MFA, Conditional Access and network requirements

Three things that apply across the Scribe desktop app and browser extension deployments

Multi-factor authentication and Conditional Access

Silent authentication reuses a sign-in your users have already completed. It does not perform MFA itself. So an MFA policy works alongside it as long as users complete MFA somewhere in their normal day:

• The browser extension uses the browser's session. MFA completed when signing in to Windows, to Microsoft 365, or to any other app in that browser counts.
• The desktop app on Windows uses the Windows sign-in session. MFA completed at Windows sign-in or in another installed Microsoft app counts. MFA completed only in a browser does not reach the desktop app.

If a user has no current MFA-satisfied session when Scribe signs them in, a Microsoft sign-in prompt appears and recurs until they complete it.

If you prefer Scribe's silent authentication to never be interrupted by MFA, exclude the Scribe applications from the Conditional Access policy that requires it: for the desktop app, Scribe Desktop API and Scribe API (the applications consented during setup); for the browser extension, the Scribe SSO enterprise application in your tenant. Sign-in to Scribe is then not MFA-gated - weigh that against your security requirements.

Conditional Access policy changes apply when a token is issued. A user who is already signed in is affected at the next renewal, not immediately.

Network requirements

If your organisation filters outbound traffic, allow the Scribe endpoints and extension IDs listed in Does Scribe work behind firewalls?

Silent authentication additionally goes through your identity provider and Scribe's SSO service, so these must be reachable too:

• https://api.workos.com and https://auth.workos.com - the browser extension's sign-in
• https://login.microsoftonline.com - Microsoft Entra sign-in (the desktop app, and the extension when Entra is your identity provider)
• https://accounts.google.com - the extension when Google is your identity provider

The symptom when one of these is blocked: everything in Scribe works except silent authentication, and users land on a normal login screen.