u/MaleficentPrize9907

We originally created an account with a free trial of Acrobat Pro in May 2026. The trial never flipped over to paid, so I contacted them to get it sorted out. The rep closed our org account and to reopen a new one, then tried to sell us a tier that we didn't need, saying Acrobat Pro was no longer available.

I created a new account, started a new trial and set everything up, and reached out to their support to deal with the "deleted-org" listed on the old profile. They opened a ticket, and closed it; not so much as an email. So through support again, and had to manually purchase a Teams license, which required me to go back in three separate times to re-assign the licenses to everyone. I pointed out again that the deleted-org was still there, and I didn't have access to the payment information section.

We changed CC providers, went in last week to update the CC, and the problem still hasn't been resolved. Cases that I have numbers for don't even exist. Opened a new ticket. Received a notice today that the ticket was closed, but the issue hasn't been resolved, so back on chat again today where I'm told that it was cancelled because our CC is suspected of fraud. FFS, I've been fighting with them for nearly four months.

I cross-posted this in the Intune sub as well.

I've spent the last four days trying to figure this out, and unfortunately, Microsoft/Apple documentation feels like it purposely leaves things out. So, if anyone can help me get over what I hope is the last hurdle, I would really appreciate it.

Our domain is federated in ABM, and these are brand new systems that haven't been deployed to anyone, with macOS 26. Company Portal version is 5.2602.0. MFA is enforced through CA.

It seems to be deploying properly, but I get to what looks like a blue Microsoft window that says to sign in to our organisation with a username and password field, but it gives me an error saying the account or password are incorrect.

The enrolment profile is configured this way:

• Enrol with User Affinity > Setup Assistant with modern authentication
• Await final configuration > Yes
• Locked enrolment > Yes
• Create a local admin account > Yes
• Create a local primary account > No

PSSO is configured this way (only what I think is relevant to the problem):

• Authentication Method > UserSecureEnclaveKey
• Enable Authorisation > Enabled
• Enable Create User At Login > Enabled
• Enable Registration During Setup > Enabled
• FileVault Policy > AttemptAuthentication
• New User Authorisation Mode > Admin
• Non Platform SSO Accounts > LAPS account
• Account Name > preferred_username
• Full Name > name
• Use Shared Device Keys > Enabled
• User Authorisation Mode > Admin
• Registration Token > {{DEVICEREGISTRATION}}
• Team Identifier > UBF8T346G
• Extension Identifier > com.microsoft.CompanyPortalMac.ssoextension
• Type > Redirect
• URLs > https://login.microsoft.com, https://login.microsoftonline.com, https://sts.windows.net

I have some Key Values entered as well, for enabling biometrics, app prefix, browser extension, and disable explicit app prompt.

Everything seems to go as it should at first. The usual ADE setup, managed by our ABM, enrolling Intune, applies policies, registers with Entra ID, then gets to the screen to sign in to our organisation and throws out the account error from there.

I've multi-checked Platform SSO configuration guide for macOS devices using Microsoft Intune, and it does say "Optionally, allow new users to log in with Entra ID credentials) for Secure Enclave.

So, I'm really not sure what I'm missing. As far as I could see, I don't need to have a local primary account pre-created during ADE.