Employees sign in to their Mac with their Factorial IT account through Apple Platform Single Sign-On (Platform SSO), using the login methods you allow. Use it when you want the Mac login to follow the same account employees already use for work.

Feature/Functionality

Overview

This control is for Macs only, and they must run macOS 27 or later:

The control is in private beta. If it shows This control is in private beta. Contact Factorial IT to enable it., write to support@factorial.it to have it turned on for your company.

It also needs the Factorial IT desktop app on your company's Macs. If the control says the desktop app is missing, write to support@factorial.it to have it deployed.

How to use

1. Go to MDM > Controls > Add new control and pick Mac login with Factorial IT.
2. Under Login methods, choose how employees sign in on the sign-in page. At least one is required:

• Password: the employee types their work email, then their Factorial IT password or a code sent by email, then their two-factor authentication if they have set it up. Selected by default.
• Google: the Google account linked to the employee's work email.
• Microsoft: the Microsoft account linked to the employee's work email.

If you pick one provider and leave Password off, the sign-in page goes straight to that provider.

3. Set the two timings:

• Full sign-in frequency (days): how often macOS asks for a full sign-in instead of quietly refreshing the session. Between 1 and 30 days; 7 by default.
• Offline grace period (days): how long after the last successful sign-in the local password keeps opening the Mac without a network. Between 1 and 30 days; 7 by default.

4. Choose the target: every macOS device, specific device groups or a custom target. Only Macs on macOS 27 or later receive it.

Your company can have only one enabled Mac login control at a time. To create another, disable the current one first.

Keep a local administrator account on every Mac the control covers, for example through Admin management. That account does not go through the Factorial IT sign-in, so it still opens the Mac if a sign-in fails.

What happens on the Mac

The control installs a configuration profile on the targeted Macs. That profile turns on the web-based Platform SSO that Apple added in macOS 27, with Factorial IT as the identity provider.

The sign-in runs through the Factorial IT desktop app. It is installed on every Mac in your company, and Macs set up through Zero-Touch Deployment get it during setup.

Registration

After the profile arrives, macOS shows the employee a Registration required notification. They click it and sign in with their Factorial IT account in a macOS sign-in window. The employee guide for this feature walks them through it.

Daily sign-in

• On the lock screen, Sign in with Factorial IT opens the sign-in page. The local password and Touch ID still work alongside it.
• macOS refreshes the session in the background every 4 hours. Once the Full sign-in frequency has passed, it asks for a full sign-in.
• With no network, the local password opens the Mac for the Offline grace period counted from the last successful sign-in.
• The sign-in window does not keep cookies between sign-ins. Employees using Google or Microsoft go through that provider every time, two-factor authentication included. This is how macOS shows the window; no setting changes it.

Mac password

When an employee signs in with their Factorial IT password, macOS also sets it as their Mac password. Signing in with Google or Microsoft leaves the Mac password as it was.

macOS rejects a password that breaks the Mac's password rules, and the sign-in then fails. To avoid this, while the control is enabled, your macOS Password and screenlock controls follow the Factorial IT password rules: at least 8 characters, upper and lower case, a number and a special character. macOS cannot require mixed case, so the Mac rule is as close as it can get:

These settings are locked; Screenlock remains editable. Disabling or deleting the Mac login control unlocks them, and they keep their values until you change them.

Password rules pushed by another profile, such as a Custom file, are not adjusted. Remove them from these Macs, or make sure they are no stricter than the Factorial IT password rules.

Change or remove the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement, but the configuration already on the devices stays there.

Every Save sends an updated profile to the targeted Macs.

Disabling or deleting the control does not uninstall the Factorial IT desktop app from your Macs.

Troubleshooting and FAQ

Troubleshooting

• The sign-in window says "Sign-in site not allowed". Open the control and click Save to push the current profile. Once the Mac has it, ask the employee to sign in again. If it still happens, see the guide on resolving Mac login issues.
• Sign-in fails just after the employee types their Factorial IT password. Look for a password rule on the Mac that is stricter than the Factorial IT password rules, for example in a Custom file.
• Google or Microsoft does not appear on the sign-in page. Check the provider is selected under Login methods, then click Save.
• A Mac never receives the control. Check it runs macOS 27 or later.

FAQ

1. Can employees still use Touch ID?
   Yes. Touch ID and the local password keep working next to the Factorial IT sign-in.
    
2. Does signing in with Google change the Mac password?
   No. Only signing in with the Factorial IT password updates the Mac password.
    
3. Why do Google and Microsoft users have to sign in every time?
   The macOS sign-in window keeps no cookies between sign-ins. No setting changes that.
    
4. Can I run two Mac login controls at once?
   No. One enabled control per company. Disable the current one to create another.
    
5. Does disabling the control remove the desktop app?
   No. The desktop app stays installed.