After updating to macOS 27 (27.0.1, build 26A434 on the MacBook Air), three of our Macs won't get past login: a MacBook Air (13", M3, 2024), a Mac mini and a Mac Pro. After entering the password, the wallpaper and a spinning cursor appear, but the menu bar and Dock never load, even after waiting 10+ minutes.
Because it's happening on three different Macs, we suspect something in our management setup rather than hardware or a single user account.
Environment (common to all three):
- Supervised, enrolled through Apple Business Manager into Microsoft Intune
- FileVault on; standard (non-admin) user accounts
- NIST 800-171 baseline from the macOS Security Compliance Project (built for macOS 26.0) deployed as configuration profiles
- Microsoft Defender for Endpoint (real-time, network and tamper protection on)
Troubleshooting on the MacBook Air:
- Logs show a shutdown stall at the start of the update and several forced resets while it appeared stuck; no kernel panic files
- Safe Mode: same hang after login
- Reinstall macOS from Recovery: fails with "No administrator was found" (standard user only; adding them to the admin group with dscl didn't help)
- The Intune-managed admin isn't shown at the login screen or in Recovery
- Deleted Microsoft Defender (app, launch daemons/agents, system extensions) from Recovery: still hangs
- Deleted the user's ~/Library/Caches (no LaunchAgents present): still hangs
- Deleted .AppleSetupDone to create a new admin: Setup Assistant never appeared (likely FileVault auto-login)
- DFU Revive from another Mac: failed twice with error 4042, then succeeded. The login hang persists after the successful Revive.
Since the Revive reinstalls macOS without touching user data, Safe Mode doesn't help, and three Macs are affected, our main suspect is a configuration profile from the macOS 26 800-171 baseline (login window, smart card, authorization/PAM or similar) that behaves differently on macOS 27.
Questions:
1. Has anyone seen login hangs on macOS 27 with an mSCP 800-171 (or similar) baseline, Platform SSO, or Defender for Endpoint deployed through Intune?
3. Is there a way to get a usable admin in Recovery, or bypass FileVault auto-login, when the only user is a standard FileVault user?
We've paused further macOS updates for now. Any help is appreciated.
[Edited by Moderator]