Help, there’s a Mac on my network (4): two passwords, one user

Episode 4 of the series Help, there’s a Mac on my network.

What happened

It was Monday morning and the password policy had struck again. A new Microsoft 365 password every 90 days, the way Ruud set it up years ago, back when that was considered sensible. Marieke dutifully picked a new password on her phone. Then she opened her MacBook Air.

“Ruud, it won’t take my password.”

Ruud put down his mug, the one that says “Have you tried turning it off and on again?”, and walked over to her office. The Mac only accepted the old password. The new one? The password field shook its head at him.

“That’s odd,” said Ruud. “On Windows you just sign in with your work account.” He thought for a moment and fixed it the way he knew best: he used the admin account to reset the password on Marieke’s Mac account to her new Microsoft password. One password, done.

Not done. After she logged in, a window popped up: an app wanted to use the keychain and asked for the password. Marieke typed the new one. Wrong. The old one. Correct. Two minutes later something else wanted the keychain. Meanwhile Outlook said she had to sign in again, and Teams joined in out of solidarity.

“I now have three passwords,” said Marieke. “I’m fairly sure I had one yesterday.”

Sam walked past with a cup of tea, looked over Ruud’s shoulder and said: “Mind if I have a go?”

What’s really going on

On a Windows laptop joined to Entra ID, you are your work account the moment you sign in. There is one identity. On Marieke’s Mac there are two, and they know nothing about each other.

• The local macOS account. The account Marieke created herself when she unboxed the Mac. Its password does three jobs at once: signing in, unlocking the disk (FileVault uses the local password as its key) and opening the login keychain.
• Her Entra ID identity. Her Microsoft 365 account. That’s what she uses in Outlook, Teams and the browser.

Without extra configuration the two live separate lives. Change the Microsoft password and the Mac has no idea. A password change does invalidate the old sign-in tokens, though, so Outlook and Teams ask you to sign in again. That’s normal and it’s a one-off.

The keychain problem was Ruud’s own doing, with the best of intentions. When you change your password in System Settings, and therefore know the old one, macOS updates the login keychain along with it. When an admin resets the password, that doesn’t happen. The keychain stays locked with the old password, and every app that wants to look inside asks for it.

Platform SSO: one identity on the Mac

Microsoft and Apple have a proper fix for this: Platform SSO. It’s part of the Microsoft Enterprise SSO plug-in, which ships with the Company Portal app. You configure it with an Intune settings catalog policy. There are three methods:

• Password (password sync). The Entra ID password replaces the local password and the two stay in sync. Change it in Microsoft 365 and the Mac asks for the new one within a few hours. After that you’re back to one. This is closest to what Windows users are used to.
• Secure Enclave key. Microsoft’s recommendation. The Mac creates a key in its security chip, comparable to Windows Hello for Business. Signing in to Microsoft services then works without a password and is phishing resistant. The local password does stay, and doesn’t change along: it’s the password for your Mac and FileVault, no longer for Microsoft.
• Smart card. Sign in with a smart card or a compatible hardware key and a PIN. Most small businesses won’t need it.

With all three, Touch ID works for unlocking. Only after a restart do you type the password once, because FileVault needs it to open the disk.

How to fix it

Today: get the keychain back in line

1. Log out and back in with the new password. If macOS notices the keychain has a different password, you get a prompt with the option to update the keychain password (“Update Keychain Password”).
2. Choose update and enter the old password. From then on the keychain opens with the new one.
3. Old password truly gone? Then you can create a new keychain. You lose what was saved in the old local keychain, but nothing in iCloud Keychain.
4. Let Outlook and Teams sign in once more. After that it goes quiet.

Lesson for next time: let users change their own password in System Settings > Users & Groups. An admin reset is for when someone has genuinely forgotten it.

For good: roll out Platform SSO

1. Make sure the Mac is in Intune, ideally through Apple Business and automated device enrollment.
2. Deploy Company Portal as a required app. It contains the SSO extension.
3. Create a settings catalog policy in Intune: Authentication > Extensible Single Sign On (SSO). Under Platform SSO pick the method (Password, UserSecureEnclaveKey or SmartCard) and copy the remaining values from the Microsoft Learn guide.
4. Assign it to a user group. The user gets a “Registration required” notification, signs in with their work account, completes MFA and confirms with their Mac password. The Mac is then Entra joined.
5. Check in Terminal with app-sso platform -s that registration succeeded.

If you go with password sync, make sure the local password policy in Intune isn’t stricter than the one in Entra ID, or syncing fails. And while we’re at it: Microsoft itself advises against periodic password expiry. A strong password with MFA beats “Spring2026!” followed three months later by “Summer2026!”.

Sam had the keychain updated within a minute. “My last internship had Platform SSO,” he said. “Nobody there even remembered the Mac had its own password.” Ruud muttered that in Windows this was just under Accounts, and wrote “Platform SSO” on a sticky note.

Ruud’s lesson

A Mac has its own memory of who you are, and it won’t forget that just because Microsoft says otherwise. You can keep the two in step by hand, or you can let Platform SSO do it. From now on Ruud picks the second option. The sticky note hangs next to his Windows 2000 certificate.

Further reading: Apple Business, Entra ID and Intune for small businesses, Outlook, Teams and Microsoft 365 on the Mac and Passwords from Google to Apple.

This is episode 4 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.