--- title: "Passport Compatibility with macOS & Kandji Features" slug: "passport-compatibility-with-macos-kandji-features" updated: 2025-07-23T18:41:05Z published: 2025-07-23T18:41:17Z canonical: "support.kandji.io/passport-compatibility-with-macos-kandji-features" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt > Use this file to discover all available pages before exploring further. # Passport Compatibility with macOS & Kandji Features ### Library Items #### Automated Device Enrollment **Require Authentication** If using Require Authentication within Automated Device Enrollment and assigning a user to a device record, prefilling initial account creation details is not recommended. Passport will use the account details provided upon the user's first login via the Passport login window. 1. Uncheck the **Prefill initial account creation details** checkbox.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/8gP7XrzCgnOsyA5-EATFwWKxuz3HHYsH3w.png) **Primary Account Creation** When using Passport, select **Skip primary account creation** under **Primary account type.** That way, when users arrive at the Passport login screen and log in using their IdP credentials, their Mac account will be provisioned. If you do not skip account creation, the device will display an error when attempting to create the local user account. 1. Select the **Primary account creation** dropdown. 2. Select **Skip primary account creation**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Mi7IYkjFWY6LoxgzJXPUZrLro3nRuJ04eg.png) **FileVault** The **Enforce during Setup Assistant for Automated Device Enrollment (macOS 14+)** option in the FileVault Library Item is not compatible with Passport and should be disabled. When using Passport, the local user is created after Setup Assistant, which means that it won’t be possible to enable FileVault until Setup Assistant is complete. 1. Navigate to the FileVault Library Item. 2. Ensure that the **Enforce during Setup Assistant for Automated Device Enrollment (macOS 14+)** option is unchecked. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0747AM@2x.png) #### Passcode When using Passport, it is highly recommended that the **Passcode** library item be removed from any Blueprint containing Passport. Your IdP should handle password requirements. If passcode requirements set by your IdP are less restrictive than those set by the **Passcode** library item, it will result in the user being unable to change their password because it doesn't meet the password requirements of the local Mac. If you need to enforce the **Passcode** policies for *Require Passcode After Sleep or Screen Saver Begins* and/or *Start Screen Saver After settings*, these are compatible with Passport. If you need to deploy these two settings, ensure that every other Passcode setting is disabled to avoid password sync issues. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/cMuj_HO0qDMgfDZ1-75ipLTK2C2nJsLVng.png) #### Login Window The Login Window Library Item contains some items that are compatible with Passport. *Compatible Options* The **Set lock message** option on the Login Window Library Item is compatible with Passport. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/aPY-6qbjs2En1_zNtgmC8iNFcTqtnq2GoQ.png) The options listed in the **Logged in users** section of Login Window Library Item are compatible with Passport. Fast user switching should be disabled for devices running macOS 13 or lower as it does not use Passport authentication when switching. Devices running macOS 14 or newer can use fast user switching with Passport without issues. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/au9K5kR7igJG29OKsSFrgAVCIlC5gXlg_w.png) The **Manage user visibility** option set to **Display a list of users** in the User visibility section of the Login Window Library Item is compatible with Passport. This setting also controls the FileVault unlock screen on Apple Silicon computer. The FileVault unlock screen does not support using the email address to unlock the disk. This can cause confusion in the communication for end users on what login name to use. In addition, Intel devices always show a list of users at the FileVault unlock screen which can lead to a mixed experience for end users depending on their Mac computer architecture. The recommended configuration provides a consistent experience for all end users. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0218PM.png) *Incompatible Options* The items in the **Menu Bar** section of the Login Window Library Item are incompatible with Passport and should be unchecked.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/oMVvN-gMPw1sUBYUehCV0CYVCHKUn6rWag.png) The items in the **Options** sections of the Login Window Library Item are incompatible with Passport and should be unchecked.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/alopkyvq2manedfd6agdwxfto5czwwqnew.png) ### Parameters #### Enforce a Custom Policy Banner If you are using the **Enforce a custom policy banner** parameter, disable it for any Blueprints containing the Passport library item. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6jKg-EB2A3Rsvbpt9IkLDBC-L1PuXUMHnw.png) #### Demote user accounts to Standard Since Passport evaluates the User account type, and may change it from Administrator to Standard or vice versa, combination with the [Demote user accounts to Standard](/v1/docs/demote-user-accounts-to-standard) Parameter can cause reboot loops. If provisioning User accounts as administrators in your Passport Library Item, ensure the Demote user accounts to Standard Parameter is not enabled in the same Blueprint. Using the Demote user accounts to Standard Parameter on a Blueprint with Passport assigned is not recommended. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6DCsgLDCjoLO53EJ_BH5OLzkNH6PV4tyIg.png) #### Secure Wi-Fi Settings Passport requires network connectivity to check user credentials against the IdP. When customizing the login window in Passport, show the network manager so users can join a Wi-Fi network as necessary. The network manager respects AirPort security settings in macOS. You can use the **Secure Wi-Fi Settings** parameter in Kandji to require local administrator credentials to change networks. If enabled, users will be prompted with a native authentication dialog at the Passport window when switching networks. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/hiSWCfvgj7Gqb8BEBQ5YInPsvsziSjmbEA.png) To ensure that users can always log in to their Mac computers, Passport will allow them to log in using their IdP credentials when there is no network connectivity. ### macOS Features #### Migration Assistant Using Migration Assistant with Passport is not supported. If Migration Assistant was used with Passport, you can follow these steps to resolve the issue. When using migration assistant to migrate data from a device that is enrolled in Kandji, please remove Passport from the device that you are migrating from before attempting a migration. If Passport remains on the device and is migrated to the target device, users may get stuck at the Passport screen and won't be able to proceed. If you need assistance remediating this situation, please [reach out to support](/v1/docs/access-to-kandji-support). #### Managed Apple Account alias In some situations, a user may be logged in to an Apple Account with an account name that matches the IdP account name. Much like Passport, an alias is created in the local directory to match this Apple Account account name. When the Apple Account matches the IdP account name, a collision can occur that will prevent the user from signing in with the IdP account name. This collision happens only when the user signs out of the Apple Account. The sign-out process removes the alias for the Apple Account. Since this alias matches the account name used by Passport, it removes the alias for Passport as well. To resolve this, the alias must be restored. This can be done manually using the Users & Groups pane in System Settings (or System Preferences) or in the Directory Utility app on the local computer. If you need assistance remediating this situation, please [reach out to support](/v1/docs/access-to-kandji-support). #### Mobile Accounts Passport is compatible with local macOS accounts. Mobile accounts are unsupported. Before using Passport, convert existing mobile accounts to local accounts for successful account merging. #### Network & Wi-Fi In order to contact the IdP, Passport needs network connectivity. It’s common for people to use a portable Mac in various locations that provide a Wi-Fi network that the Mac has not yet joined. Passport displays a Wi-Fi icon in the upper-right corner of the screen. You can click the Wi-Fi icon to join a Wi-Fi network that accepts a password to join the network. At this time, Passport does not support networks that utilize captive portal, click-through authentication, or enterprise networks that require a username and password for 802.1X authentication. ### Identity Provider #### Temporary Passwords Temporary IdP passwords are not compatible with Passport when using the Mac Login Authentication mode. Temporary password are compatible with the Web Login Authentication mode.