on macOS we can use enterprise SSO to generate the challenge response (only applies to safari/native apps)