Highlights
- Continuous Authentication with CAuth
- Risk-Based Re-Authentication Prompts
- Steadier Smart Card and PIN Dialogs
- Uninterrupted Setup on macOS 27
- Device-Aware SSO
- New Administrator Visibility Events
- Bug Fixes
Enhancements
Continuous Authentication with CAuth
- The Mac Authenticator can now run the CAuth engine, so your organization gains continuous visibility into authentication activity rather than only the initial sign-in. CAuth is enabled through a flag in the configuration file, and the engine starts at login only for enrolled users. SSO authentication results are reported back to the engine so that proving your presence immediately lowers your risk score. If the engine stops unexpectedly during a session, it restarts automatically so continuous authentication keeps working until you log out.
Risk-Based Re-Authentication Prompts
- When your risk level crosses the configured threshold, you are now prompted to verify your identity with Touch ID or your PIN. The prompt takes over the screen with a blurred cover behind it, so no one can continue working on the Mac while it is up, and the workstation locks if you do not respond before the countdown ends. A cooldown period, configurable by your administrator and defaulting to 30 minutes, keeps you from being prompted repeatedly while your risk fluctuates.
Risk-Aware SSO Access Decisions
- SSO applications configured to use CAuth now evaluate your real-time risk score at the moment you authenticate. If your risk is within the threshold set in the application policy, sign-in proceeds as usual; if it is above the threshold, you are asked to verify your identity first. This means additional verification only appears when your risk posture actually warrants it.
Steadier Smart Card and PIN Dialogs
- The smart card token has been rewritten to stop authorization dialogs from flickering between PIN and password modes. Dialogs that previously oscillated, greyed out their buttons, or appeared unresponsive — on the lock screen, during certificate trust, and immediately after a PIN change — now stay in a single stable state. Upgrades that trigger the certificate migration no longer leave the Mac with unusable auth dialogs for several minutes.
Uninterrupted Setup on macOS 27
- On macOS 27, setting up a new Mac through Automated Device Enrollment no longer goes to a black screen for about a minute after you create your PIN. A full-screen setup panel now covers that interval on every display, in light and dark mode, and dismisses itself as soon as the desktop is ready. You can see that your Mac is still working instead of wondering whether it has frozen. Behavior on macOS 26 is unchanged.
Device-Aware SSO
- During browser SSO, the Mac Authenticator now provides a signed statement describing the enrolled device and the user signing in. You can use this to filter the login options offered to a user based on the Mac they are using, and to apply conditional access policies that take the device itself into account. Sign-in requests can now be evaluated on where they come from, not just who is making them.
New Administrator Visibility Events
- You now receive an event when software from another vendor attempts to authenticate the user locally with a password, so you can act before repeated attempts lock the user out of their Mac. You also receive events when a user’s PIN becomes locked out from too many failed attempts and again when it is no longer locked, making it easier to spot patterns that suggest misuse.
Administrator Control Over Unenrollment
- The option for users to unenroll themselves from the Mac has been removed, along with the configuration setting that controlled it. This prevents users from accidentally removing their own enrollment and locking themselves out of their system and SSO applications. Users who need to remove a device can still do so from the User Portal.
Simplified Enrollment Configuration
- The option to defer post-enrollment until after a reboot has been removed, so there is now a single, consistent Automated Device Enrollment flow. Post-enrollment always begins immediately once the first phase of enrollment completes. If the old setting is still present in a configuration profile it is simply ignored, and enrollment and agent startup are unaffected.
Smaller Installation Package
- The release package is roughly half its previous size, making deployment and upgrades faster to distribute across a fleet. Application behavior is unchanged.
Bug Fixes
- Fixed an issue where authorization dialogs flickered between PIN and password prompts, momentarily cleared themselves during a successful confirmation, or presented a second prompt for the same operation. This affected the lock screen after a PIN change, the certificate trust flow during migration, and reinstalls of the same build.
- Fixed an issue where a Mac upgrading from an earlier release could show unresponsive authentication dialogs for several minutes while the certificate migration ran, and where smart card reinsertion during that migration could leave the identity missing for a few minutes.
- Fixed an issue where your PIN could stop working after a certificate renewal until you restarted the Mac. Certificate renewal no longer restarts the application and rebuilds its state in place instead.
- Fixed an issue where certificate renewal could fail repeatedly and never recover, leaving you stuck retrying with a “certificate failed to renew” message.
- Fixed an issue where the certificate trust window could disappear partway through migration if a certificate renewal restarted the application, after which the migration was incorrectly recorded as complete.
- Fixed an issue where you were not redirected to the lock screen when your account was locked out by repeated incorrect PIN entries, including from the Change PIN screen, even when the policy was configured to do so.
- Fixed an issue where lockout messages were worded differently depending on where they appeared. The message is now consistent across the application.
- Fixed an issue where enrolling as a standard user failed at the Certificate Trust prompt when an enrolled administrator was still signed in through fast user switching, with the correct password reported as incorrect.
- Fixed an issue where canceling the keychain repair prompt produced repeated password pop-ups and left the keychain unrepaired. The repair prompt also now appears in the foreground instead of being hidden behind open windows and applications.
- Fixed an issue where keychain authorization prompts during certificate-based sign-in identified the key generically instead of naming the TruU key, making it unclear what was requesting access.
- Fixed an issue where the Mac could not be unlocked with the correct password after waking from sleep once the Authenticator had been unenrolled or uninstalled, requiring a force restart.
- Fixed an issue where the lock screen continued to ask for a smart card PIN after unenrollment or uninstall, and the PIN did not unlock the Mac.
- Fixed an issue where a certificate enable prompt kept reappearing after the user’s account was deleted from the Admin Console, instead of the device unenrolling.
- Fixed an issue where no notification appeared when a user was unenrolled by an administrator or through the User Portal, leaving the user unaware of the change.
- Fixed an issue where a device could be unenrolled unexpectedly during an upgrade because a leftover enrollment identifier from a previous installation was reported to the platform.
- Fixed an issue where the Mac remained enrolled after the macOS password was reset using a FileVault recovery key. When the stored PIN secret is no longer available, the device now unenrolls so you can enroll again instead of being left in an unusable state.
- Fixed an issue where clicking Enroll could hang the application and then report that the Mac was not enrolled when the TruU background service was slow to respond. You now get a clear “service isn’t responding” message, and the application stays responsive.
- Fixed an issue where re-enrollment showed a generic “Oops! Something went wrong.” message after a device had been removed from the Admin Console. The application now detects the enrollment state change and responds correctly.
- Fixed an issue during identity verification where, after a network interruption, the application briefly displayed a stale enrollment screen before continuing on its own.
- Fixed an issue where browser SSO could fail on the first attempt and succeed on a retry when the background service was momentarily busy. The attempt is now treated as retryable instead of being rejected outright.
- Fixed an issue where uninstalling left the product in a half-removed state — the user was unenrolled but the application, services and supporting files remained on the Mac — including when the privileged helper was no longer present.
- Fixed an issue where the application could crash on launch, and relaunch repeatedly, when its diagnostic cache directory could not be created.
- Fixed an issue where third-party password authentication events were recorded on the device but never appeared in the Admin Console.
- Fixed an issue where a duplicate de-registration event was displayed in the Admin Console after an uninstall.
- Fixed an issue where failed enrollments reported the wrong reason, attributing the failure to a cancelled dialog regardless of the actual error.
- Fixed an issue where audit events could be silently lost: a single unreadable file in the outgoing queue was retried indefinitely and could eventually stall event reporting for the device.
- Fixed an issue where logs could not be submitted from the Mac Authenticator when the user’s account had no email address configured.
- Fixed an issue where startup and enrollment could block indefinitely while restarting a background service.