Blank WSS Agent authentication page on macOS (AU=unauthenticated & Platform SSO)
Article ID: 445959
Updated On:
Products
Issue/Introduction
The WSS Agent is installed using the AU=unauthenticated installation option. We have observed that on macOS devices with Platform SSO enabled, the WSS agent takes a significant amount of time to authenticate the user, resulting in a blank window during the process. This issue does not occur when the WSS agent is installed on Windows machines.
Environment
WSS Agent installed on macOS with installation option AU=unauthenticated
macOS using Platform SSO
Cause
What is AU=unauthenticated?
The AU=unauthenticated installation option enables the WSS Agent's pre-authentication tunnel mode. In this mode, the agent establishes a secure tunnel before the user signs in and enforces a restrictive traffic policy that allows only the network communications required to complete user authentication. This configuration is designed to protect devices by limiting network access until authentication is successful.
What is Platform SSO?
Apple Platform SSO provides native single sign-on capabilities for macOS and integrates with identity providers such as Microsoft Entra ID through Microsoft Intune and the Company Portal application. During system startup, Platform SSO requires network connectivity to initialize, validate device state, and evaluate Conditional Access policies before user authentication can be completed.
When the WSS Agent is installed with the AU=unauthenticated option, its restrictive pre-authentication traffic policy blocks the network communications required for Platform SSO initialization.
This creates a dependency loop:
- The WSS Agent waits for the user to authenticate before permitting broader network access.
- Platform SSO requires network access to complete its initialization.
Because neither component can complete its required operation, user authentication cannot proceed successfully. This deadlock is precisely why the authentication window displays a blank page and the login process experiences a severe delay.
Resolution
If Apple Platform SSO is deployed on macOS devices, do not install the WSS Agent using the AU=unauthenticated (pre-authentication tunnel mode) option.
Additional Information
Feedback
