension profile via MDM, and validating the Okta Desktop Password Sync behaviour across each platform (macOS) before release.
Edge cases during the beta centred on Okta configuration — ensuring the SSO extension profile was scoped correctly, that Password Sync wasn't triggering unexpected re-authentication loops, and that the Iru Passport experience was consistent across device generations and OS versions.
"The goal wasn't just fewer passwords — it was making security feel invisible to the end user while actually strengthening the identity perimeter."