How to fix "Single Sign-on extension could not validate the domain" error in MacOS setup

The error during Setup Assistant is typically caused by the Platform SSO (PSSO) profile and the Company Portal/SSO extension not being fully available or correctly configured when macOS tries to validate the domain.

Use the following steps to fix it.

1. Verify all required PSSO components

• Ensure all three required pieces are configured and assigned:
  • Platform SSO settings catalog policy (with correct URLs and options).
  • Company Portal for macOS deployed as a LOB app.
  • ADE enrollment profile using Setup Assistant with Modern Authentication and Await final configuration enabled.
• If any of these are missing or misconfigured, PSSO during setup will fail.

2. Handle the “Unable to sign-in” message during Setup Assistant

• This message appears when the SSO extension (from Company Portal) is not yet available while the PSSO profile is already present.
• Select Try again repeatedly until Company Portal has finished downloading and installing. Once installed, the SSO extension becomes available and the error should clear.

3. If misconfiguration occurred, remove PSSO and re-enroll If the configuration was wrong when devices were first enrolled, changes to the PSSO profile will not fully apply until the device is wiped and re-enrolled.

Follow this sequence:

1. In Intune, unassign the Platform SSO policy that has Enable Registration During Setup enabled, then Sync the device so the policy is removed.
2. Edit the same Platform SSO policy and set Enable Registration During Setup to disabled, then Sync again so the setting is removed from the device.
   • If using the Password authentication method, also set Enable Create First User During Setup to disabled and sync.
3. Wipe the device so that enrollment restarts and updated ADE and PSSO profiles are applied cleanly.
4. Reconfigure PSSO following the documented steps, and finally re-enable Enable Registration During Setup in the Platform SSO policy for the next enrollment.
5. Validate PSSO and SSO extension after re-enrollment

• After re-enrollment, confirm:
  • The device shows a Registration required notification and users can sign in with their Microsoft Entra account.
  • The device becomes Microsoft Entra-joined and the WPJ certificate is bound.
  • On the Mac, under Settings > Privacy and security > Profiles, the Platform SSO profile appears as com.apple.extensiblesso Profile with the expected URLs.

5. Check for TLS inspection issues (if domain validation still fails) If the error persists even with correct profiles and Company Portal installed, validate that TLS inspection or a proxy is not breaking the associated-domain validation used by the SSO extension:

• Ensure the URLs required for PSSO registration and token flows (for example login.microsoftonline.com, Apple app-site-association domains, etc.) are allowed and explicitly exempted from TLS interception/inspection, as described in the troubleshooting guidance.
• If needed, collect a sysdiagnose and review com.apple.appsso logs or use Apple’s Mac Evaluation Utility to detect HTTPS interception issues.

If issues continue after these steps, collect logs (including sysdiagnose) and use Company Portal’s Help > Send diagnostic report to open a support case.

References:

• Configure Platform Single Sign-On (PSSO) during Automated Device Enrollment for macOS devices
• Platform SSO configuration guide for macOS devices using Microsoft Intune
• macOS Platform single sign-on known issues and troubleshooting
• Troubleshooting the Microsoft Enterprise SSO Extension plugin on Apple devices