macOS-MosylePlatformSSO

The Crossing's Mosyle-targeted complement to Scott Kendall's Microsoft-Platform-SSO (which is Jamf-Pro-focused). Two things live here: a reference guide for configuring Platform SSO with Microsoft Entra ID on a Mosyle-managed fleet, and a per-user, per-login auto-enabler for two Microsoft Company Portal pluginkit extensions (SSO + Autofill).

Current contents

docs/platform-sso-mosyle-reference.md

The main reference. SSO Extensions profile settings, the Mosyle attribute-mapping workaround for Secure Enclave, grace-period behavior, Associated Domains, ADE prestage considerations, the no-wipe migration pattern for existing devices, validation commands, and troubleshooting.

Written from Mosyle's, Apple's, and Microsoft's own documentation while doing the actual implementation, with Scott's guide as the model for what a useful PSSO write-up looks like. Anywhere it uses <angle brackets>, that's a name specific to a tenant — substitute your own. Profile names, device group names, and account names are deliberately left out.

Co-written with Claude (Anthropic) alongside the real configuration work; every setting, command, and failure mode in it came out of our own fleet and was checked against vendor documentation. Errors are ours.

scripts/EnforcePortalAutofill.sh

A Mosyle Custom Command that auto-enables Company Portal's SSO and Autofill extensions for the signed-in user on every login. Both default to off on Company Portal install, both live behind System Settings → Extensions → Sharing & Actions, and users almost never toggle them on manually. This script does both, in the user's session context, at every sign-in.

Posture: polish, not prerequisite. Platform SSO + Entra join + sign-in has been observed to work smoothly on The Crossing's greenfield ADE devices (three intern Macs, 2026-05) without this script in place. Treat this as a quality-of-life / safety-net measure that aligns the user's System Settings panel with documented best-practice configuration, not as a PSSO blocker.

Upstream and license

This is a derivative work of Scott Kendall's Enforce Portal AutoFill.sh, part of the Microsoft-Platform-SSO repository. Scott himself describes the script as a "neat little trick" for the Autofill panel — same posture we've adopted here.

Scott's v1.0.0 → v1.0.3 is the helper itself. The Crossing's v2.0.0 adapts it for Mosyle (Scott's repo is Jamf-Pro-focused), adds soft-skip semantics appropriate for "every user sign-in" cadence, and bakes in lessons from prior Mosyle work (bash -c interpreter pinning, fd-split for the Custom Device Attribute, structured response format).

License: GPL-3.0-or-later, inherited from upstream, applied to the documentation here as well for consistency. See LICENSE.

The two extensions

Bundle ID	Purpose	Relationship to PSSO
com.microsoft.CompanyPortalMac.ssoextension	SSO extension	The user-session SSO extension the legacy "Extensible SSO" model used. Empirically not required for modern Platform SSO with Secure Enclave to function on greenfield ADE devices in our environment. Recommended on for documented-config alignment.
com.microsoft.CompanyPortalMac.Mac-Autofill-Extension	Autofill extension	Surfaces Microsoft work credentials into macOS / Safari autofill on Microsoft-authenticated sites and apps. Not a PSSO dependency in any model. UX improvement.

Files

File	Purpose
docs/platform-sso-mosyle-reference.md	Platform SSO configuration reference for Mosyle + Entra ID. Start here.
scripts/EnforcePortalAutofill.sh	The script Mosyle runs. Paste the contents into a Mosyle Custom Command.
docs/EnforcePortalAutofill_v2.0_history.html	Full session history / decisions / rationale for the script. Read this first before changing it.
LICENSE	GPLv3 license (inherited from upstream).

Quick deploy (Mosyle)

1. Custom Commands → Add new.
2. Paste the entire contents of EnforcePortalAutofill.sh into the Code tab.
3. Execution Settings:
   • Execute command: Only based on schedule or events
   • Event: ☑ Every user sign-in (leave the others unchecked)
4. (Optional) Make the command response a Custom Device Attribute. The script sends a single short summary line, e.g. result=ok;sso=ok;autofill=ok.
5. Target: the user groups that should have Company Portal extensions enforced. Start with a test ring before going fleet-wide.
6. The Company Portal install profile should target the same user groups so timing/scope match.

Response line format

One line, sent to Mosyle's captured stdout (fd 3 in the script). Format:

result=<ok|partial|skipped|fail>;sso=<ok|missing|fail>;autofill=<ok|missing|fail>[;reason=<short>]

Scenario	Response
Both extensions enabled	result=ok;sso=ok;autofill=ok
One extension not yet registered	result=partial;sso=ok;autofill=missing
Company Portal not installed	result=skipped;reason=app-not-installed
No console user at trigger time	result=skipped;reason=no-console-user
pluginkit -e use failed	result=fail;sso=fail;autofill=ok

Self-healing across sign-ins

If Company Portal isn't installed yet (separate Mosyle profile pushes it), or its extensions haven't registered with pluginkit yet (Company Portal must run once in the user session before they appear), the run is a no-op that exits 0 and retries on the next sign-in. Once both are enabled, subsequent runs are no-ops with a single "already enabled" log line per extension.

On-device log

Full per-run log: /var/log/PortalAutofill.log (root-readable). Each run appends a timestamped block; the response line is the last log entry.

Testing

Quickest sanity check on a Mac with Company Portal installed:

# Reset both extensions to disabled (as yourself, not sudo)
pluginkit -e ignore -i com.microsoft.CompanyPortalMac.ssoextension
pluginkit -e ignore -i com.microsoft.CompanyPortalMac.Mac-Autofill-Extension

# Run the way Mosyle will
sudo bash -c "$(cat EnforcePortalAutofill.sh)"

# Confirm both now show '+' (enabled)
pluginkit -m | grep -i companyportal

stdout should be exactly one short line. If you see lots of log lines on stdout, the fd-split is broken — see the HTML history doc for the underlying pattern.

Full four-layer testing progression (local bash -c simulation → forced- branch tests → Mosyle Self-Service dry-run → real login trigger on one device) is documented in the HTML history doc.

Related upstream work (not adopted here)

Scott's repo includes two other small scripts that may be useful future companions, but neither is adopted by The Crossing as of v2.0.0:

• Open System Setting SSO User.sh — two-line utility that opens System Settings to the current user's pane (useful for self-service "open the SSO repair screen" buttons).
• Verify Device Compliance via Extensible SSO and Platform SSO.sh — Jamf-specific (calls Jamf Conditional Access binaries directly); would need substantial rewriting for Mosyle.

Maintenance

Maintained by the IT team at The Crossing (Chesterfield, MO).

This documents a production configuration in one environment, published in the hope it's useful — not a supported product. Verify against current Apple, Microsoft, and Mosyle documentation before applying any of it to your own fleet. Corrections and additions welcome, particularly from other Mosyle shops.

Credits

• Upstream script (v1.0.0–v1.0.3): Scott Kendall, via the Microsoft-Platform-SSO repository.
• v2.0.0 Mosyle adaptation: Shawn Ross at The Crossing, with Claude Opus 4.7 (Claude Code) pair-programming, 2026-05-27 → 2026-05-28.
• Platform SSO reference doc: Shawn Ross at The Crossing, co-written with Claude (Anthropic), 2026-05 → 2026-08. Mosyle attribute-mapping workaround courtesy of Aaron Harvey (CITN); com.apple.PlatformSSO.AccountShortName surfaced by Josh Ricketts in MacAdmins Slack.
• License: GPL-3.0-or-later. See LICENSE.