This guide sets up the Scribe desktop app on Windows for silent authentication, so users are signed in with their Microsoft Entra identity without any prompt. It assumes the app is deployed (Windows desktop app - install via Intune) and that you deliver an Enterprise Settings file to devices (Windows desktop app - Enterprise Settings via Intune); silent authentication is one key in that file.
Order matters. The app reads the Enterprise Settings file when it launches and then signs in silently. On a test device, complete Step 1 from this guide, add the key to the file, and relaunch the app. For the rollout to users, do Step 1 and deliver the file before the app itself, so each user's first launch signs in.
Prerequisites
| Requirement | Why | How to check |
|---|---|---|
| Microsoft Entra ID tenant, with Global Administrator access | A one-time, organisation-wide consent is needed | - |
| Devices Entra-joined | The app relies on the Windows sign-in session. A device that is only registered, or a user signed in with a local account, cannot sign in silently | dsregcmd /status shows AzureAdJoined: YES and AzureAdPrt: YES |
| Users exist in Scribe with emails matching their Entra sign-in names | Silent authentication signs in existing users; it does not create them | Your Scribe admin console |
| SSO enabled for your Scribe organisation | Silent authentication requires it | Ask your Scribe contact |
Step 1 - Connect your Entra tenant to Scribe
Find your Tenant ID: Microsoft Entra admin center → Overview.
- In Scribe, as an organisation admin, go to Settings → set Silent authentication to Microsoft Entra → enter your Tenant ID → Consent.
- A Microsoft page opens. Sign in as an Entra Global Administrator and approve. This grants consent for both Scribe applications at once.
Consent applies to your whole organisation; individual users are never prompted. The Tenant ID is saved only once consent succeeds, which is how you know it worked. Allow a minute before testing.
The consent screens list sign-in permissions (basic profile, maintain access, access the Scribe API) and show the applications as "unverified". That is expected.
To check afterwards: Entra admin center → Enterprise applications → All applications. Scribe API and Scribe Desktop API are listed, and Scribe Desktop API's Permissions page shows access_as_user alongside the Microsoft Graph permissions, granted by an administrator.
If the in-app flow is unavailable for any reason, open each of these as a Global Administrator and approve:
Scribe API application:
Scribe Desktop API application:
The first is the Scribe API application, the second the Scribe Desktop API application. The first currently ends on an error-looking page; the consent is granted regardless.
Step 2 - Make sure your users exist in Scribe
Every user who should be signed in silently must already exist in your Scribe organisation, with an email matching their Entra sign-in name. A user who is not in Scribe gets a normal login screen.
Step 3 - Add silent authentication to the Enterprise Settings file
Add this key to the file you deliver per the Enterprise Settings guide:
For example, a common Intune deployment with silent authentication looks like this:
Update the $json line in your delivery scripts accordingly. The file is read at launch: relaunch the app on any device that already had it running.
Step 4 - Verify on one device
- dsregcmd /status: AzureAdJoined: YES, AzureAdPrt: YES.
- dir "C:\ProgramData\Scribe" shows Enterprise Settings with no extension, and its content includes the key.
- Launch the app as the signed-in Entra user. It reaches a signed-in state within a few seconds, with no prompt.
- Then widen the rollout.
Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| Users get a normal login screen | Consent missing or incomplete | Re-run consent as Global Administrator and check the permissions listed in Step 1 |
| Login screen, consent looks fine | The user does not exist in Scribe | Create the user with an email matching their Entra sign-in name |
| Login screen on some devices only | Device not Entra-joined, or the user signed in to Windows with a local or personal account | dsregcmd /status on an affected device |
| Login screen, everything above checks out | The Enterprise Settings file is missing, misnamed, invalid, or landed after the app launched | Check the file per the Enterprise Settings guide; relaunch the app |
| A sign-in or MFA prompt appears | A Conditional Access policy requires interaction | See MFA, Conditional Access and network requirements |