macOS ADE PSSO during Setup Assistant with FileVault and Entra IDSolved

For macOS ADE, Hexnode can deploy the Extensible SSO / Platform SSO configuration during the initial enrollment process and can also distribute the required identity app, such as Microsoft Company Portal, as a required app. However, enforcing Platform SSO registration as a strict mandatory gate inside Setup Assistant, where the user cannot proceed until Entra ID authentication and PSSO registration are completed, is not fully available in Hexnode at this time.

There is also an important FileVault limitation to consider. FileVault unlock happens before macOS fully boots and before networking, identity extensions, or cloud authentication are available. Because of this, FileVault cannot perform live Entra ID authentication at the pre-boot screen. The FileVault unlock must use a local account credential that is authorized to unlock the encrypted volume.

If your requirement is both:

1. PSSO registration must be completed inside Setup Assistant before the desktop is reached, and
2. FileVault must provide a single-login experience without an additional authentication prompt,

then that exact workflow is not currently achievable through the released Hexnode PSSO during-enrollment flow.

That matches what I’m seeing. Hexnode Access works for the identity side, but when FileVault is enabled the user has to authenticate twice. With the older password method, FileVault only asks once, which is the experience we want.

Yes, that double-authentication behavior with Hexnode Access and FileVault is a current limitation. FileVault itself will always require a pre-boot unlock credential, but the goal of a streamlined flow is to avoid a second interactive sign-in immediately afterward. Support for a single-login experience with Hexnode Access and FileVault is in active development, but it has not been released globally yet.

Until that capability is available, the practical options are:

• Continue using the existing password-based PSSO workflow after enrollment if it gives the desired single-login FileVault behavior.
• Use Hexnode Access if the additional authentication step is acceptable for the deployment.
• Wait for the upcoming Hexnode Access + FileVault single-login support before moving this workflow into production.

For now, Hexnode cannot force the full Apple-defined PSSO Setup Assistant gate with Entra ID registration and also provide the FileVault single-login behavior in the same enrollment flow.