Configure device management profiles for Desktop Password Sync

Set up Desktop Password Sync and create managed profiles to enable the password sync workflow on your devices. You can use any device management solution that supports extensible SSO payload deployment with platform SSO authentication enabled. These instructions assume you're using Jamf Pro for device management.

Desktop Password Sync requires three types of payloads for full functionality:

  1. An extensible single sign-on profile deployed at the computer level.

  2. An AssociatedDomain payload. This can be within the same profile as the extensible single sign-on extension.

  3. A Okta Verify configurations for macOS devices that contains the org URL, username, client ID, and Platform SSO protocol version. The username and client ID are specific to Desktop Password Sync. Scope the username and client ID to the SSO extension domain only. Add a separate entry for each Okta preference domain.

You're asked to provide an org URL at several points during the setup process. For example, https://customerorg.okta.com. Use the same org URL wherever you're prompted to provide an org URL. If you have a custom domain configured, then use the custom domain URL.

If you have users on both macOS Ventura (13.0) and macOS Sonoma (14.0), configure two separate Desktop Password Sync instances.

Tasks

Create a single sign-on extension profile

The SSO extension extends to the macOS login window, which enables users to use their Okta credentials to unlock and sign in to their computer. The local account password is automatically kept in sync, so the local password and Okta password match. Create profiles in your device management software with the following parameters:

  • Payload type: SSO

  • Extension identifier: com.okta.mobile.auth-service-extension

  • Team identifier: B7F62B65BN

  • Sign-on type: Redirect

  • URLs: Add your Okta org URL with the path /device-access/api/v1/nonce and /oauth2/v1/token. See the following examples:

    • https://customerorg.okta.com/device-access/api/v1/nonce

    • https://customerorg.okta.com/oauth2/v1/token

  • Use Platform SSO: Enabled

  • Authentication method: Password

  • App Identifier: B7F62B65BN.com.okta.mobile.auth-service-extension

  • Associated Domain: Your org URL with authsrv: preceding the URL, for example, authsrv:customerorg.okta.com. For more information, review Apple's AssociatedDomains documentation.

  • Account Display Name: The display name for the account in notifications and authentication requests. This is set at a system level, and not at a user-specific level. Any value set here is shown to all users.

  • For orgs on macOS Sonoma using Platform SSO 2.0, set Use Shared Device Keys to Enabled.

Create a device management profile

A managed app configuration allows you to enable the functionality that's built into Okta Verify for macOS and Desktop Password Sync.

Create a Managed app configurations for macOS devices. In the new profile, create a separate payload entry for each Okta preference domain. You can use the same property list in both entries:

Preference Domain Example Comment
com.okta.mobile
Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
</dict>
</plist>

If this has already been configured for Okta Verify or Okta FastPass, you don't need to create it again. The same configuration can be used for Desktop Password Sync.

com.okta.mobile.auth-service-extension

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://replace-with-your-org-URL</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>replace-with-your-client-ID</string>
<key>PlatformSSO.ProtocolVersion</key>
<string>2.0</string>
</dict>
</plist>

Replace the strings for your org URL and client ID. Use the same org URL (https://customerorg.okta.com) throughout the Desktop Password Sync setup process. See Configure Desktop Password Sync for macOS for your client ID.

If your org is using macOS Ventura, set the PlatformSSO.ProtocolVersion to 1.0. For macOS Sonoma, set the PlatformSSO.ProtocolVersion to 2.0, as shown in the example.

$USERNAME is an optional value for OktaVerify.UserPrincipalName, which automatically populates the username in the Sign-In Widget. If a value isn't specified, users need to input their username when signing in.
com.apple.preference.security
Copy 
<plist version="1.0">
<dict>
<key>dontAllowPasswordResetUI</key>
<true/>
</dict>
</plist>

This profile disables the ability to change the local account password. Because the password is synced with Okta, the user shouldn't change the password locally. To change a password, users should change their Okta password and then sync it at the lock screen of the computer.

For more information, see Apple's SecurityPreferences documentation.

Distribute the profile to all computers in scope, or distribute to newly assigned devices only.

After creating and distributing the device management profile, your managed users can begin to sync their local macOS password with their Okta password. A system notification displays a message to users that registration is required to sync their local macOS password to their Okta password. Desktop Password Sync also sets up Okta FastPass as part of the enrollment process. Your users may already have Okta FastPass enabled. If biometrics for Okta FastPass are enabled, the Desktop Password Sync enrollment flow prompts users for Touch ID to successfully set up Okta FastPass.

MDM setup examples

Choose the appropriate format for your MDM and macOS version.

Generic MDM

macOS com.apple.com.associated-domain payload:

Copy 
<key>PayloadType</key>
<string>com.apple.associated-domains</string>
<key>Configuration</key>
<array>
<dict>
<key>ApplicationIdentifier</key>
<string>B7F62B65BN.com.okta.mobile.auth-service-extension</string>
<key>AssociatedDomains</key>
<array>
<string>authsrv:customerorg.okta.com</string>
</array>
</dict>
</array>

macOS Ventura com.apple.extensiblesso payload:

Copy 
<key>PayloadType</key>
<string>com.apple.extensiblesso</string>
<key>AuthenticationMethod</key>
<string>Password</string>
<key>ExtensionIdentifier</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>Hosts</key>
<array/>
<key>TeamIdentifier</key>
<string>B7F62B65BN</string>
<key>Type</key>
<string>Redirect</string>
<key>URLs</key>
<array>
<string>https://customerorg.okta.com/device-access/api/v1/nonce</string>
<string>https://customerorg.okta.com/oauth2/v1/token</string>
</array>

macOS Sonoma com.apple.extensiblesso payload:

Copy 
<key>PayloadType</key>
<string>com.apple.extensiblesso</string>
<key>PlatformSSO</key>
<dict>
    <key>AuthenticationMethod</key>
    <string>Password</string>
    <key>UseSharedDeviceKeys</key>
    <true/>
</dict>
<key>ExtensionIdentifier</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>Hosts</key>
<array/>
<key>TeamIdentifier</key>
<string>B7F62B65BN</string>
<key>Type</key>
<string>Redirect</string>
<key>URLs</key>
<array>
<string>https://customerorg.okta.com/device-access/api/v1/nonce</string>
<string>https://customerorg.okta.com/oauth2/v1/token</string>
</array>

com.okta.mobile payload:

Copy 
<key>PayloadType</key>
<string>com.okta.mobile</string>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.UserPrincipalName</key>
<string>username@domain.com</string>

macOS Ventura com.okta.mobile.auth-service-extension payload:

Copy 
<key>PayloadType</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>your-client-ID</string>
<key>OktaVerify.UserPrincipalName</key>
<string>username@domain.com</string>

macOS Sonoma com.okta.mobile.auth-service-extension payload:

Copy 
<key>PayloadType</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>your-client-ID</string>
<key>OktaVerify.UserPrincipalName</key>
<string>username@domain.com</string>
<key>PlatformSSO.ProtocolVersion</key>
<string>2.0</string>

com.apple.preference.security payload:

Copy 
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>dontAllowPasswordResetUI</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>com.customer-name.profiles.dontAllowPasswordResetUI</string>
            <key>PayloadType</key>
            <string>com.apple.preference.security</string>
            <key>PayloadUUID</key>
            <string>d99bb019-1010-447f-8fed-8f223cc56be3</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Restrict Local Password Reset for Okta's PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.restrictLocalPasswordReset</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>b44b6a04-6527-4333-1010-46422e8a5844</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Examples for Jamf Pro

com.okta.mobile Preference Domain:

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
</dict>
</plist>

macOS Ventura com.okta.mobile.auth-service-extension Preference Domain:

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://replace-with-your-org-URL</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>replace-with-your-client-ID</string>
</dict>
</plist>

macOS Sonoma com.okta.mobile.auth-service-extension Preference Domain:

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://replace-with-your-org-URL</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>replace-with-your-client-ID</string>
<key>PlatformSSO.ProtocolVersion</key>
<string>2.0</string>
</dict>
</plist>

com.apple.preference.security Preference Domain:

Copy 
<plist version="1.0">
   <dict>
    <key>dontAllowPasswordResetUI</key>
    <true/>
  </dict>
</plist>

Examples for Kandji

macOS Ventura Desktop Password Sync config:

Copy 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>Configuration</key>
            <array>
                <dict>
                    <key>ApplicationIdentifier</key>
                    <string>B7F62B65BN.com.okta.mobile.auth-service-extension</string>
                    <key>AssociatedDomains</key>
                    <array>
                        <!-- replace accuhive.okta.com with your tenant address -->
                        <string>authsrv:accuhive.okta.com</string>
                    </array>
                </dict>
            </array>
            <key>PayloadDisplayName</key>
            <string>Associated Domains for Okta Verify</string>
            <key>PayloadIdentifier</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.associated-domains</string>
            <key>PayloadUUID</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
        <dict>
            <key>AuthenticationMethod</key>
            <string>Password</string>
            <key>ExtensionIdentifier</key>
            <string>com.okta.mobile.auth-service-extension</string>
            <key>Hosts</key>
            <array/>
            <key>TeamIdentifier</key>
            <string>B7F62B65BN</string>
            <key>Type</key>
            <string>Redirect</string>
            <key>URLs</key>
            <array>
                <!-- replace accuhive.okta.com with your tenant address -->
                <string>https://accuhive.okta.com/device-access/api/v1/nonce</string>
                <string>https://accuhive.okta.com/oauth2/v1/token</string>
            </array>
            <key>PayloadDisplayName</key>
            <string>Okta Verify Sign-On Extensions Payload</string>
            <key>PayloadIdentifier</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.extensiblesso</string>
            <key>PayloadUUID</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Okta PSSO extension configuration</string>
    <key>PayloadDisplayName</key>
    <string>Okta PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.profiles.ssoextension</string>
    <key>PayloadOrganization</key>
    <string>CUSTOMER NAME</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>D78FE406-0C61-4007-8C51-FFA5FDE5F54B</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

macOS Sonoma Desktop Password Sync config:

Copy 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>Configuration</key>
            <array>
                <dict>
                    <key>ApplicationIdentifier</key>
                    <string>B7F62B65BN.com.okta.mobile.auth-service-extension</string>
                    <key>AssociatedDomains</key>
                    <array>
                        <!-- replace accuhive.okta.com with your tenant address -->
                        <string>authsrv:accuhive.okta.com</string>
                    </array>
                </dict>
            </array>
            <key>PayloadDisplayName</key>
            <string>Associated Domains for Okta Verify</string>
            <key>PayloadIdentifier</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.associated-domains</string>
            <key>PayloadUUID</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
        <dict>
            <key>PlatformSSO</key>
            <dict>
                <key>AuthenticationMethod</key>
                <string>Password</string>
                <key>UseSharedDeviceKeys</key>
                <true/>
            </dict>
            <key>ExtensionIdentifier</key>
            <string>com.okta.mobile.auth-service-extension</string>
            <key>Hosts</key>
            <array/>
            <key>TeamIdentifier</key>
            <string>B7F62B65BN</string>
            <key>Type</key>
            <string>Redirect</string>
            <key>URLs</key>
            <array>
                <!-- replace accuhive.okta.com with your tenant address -->
                <string>https://accuhive.okta.com/device-access/api/v1/nonce</string>
                <string>https://accuhive.okta.com/oauth2/v1/token</string>
            </array>
            <key>PayloadDisplayName</key>
            <string>Okta Verify Sign-On Extensions Payload</string>
            <key>PayloadIdentifier</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.extensiblesso</string>
            <key>PayloadUUID</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Okta PSSO extension configuration</string>
    <key>PayloadDisplayName</key>
    <string>Okta PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.profiles.ssoextension</string>
    <key>PayloadOrganization</key>
    <string>CUSTOMER NAME</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>D78FE406-0C61-4007-8C51-FFA5FDE5F54B</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Okta Verify config. Note the PlatformSSO.ProtocolVersion key. The string should be 2.0 if you're using Platform SSO 2.0. Set it to 1.0 if you're using macOS Ventura or remaining on Platform SSO 1.0:

Copy 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <!-- replace accuhive.okta.com with your tenant -->
            <key>OktaVerify.OrgUrl</key>
            <string>https://accuhive.okta.com</string>
            <!-- replace YOUR_CLIENT_ID with your Desktop Password Sync app Client ID -->
            <key>OktaVerify.PasswordSyncClientID</key>
            <string>YOUR_CLIENT_ID</string>
            <key>PlatformSSO.ProtocolVersion</key>
            <string>2.0</string>
            <!-- optional keys-->
            <key>OktaVerify.EnrollmentOptions</key>
            <string>SilentEnrollmentEnabled</string>
            <key>OktaVerify.ReportDiagnostics</key>
            <true/>
            <key>OktaVerify.UserPrincipalName</key>
            <string>username@domain.com</string>
            <!-- optional keys-->
            <key>PayloadDescription</key>
            <string>Configures Okta Verify settings</string>
            <key>PayloadDisplayName</key>
            <string>Okta Verify configuration</string>
            <key>PayloadIdentifier</key>
            <string>DEB5863A-E503-468C-A3DE-D90479F1E10A</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.okta.mobile</string>
            <key>PayloadUUID</key>
            <string>1D89FEA8-BAFE-42F5-9393-634BE23009D8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
        <dict>
            <!-- replace accuhive.okta.com with your tenant -->
            <key>OktaVerify.OrgUrl</key>
            <string>https://accuhive.okta.com</string>
            <!-- replace YOUR_CLIENT_ID with your Desktop Password Sync app Client ID -->
            <key>OktaVerify.PasswordSyncClientID</key>
            <string>YOUR_CLIENT_ID</string>
            <!-- optional keys-->
            <key>OktaVerify.EnrollmentOptions</key>
            <string>SilentEnrollmentEnabled</string>
            <key>OktaVerify.ReportDiagnostics</key>
            <true/>
            <key>OktaVerify.UserPrincipalName</key>
            <string>username@domain.com</string>
            <!-- optional keys-->
            <key>PayloadDescription</key>
            <string>Configures Okta Verify settings</string>
            <key>PayloadDisplayName</key>
            <string>Okta Verify (auth service) configuration</string>
            <key>PayloadIdentifier</key>
            <string>E5F1356E-3B04-43F7-8E8C-2213F7D74B13</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.okta.mobile.auth-service-extension</string>
            <key>PayloadUUID</key>
            <string>6764E8E4-0A37-4206-96E2-A73B2DFA5673</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Configures settings</string>
    <key>PayloadDisplayName</key>
    <string>Okta Verify Configuration</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.profiles.oktaverify</string>
    <key>PayloadOrganization</key>
    <string>CUSTOMER NAME</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>9A641D93-471C-44D7-8B54-264E842A12C8</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

com.apple.preference.security config:

Copy 
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>dontAllowPasswordResetUI</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>com.customer-name.profiles.dontAllowPasswordResetUI</string>
            <key>PayloadType</key>
            <string>com.apple.preference.security</string>
            <key>PayloadUUID</key>
            <string>d99bb019-1010-447f-8fed-8f223cc56be3</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Restrict Local Password Reset for Okta's PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.restrictLocalPasswordReset</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>b44b6a04-6527-4333-1010-46422e8a5844</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Next steps

Support your Desktop Password Sync users