How is authentication changing for single-user macOS computers?

Overview

Historically, MSU Denver-managed macOS computers were connected in some way to our university Microsoft accounts. The password for the local account on the Mac was synced to whatever password was being used for the associated MSU Denver email address. This caused some issues when staff and faculty were required to change their MSU Denver account password. They encountered problems getting the new password to sync properly with the local account on the computer.

With the release of macOS Tahoe (version 26.x.x) Apple released a new feature that allows your local macOS account to be linked to your MSU Denver email, but without requiring the password to be synced between them. This new framework is called Platform Single Sign-on (PSSO), and it allows you to maintain access to all your MSU Denver resources on your managed Mac by authenticating silently in the background using Microsoft's Company Portal application. All single-user macOS computers (i.e. you are the only user who signs into the computer) will be required to register for PSSO.

What does this mean?

This means once you have upgraded to macOS Tahoe, you will be prompted to register with Microsoft via PSSO, and once the registration process is successfully completed, you will be prompted to change the password for your computer. This new password will actually be a PIN that is at least 6 digits long and unique to your computer (i.e. it should not match the PIN you use to access any of your other devices). Once the registration is completed, your macOS account will no longer sync its password with your email address, and instead will always remain the unique-to-your-computer secure PIN that you created during the migration process.

This migration outlined below is a one time occurrence for macOS computers that have already been deployed. For newly provisioned and deployed computers this registration process will happen during the setup of the computer.

This new change will not affect any shared-use macOS computers on campus. For example, classroom lecterns, general and departmental computer labs, or shared student spaces (multi-user) will still require that you sign in using your MSU Denver email address and password. This new change will only affect the computers that faculty and staff were issued from ITS for use in their role at the University (single-user computers).

PLEASE NOTE: 

• Once you have completed the PSSO registration the password (PIN) that you set for your computer will never sync with your MSU Denver email account. Even if you call the ITS Service Desk and have them reset your password, your macOS PIN will not be changed and you should continue to use it when signing into your assigned computer. These passwords are separate and different by design.
• If you need to change your PIN you can do so from System Settings>Touch ID & Password. This will not have any affect on your MSU Denver email account password.

Before you begin...

Your computer must be

• A macOS computer. For the Windows equivalent, see How is authentication changing for single-user Windows computers?
• Running macOS Tahoe (26.x.x) at a minimum.

Understand biometrics

• While PSSO registration is mandatory, the use of TouchID is optional but it is recommended that you set it up following registration. At a minimum, you will only be required to set up a PIN.
• MSU Denver and Apple can never retrieve your fingerprint. By design, this data is strictly kept on your device and is never transmitted to servers or across networks. For more information, see About Touch ID advanced security technology

Migration

During the optional enrollment period

You can manually trigger this migration process to begin earlier than the enforcement date.

1. Open  the Self Service+ application and search for the PSSO Migration policy.

2. Run the Policy and follow the steps below.

During the mandatory enrollment period

Beginning 10/21/2026 you will see a new pop-up notification on your assigned macOS computer informing you that PSSO registration is required. The pop-up will display once every three hours with the option to defer completely until tomorrow. Once the deadline 10/23/2026 passes the registration becomes mandatory and the option to defer will become greyed out. 

1. Click Continue to begin the registration.
2. You will notice a smaller notification pop-up in the top left of your screen. This notification will automatically close once the registration process has completed successfully.

3. Click Register on the toast notification in the top right of your screen. If you don't see the toast notification after a few seconds, click the Calendar/Clock pill in the top right corner of your screen to check your notifications. If you still do not see the notification please reach out to the ITS Service Desk at (303) 605-7000.

4. A new prompt will appear in the center of your screen, follow the steps to complete the registration.
   1. Click Continue.

2. Enter your password at the prompt. This is the current password you use to log in to your Mac.

3. Sign-in with your MSU Denver email address and password. This is the password you use to log in to web services on MSU Denver websites.

5. Registration has completed! Now you will be forced to change the password for your local macOS account and set a PIN instead. As outlined above, this PIN will be unique and used to sign in to YOUR COMPUTER ONLY. It will not be used anywhere else on campus, and will never sync with your MSU Denver email password. Click OK on the prompt.

1. Your computer will automatically go to the lock screen. Enter your current Mac password and sign-in. This is the password you normally use to log in to your Mac.

2. You will be prompted to set a new password for your local macOS account. Please set a unique PIN that will not be forgotten. A 6-8 digit PIN is recommended, similar to your smart phone. Only numbers are allowed.

Video example

Result

You have now successfully registered your local macOS account with your MSU Denver Microsoft email address, and changed your password to a unique PIN that will only be used to log into this computer to meet the Secure Enclave PSSO standards.

You will find that when opening links to MSU Denver resources (Outlook, Canvas, Workday, etc...) in an Internet Browser (Safari, Chrome, Firefox) you will not need to enter your email address, password or even perform 2-step verification. Instead, the Company Portal app will automagically provide authentication from your local macOS account's PSSO registration. Additionally, desktop applications like Microsoft Office, Global Protect, Adobe, etc... no longer require authentication, they also will use the authentication token provided by Company Portal and your PSSO registration.

Printing

Because your mac is no longer connected to Active Directory, you may experience issues printing to network printers after completing this migration. For any campus networked printers this can be resolved by removing the old printer from your computer and following the steps in How do I add a printer to my MSU Denver Mac computer?