How is authentication changing for single-user macOS computers?

Overview

Historically, MSU Denver-managed macOS computers were connected in some way to our university Microsoft accounts. The password for the local account on the Mac was synced to whatever password was being used for the associated MSU Denver email address. This caused some issues when staff and faculty were required to change their MSU Denver account password. They encountered problems getting the new password to sync properly with the local account on the computer.

With the release of macOS Tahoe (version 26.x.x) Apple released a new feature that allows your local macOS account to be linked to your MSU Denver email, but without requiring the password to be synced between them. This new framework is called Platform Single Sign-on (PSSO), and it allows you to maintain access to all your MSU Denver resources on your managed Mac by authenticating silently in the background using Microsoft's Company Portal application. All single-user macOS computers (i.e. you are the only user who signs into the computer) will be required to register for PSSO.

What does this mean?

This means once you have upgraded to macOS Tahoe, you will be prompted to register with Microsoft via PSSO, and once the registration process is successfully completed, you will be prompted to change the password for your computer. This new password will actually be a PIN that is at least 6 digits long and unique to your computer (i.e. it should not match the PIN you use to access any of your other devices). Once the registration is completed, your macOS account will no longer sync its password with your email address, and instead will always remain the unique-to-your-computer secure PIN that you created during the migration process.

This migration outlined below is a one time occurrence for macOS computers that have already been deployed. For newly provisioned and deployed computers this registration process will happen during the setup of the computer.

This new change will not affect any shared-use macOS computers on campus. For example, classroom lecterns, general and departmental computer labs, or shared student spaces (multi-user) will still require that you sign in using your MSU Denver email address and password. This new change will only affect the computers that faculty and staff were issued from ITS for use in their role at the University (single-user computers).

PLEASE NOTE: 

• Once you have completed the PSSO registration the password (PIN) that you set for your computer will never sync with your MSU Denver email account. Even if you call into Service Desk and have them reset your password, your macOS PIN will not be changed and you should continue to use it when signing into your assigned computer. These passwords are separate and different by design.
• If you need to change your PIN you can do so from System Settings>Touch ID & Password. This will not have any affect on your MSU Denver email account password.

Before you begin...

Your computer must be

• A macOS computer. For the Windows equivalent, see How is authentication changing for single-user Windows computers?
• Running macOS Tahoe (26.x.x) at a minimum.

Understand biometrics

• While PSSO registration is mandatory, the use of TouchID is optional but it is recommended that you set it up following registration. At a minimum, you will only be required to set up a PIN.
• MSU Denver and Apple can never retrieve your fingerprint. By design, this data is strictly kept on your device and is never transmitted to servers or across networks. For more information, see About Touch ID advanced security technology

Migration

Instructions

When the registration period is in effect, you will see a new pop-up notification informing you that registration is required. 

1. Click Continue to begin the registration. You may defer the registration during the optional enrollment period. Once the deadline 10/21/2026 passes the registration becomes mandatory. 
2. You will notice a smaller notification pop-up in the top left of your screen. This notification will automatically close once the registration process has completed successfully.

3. A new notification will present itself in the top right of your screen in the Notification Center with another pop-up in the center of the screen explaining to Click 'Register'. Click Register on the notification in the top right of your screen, the center pop-up will automatically close after clicking 'Register'. If you don't see the notification pop up after a few seconds, click the Calendar/Clock pill in the top right corner of your screen to check your notifications.

4. A new prompt will appear in the center of your screen, follow the steps to complete the registration
   1. Click Continue

2. Enter your password at the prompt. This is the current password you use to log in to your Mac.

3. Sign-in with your MSU Denver email address and password. This is the password you use to log in to web services on MSU Denver websites.

5. Registration has completed! Now you will be forced to change the password for your local macOS account and set a PIN instead. As outlined above, this PIN will be unique and used to sign in to YOUR COMPUTER ONLY. It will not be used anywhere else on campus, and will never sync with your MSU Denver email password. Click OK on the prompt.

1. Your computer will automatically go to the lock screen. Enter your current Mac password and sign-in. This is the password you normally use to log in to your Mac.

2. You will be prompted to set a PIN for your local macOS account. Please set a unique PIN that will not be forgotten. A 6-8 digit PIN is recommended, similar to your smart phone. Only numbers are allowed.

Video example

Result

You have now successfully registered your local macOS account with your MSU Denver Microsoft email address, and changed your password to a unique PIN that will only be used to log into this computer to meet the Secure Enclave PSSO standards.

You will find that when opening links to MSU Denver resources (Outlook, Canvas, Workday, etc...) in an Internet Browser (Safari, Chrome, Firefox) you will not need to enter your email address, password or even perform 2-step verification. Instead, the Company Portal app will automagically provide authentication from your local macOS account's PSSO registration. Additionally, desktop applications like Microsoft Office, Global Protect, Adobe, etc... no longer require authentication, they also will use the authentication token provided by Company Portal and your PSSO registration.