Configure device management profiles

Set up Desktop Password Sync for macOS and create managed profiles to enable the password sync workflow on your devices. You can use any device management solution that supports extensible single sign-on (SSO) payload deployment with Platform SSO authentication enabled. These instructions assume you're using Jamf Pro for device management.

Desktop Password Sync for macOS requires three types of payloads for full functionality:

  1. An extensible single sign-on profile deployed at the computer level.

  2. An associated domain payload. This can be within the same profile as the extensible single sign-on extension.

  3. A Okta Verify configurations for macOS devices that contains the org URL, username, client ID, and Platform SSO protocol version. The username and client ID are specific to Desktop Password Sync. Scope the username and client ID to the SSO extension domain only. Add a separate entry for each Okta preference domain.

During the setup process, Okta asks you to provide an org URL, for example, https://customerorg.okta.com. Use the same org URL each time. If you have configured a custom domain, then use the custom domain URL.

If you have users on both macOS 13 Ventura and macOS 14 Sonoma, configure two separate Desktop Password Sync instances.

Tasks

Create a single sign-on extension profile

The SSO extension extends to the macOS login window. This enables users to use their Okta credentials to unlock and sign in to their computer. The local account password is kept in sync automatically, so the local password and Okta password match.

Create profiles in your device management software with the following parameters:

Parameter

 Input value

Payload type

SSO

Extension identifier

com.okta.mobile.auth-service-extension

Team identifier

B7F62B65BN

Sign-on type

Redirect

URLs

Add your Okta org URL, including the path /device-access/api/v1/nonce and /oauth2/v1/token.

For example:

  • https://customerorg.okta.com/device-access/api/v1/nonce

  • https://customerorg.okta.com/oauth2/v1/token

Use Platform SSO

Enabled

Authentication method

Password

App Identifiers

B7F62B65BN.com.okta.mobile.auth-service-extension

For macOS 15 Sequoia or later, you need two entries. Add an associated domain entry for the following app identifier:

B7F62B65BN.com.okta.mobile

Associated Domain

Enter your org URL with authsrv: preceding the URL.

For example, authsrv:customerorg.okta.com.

See Apple Associated Domains documentation.

Account Display Name

The display name for the account in notifications and authentication requests.

This is set at a system level, and not at a user-specific level. This value is visible to all users.

Use Shared Device Keys

For orgs on macOS 14 Sonoma using Platform SSO 2.0, set to Enabled.

Create a device management profile

A managed app configuration allows you to enable the functionality that's built into Okta Verify for macOS and Desktop Password Sync.

Create a Managed app configurations for macOS devices. In the new profile, create a separate payload entry for each Okta preference domain. You can use the same property list in both entries:

Preference Domain Example Comment

com.okta.mobile

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
</dict>
</plist>

If this has already been configured for Okta Verify or Okta FastPass, you don't need to recreate it.

You can use the same configuration for Desktop Password Sync.

com.okta.mobile.auth-service-extension

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://replace-with-your-org-URL</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>replace-with-your-client-ID</string>
<key>PlatformSSO.ProtocolVersion</key>
<string>2.0</string>
</dict>
</plist>

Replace the strings for your org URL and client ID. Use the same org URL (https://customerorg.okta.com) throughout the Desktop Password Sync setup process. See Desktop Password Sync for macOS for your client ID.

Set the PlatformSSO.ProtocolVersion to the appropriate version for your org:

  • For macOS 13 Ventura, set to 1.0.

  • For macOS 14 Sonoma or later, set to 2.0.

$USERNAME is an optional value for OktaVerify.UserPrincipalName, which automatically populates the username in the Sign-In Widget. If a value isn't specified, users need to input their username when signing in.

com.apple.preference.security

Copy 
<plist version="1.0">
<dict>
<key>dontAllowPasswordResetUI</key>
<true/>
</dict>
</plist>

This profile disables the ability to change the local account password.

As the password is synced with Okta, the user shouldn't change the password locally. To change a password, users should change their Okta password and then sync it at the lock screen of the computer.

See Apple Security Preferences documentation.

Distribute the profile to all computers in scope, or distribute to newly assigned devices only.

After creating and distributing the device management profile, your managed users can sync their local macOS password with their Okta password. A system notification displays a message to users that registration is required to sync the two passwords.

Desktop Password Sync also sets up Okta FastPass as part of the enrollment process. Your users may already have Okta FastPass enabled. If biometrics for Okta FastPass are enabled, the Desktop Password Sync enrollment flow prompts users for Touch ID to successfully set up Okta FastPass.

MDM setup examples

Choose the appropriate format for your MDM and macOS version.

Generic MDM

macOS com.apple.com.associated-domain payload:

Copy 
<key>PayloadType</key>
<string>com.apple.associated-domains</string>
<key>Configuration</key>
<array>
<dict>
<key>ApplicationIdentifier</key>
<string>B7F62B65BN.com.okta.mobile.auth-service-extension</string>
<key>AssociatedDomains</key>
<array>
<string>authsrv:customerorg.okta.com</string>
</array>
</dict>
</array>

macOS 13 Ventura com.apple.extensiblesso payload:

Copy 
<key>PayloadType</key>
<string>com.apple.extensiblesso</string>
<key>AuthenticationMethod</key>
<string>Password</string>
<key>ExtensionIdentifier</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>Hosts</key>
<array/>
<key>TeamIdentifier</key>
<string>B7F62B65BN</string>
<key>Type</key>
<string>Redirect</string>
<key>URLs</key>
<array>
<string>https://customerorg.okta.com/device-access/api/v1/nonce</string>
<string>https://customerorg.okta.com/oauth2/v1/token</string>
</array>

macOS 14 Sonoma com.apple.extensiblesso payload:

Copy 
<key>PayloadType</key>
<string>com.apple.extensiblesso</string>
<key>PlatformSSO</key>
<dict>
    <key>AuthenticationMethod</key>
    <string>Password</string>
    <key>UseSharedDeviceKeys</key>
    <true/>
</dict>
<key>ExtensionIdentifier</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>Hosts</key>
<array/>
<key>TeamIdentifier</key>
<string>B7F62B65BN</string>
<key>Type</key>
<string>Redirect</string>
<key>URLs</key>
<array>
<string>https://customerorg.okta.com/device-access/api/v1/nonce</string>
<string>https://customerorg.okta.com/oauth2/v1/token</string>
</array>

com.okta.mobile payload:

Copy 
<key>PayloadType</key>
<string>com.okta.mobile</string>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.UserPrincipalName</key>
<string>username@domain.com</string>

macOS 13 Ventura com.okta.mobile.auth-service-extension payload:

Copy 
<key>PayloadType</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>your-client-ID</string>
<key>OktaVerify.UserPrincipalName</key>
<string>username@domain.com</string>

macOS 14 Sonoma com.okta.mobile.auth-service-extension payload:

Copy 
<key>PayloadType</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>your-client-ID</string>
<key>OktaVerify.UserPrincipalName</key>
<string>username@domain.com</string>
<key>PlatformSSO.ProtocolVersion</key>
<string>2.0</string>

com.apple.preference.security payload:

Copy 
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>dontAllowPasswordResetUI</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>com.customer-name.profiles.dontAllowPasswordResetUI</string>
            <key>PayloadType</key>
            <string>com.apple.preference.security</string>
            <key>PayloadUUID</key>
            <string>d99bb019-1010-447f-8fed-8f223cc56be3</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Restrict Local Password Reset for Okta's PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.restrictLocalPasswordReset</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>b44b6a04-6527-4333-1010-46422e8a5844</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Examples for Jamf Pro

com.okta.mobile Preference Domain:

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://customerorg.okta.com</string>
</dict>
</plist>

macOS 13 Ventura com.okta.mobile.auth-service-extension Preference Domain:

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://replace-with-your-org-URL</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>replace-with-your-client-ID</string>
</dict>
</plist>

macOS 14 Sonoma com.okta.mobile.auth-service-extension Preference Domain:

Copy 
<plist version="1.0">
<dict>
<key>OktaVerify.OrgUrl</key>
<string>https://replace-with-your-org-URL</string>
<key>OktaVerify.UserPrincipalName</key>
<string>$USERNAME</string>
<key>OktaVerify.PasswordSyncClientID</key>
<string>replace-with-your-client-ID</string>
<key>PlatformSSO.ProtocolVersion</key>
<string>2.0</string>
</dict>
</plist>

com.apple.preference.security Preference Domain:

Copy 
<plist version="1.0">
   <dict>
    <key>dontAllowPasswordResetUI</key>
    <true/>
  </dict>
</plist>

Examples for Kandji

macOS 13 Ventura Desktop Password Sync config:

Copy 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>Configuration</key>
            <array>
                <dict>
                    <key>ApplicationIdentifier</key>
                    <string>B7F62B65BN.com.okta.mobile.auth-service-extension</string>
                    <key>AssociatedDomains</key>
                    <array>
                        <!-- replace accuhive.okta.com with your tenant address -->
                        <string>authsrv:accuhive.okta.com</string>
                    </array>
                </dict>
            </array>
            <key>PayloadDisplayName</key>
            <string>Associated Domains for Okta Verify</string>
            <key>PayloadIdentifier</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.associated-domains</string>
            <key>PayloadUUID</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
        <dict>
            <key>AuthenticationMethod</key>
            <string>Password</string>
            <key>ExtensionIdentifier</key>
            <string>com.okta.mobile.auth-service-extension</string>
            <key>Hosts</key>
            <array/>
            <key>TeamIdentifier</key>
            <string>B7F62B65BN</string>
            <key>Type</key>
            <string>Redirect</string>
            <key>URLs</key>
            <array>
                <!-- replace accuhive.okta.com with your tenant address -->
                <string>https://accuhive.okta.com/device-access/api/v1/nonce</string>
                <string>https://accuhive.okta.com/oauth2/v1/token</string>
            </array>
            <key>PayloadDisplayName</key>
            <string>Okta Verify Sign-On Extensions Payload</string>
            <key>PayloadIdentifier</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.extensiblesso</string>
            <key>PayloadUUID</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Okta PSSO extension configuration</string>
    <key>PayloadDisplayName</key>
    <string>Okta PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.profiles.ssoextension</string>
    <key>PayloadOrganization</key>
    <string>CUSTOMER NAME</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>D78FE406-0C61-4007-8C51-FFA5FDE5F54B</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

macOS 14 Sonoma Desktop Password Sync config:

Copy 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>Configuration</key>
            <array>
                <dict>
                    <key>ApplicationIdentifier</key>
                    <string>B7F62B65BN.com.okta.mobile.auth-service-extension</string>
                    <key>AssociatedDomains</key>
                    <array>
                        <!-- replace accuhive.okta.com with your tenant address -->
                        <string>authsrv:accuhive.okta.com</string>
                    </array>
                </dict>
            </array>
            <key>PayloadDisplayName</key>
            <string>Associated Domains for Okta Verify</string>
            <key>PayloadIdentifier</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.associated-domains</string>
            <key>PayloadUUID</key>
            <string>F65C9B21-13AD-4F46-86E5-C3352E7D97B6</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
        <dict>
            <key>PlatformSSO</key>
            <dict>
                <key>AuthenticationMethod</key>
                <string>Password</string>
                <key>UseSharedDeviceKeys</key>
                <true/>
            </dict>
            <key>ExtensionIdentifier</key>
            <string>com.okta.mobile.auth-service-extension</string>
            <key>Hosts</key>
            <array/>
            <key>TeamIdentifier</key>
            <string>B7F62B65BN</string>
            <key>Type</key>
            <string>Redirect</string>
            <key>URLs</key>
            <array>
                <!-- replace accuhive.okta.com with your tenant address -->
                <string>https://accuhive.okta.com/device-access/api/v1/nonce</string>
                <string>https://accuhive.okta.com/oauth2/v1/token</string>
            </array>
            <key>PayloadDisplayName</key>
            <string>Okta Verify Sign-On Extensions Payload</string>
            <key>PayloadIdentifier</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.apple.extensiblesso</string>
            <key>PayloadUUID</key>
            <string>77058B08-6943-4DEC-899A-721F55B4EEE8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Okta PSSO extension configuration</string>
    <key>PayloadDisplayName</key>
    <string>Okta PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.profiles.ssoextension</string>
    <key>PayloadOrganization</key>
    <string>CUSTOMER NAME</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>D78FE406-0C61-4007-8C51-FFA5FDE5F54B</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Okta Verify config.

Note the PlatformSSO.ProtocolVersion key. If you're using Platform SSO 2.0, set the string value to 2.0. If you're using macOS 13 Ventura, or if you plan to stay on Platform SSO 1.0, set the value to 1.0.

Copy 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <!-- replace accuhive.okta.com with your tenant -->
            <key>OktaVerify.OrgUrl</key>
            <string>https://accuhive.okta.com</string>
            <!-- replace YOUR_CLIENT_ID with your Desktop Password Sync app Client ID -->
            <key>OktaVerify.PasswordSyncClientID</key>
            <string>YOUR_CLIENT_ID</string>
            <key>PlatformSSO.ProtocolVersion</key>
            <string>2.0</string>
            <!-- optional keys-->
            <key>OktaVerify.EnrollmentOptions</key>
            <string>SilentEnrollmentEnabled</string>
            <key>OktaVerify.ReportDiagnostics</key>
            <true/>
            <key>OktaVerify.UserPrincipalName</key>
            <string>username@domain.com</string>
            <!-- optional keys-->
            <key>PayloadDescription</key>
            <string>Configures Okta Verify settings</string>
            <key>PayloadDisplayName</key>
            <string>Okta Verify configuration</string>
            <key>PayloadIdentifier</key>
            <string>DEB5863A-E503-468C-A3DE-D90479F1E10A</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.okta.mobile</string>
            <key>PayloadUUID</key>
            <string>1D89FEA8-BAFE-42F5-9393-634BE23009D8</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
        <dict>
            <!-- replace accuhive.okta.com with your tenant -->
            <key>OktaVerify.OrgUrl</key>
            <string>https://accuhive.okta.com</string>
            <!-- replace YOUR_CLIENT_ID with your Desktop Password Sync app Client ID -->
            <key>OktaVerify.PasswordSyncClientID</key>
            <string>YOUR_CLIENT_ID</string>
            <!-- optional keys-->
            <key>OktaVerify.EnrollmentOptions</key>
            <string>SilentEnrollmentEnabled</string>
            <key>OktaVerify.ReportDiagnostics</key>
            <true/>
            <key>OktaVerify.UserPrincipalName</key>
            <string>username@domain.com</string>
            <!-- optional keys-->
            <key>PayloadDescription</key>
            <string>Configures Okta Verify settings</string>
            <key>PayloadDisplayName</key>
            <string>Okta Verify (auth service) configuration</string>
            <key>PayloadIdentifier</key>
            <string>E5F1356E-3B04-43F7-8E8C-2213F7D74B13</string>
            <key>PayloadOrganization</key>
            <string>CUSTOMER NAME</string>
            <key>PayloadType</key>
            <string>com.okta.mobile.auth-service-extension</string>
            <key>PayloadUUID</key>
            <string>6764E8E4-0A37-4206-96E2-A73B2DFA5673</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDescription</key>
    <string>Configures settings</string>
    <key>PayloadDisplayName</key>
    <string>Okta Verify Configuration</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.profiles.oktaverify</string>
    <key>PayloadOrganization</key>
    <string>CUSTOMER NAME</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>9A641D93-471C-44D7-8B54-264E842A12C8</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

com.apple.preference.security config:

Copy 
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>dontAllowPasswordResetUI</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>com.customer-name.profiles.dontAllowPasswordResetUI</string>
            <key>PayloadType</key>
            <string>com.apple.preference.security</string>
            <key>PayloadUUID</key>
            <string>d99bb019-1010-447f-8fed-8f223cc56be3</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Restrict Local Password Reset for Okta's PSSO extension</string>
    <key>PayloadIdentifier</key>
    <string>com.customer-name.restrictLocalPasswordReset</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>b44b6a04-6527-4333-1010-46422e8a5844</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Next steps

Support your macOS users