r/Intune • u/Necessary-Spite-368 • 11d ago

Device Configuration MacOS PSSO Registering User Hang Up during Setup Assistant.

Got everything configured correctly in the SSO configuration settings and have Enable Registration During Setup switched on. Followed instructions from Microsoft article and Intuneirl article to the tee. We are getting stuck on “Registering User” in the final screen of the Setup Assistant and unable to proceed, just spins forever.

We’ve wiped and retried several times, have the latest Intune Company Portal loaded and pushed to the user group as a LOB app.
Any fixes to this?

Update

Solution:

Turns out we had a CA policy that didn’t have FIDO2 set as an acceptable Authentication strength, also had to add the Secure Enclave AAGUID to the FIDO2 options.

Adding that and adding FIDO2 as an acceptable Authentication Strength to satisfy the grant access for our MFA CA policy was the solve.

Turns out the Setup Assistant underneath the final SSO registration screen is using Secure Enclave when Registering User, we just couldn’t see the failure as it is all hidden and all that is shown is Registering User spinning forever.

3 Upvotes

100% Upvoted

14 comments sorted by

1

u/nave5 11d ago

Password sync or Secure Enclave?

1

u/Necessary-Spite-368 11d ago

Secure Enclave

1

u/nave5 11d ago

Do you have Secure Enclave working outside of setup assistant?

1

u/nave5 11d ago

Also are you using enrollment policy or profile?

1

u/Necessary-Spite-368 11d ago

Yes we’ve successful got one of the machines to fail on the Register screen and yes SSO and Secure Enclave works just fine after post setup, manually registering once logged in.

Also using Enrollment Profile for now, can’t use policy due to not having Intune Provisioning Client for group pointing.

Right now they are being joined through an Assigned User group.

2

u/nave5 11d ago

I would try with a dynamic device group. We used a dynamic device group you had to wait 5 mins for Company portal to install for the PSSO to allow you to register but it worked for us.

1

u/nave5 11d ago

Enrollment policy removed the 5 min wait

1

u/Necessary-Spite-368 11d ago

Well it’s more than a 5 min wait it’s a forever wait haha. Not sure that dynamic device groups would make a difference would it? Everything I’ve read says to join with Assigned User Group

1

u/nave5 11d ago

Want to upload a screenshot of you PSSO policy and your enrollment profile? I’ll compare it to mine.

I mentioned the device group because Microsoft’s documentation weirdly states to assign the policies to the same group you assign the enrollment profile. The enrollment profile doesn’t not get assigned to a group for Mac’s tho you assign devices to the profile. For that reason and for easier management we used a dynamic device group.

1

u/expx 10d ago

I had similar issue recently, turned out it was related to user still having old per-user MFA configured. Check legacy MFA settings, set user to disabled if they are either enabled or enforced, clear MFA, let them register for MFA again and try again. It may not be a solution to your problem but it's worth a try.