Intune compliant MacOS device cannot authenticate from the browser - Error 530003

Error 530003 with Device state: Unregistered means the sign-in is being evaluated as requiring a managed device, but the browser sign-in is not presenting a usable device registration to Microsoft Entra ID.

For macOS browser sign-in with Conditional Access, the supported path is:

• the device is Microsoft Entra registered
• the device is MDM managed
• compliance is available through Intune or Intune Partner Compliance
• the Microsoft Enterprise SSO extension is actually being used during the browser auth flow

Use this troubleshooting path:

1. Confirm the SSO extension is being used in the failed sign-in In the Microsoft Entra sign-in logs, check the failed event and verify these fields:
   • Authentication method detected = Microsoft Entra SSO plug-in
   • Managed indicates the device is under management
   • Compliant is being passed
   • Join Type for macOS should be Microsoft Entra registered
   • Device ID should be present if the device is registered
   If the sign-in log still shows Device identifier: Not available and Device state: Unregistered, the browser flow is not getting device registration information.
2. Verify the SSO extension deployment path Apple requires the device to be enrolled in MDM for the SSO extension to be deployed. If the extension is deployed through Intune or an MDM that supports Intune Partner Compliance, the extension can pass the device certificate so device authentication can complete.
3. If Chrome is being used, verify the browser integration file exists On macOS, validate this file exists:

      ls ~/Library/Application\ Support/Google/Chrome/NativeMessagingHosts/com.microsoft.browsercore.json
   

   If it is missing, remove Company Portal, install the latest Company Portal again, and recheck the file. This is a known issue caused by how Company Portal is installed or updated in some cases.
4. Check for app compatibility with the new device identity key storage Microsoft documents 530003 with failure reason Device is required to be managed to access this resource for Apple device SSO scenarios. First ensure the SSO extension is enabled and any required app-specific extension is installed. If the issue continues after that, the documented recommendation is to contact the application vendor about incompatibility with the new storage location.
5. Test Secure Enclave only as a temporary troubleshooting step If Secure Enclave troubleshooting is required, set this MDM key:
   • use_most_secure_storage = 0 (Integer)
   Warning: disabling Secure Enclave should only be done during troubleshooting. After changing it, Microsoft recommends:
   • unregister the device in Microsoft Authenticator or Intune Company Portal
   • register the device again
6. Check network inspection TLS inspection can break the SSO extension on macOS. These domains must not be subject to TLS interception/inspection:
   • app-site-association.cdn-apple.com
   • app-site-association.networking.apple

Most likely in this case, the key mismatch is that the Mac is compliant in Intune but the browser sign-in is still not seeing the Mac as Microsoft Entra registered/device-auth capable, which is why the log shows Unregistered and no device identifier.

References:

• Microsoft Enterprise SSO plug-in for Apple devices
• Troubleshooting the Microsoft Enterprise SSO Extension plugin on Apple devices
• macOS Platform single sign-on known issues and troubleshooting
• Any mobile device management tool for customers without Microsoft Defender for Endpoint