visionOS 2.0 Beta 4: New Authentication APIs, Passkey Support, and Enterprise SSO Advances for Vision Pro

What Apple Just Shipped: visionOS 2.0 Beta 4 (24M5326g)

On July 20, 2026, Apple released visionOS 2.0 Beta 4 (build 24M5326g) to developers. This beta brings parity with iOS 18/macOS Sequoia for key identity and authentication features, most notably:

• Passkey support for platform and roaming authenticators
• Full Sign in with Apple (SIWA) enhancements, including managed Apple ID support
• Updated Platform SSO Extension Framework for enterprise authentication
• Expanded MDM configuration profile options for identity and device management

This beta is required for developers targeting Vision Pro with authentication, identity, and enterprise integrations launching with visionOS 2.0 in Fall 2026.

What’s Coming: WWDC and Apple Docs Highlights

• Passkey Cross-Device Sync: iCloud Keychain will sync passkeys created on Vision Pro to other signed-in Apple devices. Developers should migrate password-based logins to passkeys for visionOS apps.
• Managed Apple ID Federation: ABM/ASM admins will soon be able to federate Managed Apple IDs with Google Workspace (joining Entra ID and Okta), reflected in visionOS sign-in flows.
• Kerberos SSO Extension: The SSO extension now supports ticket acquisition and renewal on visionOS, enabling seamless access to on-prem and cloud resources.
• AuthenticationServices Updates: New APIs for ASAuthorizationPlatformPublicKeyCredentialProvider and ASAuthorizationController bring visionOS up to parity with iOS/macOS passkey flows.
• MDM Declarative Device Management for Vision Pro: Support for declarative status feedback and automated passcode enforcement.

Who’s Affected

• Developers integrating passkeys, Sign in with Apple, or enterprise SSO in visionOS apps.
• Enterprise IT admins managing Vision Pro devices in ABM/ASM, especially with federated identity or SSO requirements.
• Security engineers responsible for enforcing authentication policy or auditing device posture on visionOS endpoints.

Why This Is Better

• Security: Passkey support eliminates phishing risks and credential reuse compared to legacy passwords. The Secure Enclave on Vision Pro provides robust local key protection.
• Seamless SSO: Platform SSO and Kerberos Extension support bring parity with iOS/macOS, reducing friction for enterprise logins and resource access.
• Modern MDM: Declarative device management and enhanced identity payloads reduce drift and automate compliance for Vision Pro deployments.
• Cross-Platform Consistency: SIWA and passkeys now work the same across iPhone, Mac, iPad, and Vision Pro, simplifying app and fleet management.

How to Implement or Respond

1. Integrate Passkeys in visionOS Apps

Update your authentication logic using the latest AuthenticationServices APIs in Swift:

import AuthenticationServices

let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: "example.com")
let registrationRequest = provider.createCredentialRegistrationRequest(challenge: challengeData, name: "Vision Pro User", userID: userIdData)

let controller = ASAuthorizationController(authorizationRequests: [registrationRequest])
controller.delegate = self
controller.performRequests()

Ensure your backend supports FIDO2 server-side challenge/response validation. See Apple’s Passkey documentation.

2. Enforce Passcode and Passkey Policy via MDM

Admins can require passcode and passkey support on Vision Pro using MDM configuration:

<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.apple.mobiledevice.passwordpolicy</string>
      <key>allowSimple</key>
      <false/>
      <key>maxFailedAttempts</key>
      <integer>6</integer>
      <key>forcePasskeyAuthentication</key>
      <true/> <!-- visionOS 2.0+ only -->
    </dict>
  </array>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>

Deploy via your MDM or Apple Business Manager device group targeting Vision Pro devices on visionOS 2.0+.

3. Configure Platform SSO Extension for Enterprise Logins

To enable SSO for enterprise apps and web views:

<dict>
  <key>PayloadType</key>
  <string>com.apple.extensiblesso</string>
  <key>ExtensionIdentifier</key>
  <string>com.yourorg.ssoextension</string>
  <key>Type</key>
  <string>Redirect</string>
  <key>TeamIdentifier</key>
  <string>YOURTEAMID</string>
  <key>URLs</key>
  <array>
    <string>https://login.yourorg.com</string>
  </array>
</dict>

Test with Kerberos or OIDC identity providers that support Apple’s SSO extension APIs.

4. Enable Managed Apple ID Federation (Preview)

Admins can prepare for Google Workspace federation by verifying domain ownership in Apple Business Manager:

1. Go to Settings > Accounts > Federation in ABM/ASM.
2. Add your Google Workspace domain and follow the TXT record DNS verification steps.
3. Enable Google Workspace as your IdP once available in production (expected late 2026).

What to Check

• On Vision Pro with visionOS 2.0 Beta 4: In Settings > General > Passkeys & Passwords, confirm passkey sync is enabled and passkey creation works in your app.
• In MDM/ABM: Devices running visionOS 2.0 Beta 4 report forcePasskeyAuthentication as true in device details.
• In your SIWA flow: Managed Apple ID users from Entra ID, Okta, or Google Workspace can sign in via your app and receive the correct sub and email claims in the ID token.

Bottom Line

Update your visionOS apps and MDM policies now to support passkeys, Platform SSO, and federated Managed Apple IDs ahead of visionOS 2.0’s general release. These changes are required for secure, compliant Vision Pro deployments and unlock seamless authentication and device management workflows across Apple platforms.