Daily.Entra.News
Aboutmerill.net
← Previous week
Next week →
Week in brief

macOS Platform SSO troubleshooting is the week’s clearest admin-impact item; most other changes are documentation guidance

For the week of 11 August 2025, the supplied record is dominated by Microsoft Learn maintenance: 28 updates, five new records, two removed records, and no Message Center items. The strongest operational signal is updated macOS Platform SSO guidance documenting a macOS 15+ concurrency issue that can corrupt device configuration and trigger unexpected re-registration prompts. New Workday and SuccessFactors expression-mapping references, refreshed native-authentication setup material, and more specific security and governance guidance are the other meaningful exceptions. Nothing supplied establishes a preview, general availability, tenant-wide behavior change, or confirmed retirement. The two removed Zero Trust entries are paired with same-day new entries bearing identical titles, so they do not by themselves prove retirement.

  • Entra ID · Troubleshooting
    macOS Platform SSO documents a macOS 15+ concurrency failure mode

    The updated Microsoft Entra ID troubleshooting content says simultaneous updates from the macOS AppSSOAgent and AppSSODaemon can corrupt the PSSO device configuration. macOS may then start its re-registration remediation flow, producing unexpected registration prompts. Related material covers integrating PSSO with an MDM solution. This is troubleshooting and integration guidance—not evidence of a new PSSO launch or a behavior change introduced this week.

  • Entra ID · Provisioning
    Provisioning references for Workday and SuccessFactors were added

    Two new Microsoft Entra ID pages document commonly used expression-mapping functions: Workday mappings to on-premises Active Directory or Microsoft Entra ID, and SuccessFactors mappings to Microsoft Entra ID. The existing Workday guide was also updated with an organizational-unit assignment section. These additions expand the implementation reference material; they do not establish that new connector functions or runtime behavior were introduced.

  • External ID · Authentication
    Native authentication setup content was refreshed for Entra ID and External ID

    The Entra ID React single-page-app tutorial now includes the terminal command for installing the native-authentication JavaScript SDK. The Microsoft Entra External ID page covers native-authentication setup and user-interface customization for mobile and desktop applications. The supplied evidence gives no preview or general-availability status and does not show a change to service availability.

  • Global Secure Access · Security
    Security pages add protection checks and TLS configuration details

    The Entra ID Identifier URI Restrictions update links administrators to a way to check whether the protection is enabled. The Domain Services TLS Enforcement update includes interface guidance for enabling TLS 1.2 Only Mode, and the Global Secure Access Transport Layer Security page includes an OpenSSL certificate-generation example. These are security documentation updates; the evidence does not say that protections were automatically enabled or that enforcement requirements changed.

  • ID Governance · Governance
    PIM approval guidance and Lifecycle Workflows syntax were clarified

    Updated Microsoft Entra ID Governance guidance recommends approval for eligible role activation, at least one approver and preferably two; when no specific approvers are selected, active Privileged Role Administrators and Global Administrators become the default approvers. The Logic App Lifecycle Workflows update calls out the slash required after the tenant ID in the Issuer value. These are documented recommendations and configuration details, not evidence that existing PIM defaults changed.

For Entra administrators

PSSO administrators supporting macOS 15+ should review the troubleshooting guidance, particularly when users encounter unexpected re-registration prompts. Provisioning and application teams can use the updated mapping and native-authentication documentation for implementation work, while relevant security and governance owners can verify settings or syntax. The evidence does not support a broad tenant change or immediate rollout based on this period alone.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.

Updates this week

Authentication

6

Macos Psso

Updated

macOS Platform Single Sign-on (PSSO) is a new feature powered by Microsoft’s Enterprise SSO plug-in, Platform Credentials for macOS that enables users to sign in to Mac devices using their Microsoft Entra ID credentials. This feature provides benefits for admins by simplifying the sign-in process for users and reducing the number of passwords they need to remember. It also allows users to authenticate with Microsoft Entra ID with a smart card or hardware-bound key. This feature improves the end-user experience by not having to remember two separate passwords and diminishes the need for admins to manage the local account password.

14 August 2025

Integrate macOS Platform Single Sign-On (PSSO) into your MDM solution

Updated

Platform Single Sign-On (PSSO) for macOS devices is a feature that allows users to sign in to macOS devices using their Microsoft Entra credentials. This feature provides a seamless sign-in experience for users and helps organizations manage access to resources on macOS devices.

14 August 2025

Fundamentals

6

Agents

Updated

author: MicrosoftGuyJFlo

13 August 2025

General

6

Domain Services Tls Enforcement

Updated

:::image type="content" border="true" source="media/reference-domain-services-tls-enforcement/enable.png" alt-text="Screenshot that shows how to enable TLS 1.2 Only Mode for Domain Services.":::

16 August 2025

Group Source Of Authority Configure

Updated

The following table explains the status for *isCloudManaged* and *onPremisesSyncEnabled* attributes after you convert the SOA of an object.

12 August 2025

Provisioning

4

Workday expression mapping functions for Microsoft Entra ID provisioning

New

A comprehensive guide to commonly used expression mapping functions when configuring Workday to on-premises Active Directory/Microsoft Entra ID user provisioning. These functions help transform and map data from Workday to create appropriate user attributes in Microsoft Entra ID.

13 August 2025

Developer

1

Security

1

Identifier Uri Restrictions

Updated

[Learn how to check if the protection has been enabled in your organization](https://aka.ms/check-identifier-uri-protection-state)

13 August 2025

Standards

1

Saml Tokens

Updated

> |Name | `unique_name` |Provides a human readable value that identifies the subject of the token. This value is not guaranteed to be unique within a tenant and is designed to be used only for display purposes. | `<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">`<br>`<AttributeValue>[email protected]<AttributeValue>`|

13 August 2025

Troubleshooting

1

Troubleshoot Macos Platform Single Sign On Extension

Updated

There's a known concurrency issue on macOS 15+ (Sequoia) that can cause the PSSO device configuration to become corrupted. The device configuration can be corrupted by simultaneous updates from the system AppSSOAgent and AppSSODaemon processes. The corrupted configuration causes the operating system to trigger its re-registration remediation flow, resulting in unexpected registration prompts for users.

14 August 2025

Governance

4

Pim How To Change Default Settings

Updated

We recommend requiring approval for activation of an eligible assignment. The approver doesn't have to have any roles. When you use this option, select at least one approver. We recommend that you select at least two approvers. If no specific approvers are selected, active Privileged Role Administrators/Global Administrators become the default approvers.

14 August 2025

Authentication

1

Native authentication

Updated

Learn how to set up native authentication in Microsoft Entra External ID. Customize the user interface for mobile and desktop apps, and provide a seamless sign-in experience.

13 August 2025

General

2

Developer

1

Application Discovery

Updated

Use Application discovery to detect the applications accessed by users and create separate private applications.

13 August 2025

Security

1

Transport Layer Security

Updated

```openssl req -x509 -new -nodes -newkey rsa:4096 -keyout rootCAchain.key -sha256 -days 370 -out rootCAchain.pem -subj "/C=US/ST=US/O=Self Signed/CN=Self Signed Root CA" -config openssl.cnf -extensions rootCA_ext```

13 August 2025