This guide configures the Scribe desktop app on Windows for silent authentication. Users are signed in with their Microsoft Entra identity without seeing a sign-in prompt.
This guide assumes that:
- The Scribe app is deployed. See Windows Desktop App: Install via Intune.
- An Enterprise Settings file is delivered to devices. See Windows Desktop App: Enterprise Settings via Intune.
Silent authentication is enabled by adding one key to the Enterprise Settings file.
Order of deployment
The app reads the Enterprise Settings file when it launches, then attempts to sign in silently.
On a test device:
- Complete Step 1 below.
- Add the silent authentication key to the Enterprise Settings file.
- Relaunch the Scribe app.
For a broader rollout, complete Step 1 and deliver the Enterprise Settings file before deploying the app. This ensures that each user’s first launch has the required configuration.
Prerequisites
| Requirement | Why it is needed | How to check |
|---|---|---|
| Microsoft Entra ID tenant with Global Administrator access | One-time, organization-wide administrator consent is required. | Confirm that you can sign in to the Microsoft Entra admin center as a Global Administrator. |
| Devices joined to Microsoft Entra | Silent authentication relies on the Windows sign-in session. Devices that are only registered, or users signed in with local accounts, cannot authenticate silently. | Run dsregcmd /status and confirm AzureAdJoined: YES and AzureAdPrt: YES. |
| Users exist in Scribe with matching email addresses | Silent authentication signs in existing Scribe users. It does not create new users. | Check the Scribe admin console. |
| SSO enabled for your Scribe organization | Silent authentication requires SSO to be enabled. | Contact your Scribe representative if you are unsure. |
Step 1: Connect your Microsoft Entra tenant to Scribe
- Find your Tenant ID in the Microsoft Entra admin center by going to Overview.
- In Scribe, sign in as an organization admin.
- Go to Settings.
- Set Silent authentication to Microsoft Entra.
- Enter your Tenant ID.
- Select Consent.
- When the Microsoft sign-in page opens, sign in as a Microsoft Entra Global Administrator and approve the request.
This grants consent for both Scribe applications. Consent applies to the entire organization, so individual users are not prompted.
The Tenant ID is saved only after consent succeeds. This confirms that the connection was completed successfully. Allow approximately one minute before testing.
The consent screens list permissions for basic profile information, maintaining access, and accessing the Scribe API. The applications may appear as unverified. This is expected.
Verify administrator consent
In the Microsoft Entra admin center, go to Enterprise applications → All applications.
You should see:
- Scribe API
- Scribe Desktop API
Open Scribe Desktop API and select Permissions. The permissions should include
access_as_user and the Microsoft Graph permissions granted by an administrator.Grant consent manually
If the in-app consent flow is unavailable, sign in as a Global Administrator and approve both applications using the following links:
The first link may end on an error-looking page after consent is granted. The consent is still applied successfully.
Step 2: Confirm that users exist in Scribe
Every user who should authenticate silently must already exist in your Scribe organization.
The user’s Scribe email address must match their Microsoft Entra sign-in name. If the user does not exist in Scribe, the app displays the normal login screen instead of signing in silently.
Step 3: Add silent authentication to the Enterprise Settings file
Add the following setting to the Enterprise Settings file:
Authentication Providerentra
For example, a common Intune configuration with silent authentication, IT-managed updates, and an always-running app is:
Authentication ProviderentraIs Central DeploymentYesKeep AliveYes
Update the
$json line in your Intune delivery scripts to include the setting.The file is read when the app launches. Relaunch Scribe on any device where the app was already running.
For more information about the file location and delivery options, see Windows Desktop App: Enterprise Settings via Intune.
Step 4: Verify on one device
-
Open Command Prompt and run:
dsregcmd /status
-
Confirm that the output includes:
AzureAdJoined: YES AzureAdPrt: YES
-
Confirm that the Enterprise Settings file exists without an extension:
dir "C:\ProgramData\Scribe"
-
Confirm that the file content includes:
"authentication_provider": "entra"
- Launch Scribe as the signed-in Microsoft Entra user.
The app should reach a signed-in state within a few seconds without displaying a login prompt.
After successful verification, expand the deployment to the remaining devices.
Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| Users see the normal login screen. | Administrator consent is missing or incomplete. | Run the consent flow again as a Global Administrator. Confirm the permissions listed in Step 1. |
| Users see the login screen and consent appears complete. | The user does not exist in Scribe. | Create the user in Scribe with an email address that matches the Microsoft Entra sign-in name. |
| Only some devices display the login screen. | The device is not joined to Microsoft Entra, or the user signed in with a local or personal account. | Run dsregcmd /status on an affected device and confirm AzureAdJoined: YES and AzureAdPrt: YES. |
| Users see the login screen, but all other checks pass. | The Enterprise Settings file is missing, misnamed, invalid, or was delivered after the app launched. | Check the file path, filename, and JSON content using the Enterprise Settings guide. Then relaunch Scribe. |
| A sign-in or MFA prompt appears. | A Conditional Access policy requires user interaction. | See MFA, Conditional Access, and network requirements. |