> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usefluency.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Connect Microsoft Entra ID so Windows agents sign in silently and users show up in Fluency automatically.

**Authentication** is where **admins** connect Microsoft Entra ID to Fluency. Once connected, Entra-joined Windows devices sign in silently, so users start capturing without a browser prompt.

Open [app.usefluency.com](https://app.usefluency.com) → **Settings** → **Authentication**.

<Frame caption="Authentication: connect Microsoft Entra ID so Windows agents sign in silently, and see tenant, consent, and connection status at a glance.">
  <img src="https://mintcdn.com/fluency/C0WOPHGTcOZ3Jq_U/images/settings-authentication.png?fit=max&auto=format&n=C0WOPHGTcOZ3Jq_U&q=85&s=792f4f0e2898f64ccc58f554595cf820" alt="Authentication settings with Microsoft Entra ID connected" width="1802" height="1074" data-path="images/settings-authentication.png" />
</Frame>

<Info>
  This page covers the product UI. For the full architecture, consent scopes, and Windows device requirements, see [Silent Authentication via Entra ID](/silent-authentication-entra-id).
</Info>

## What you'll see

When Entra ID is connected, the card shows:

| Field                   | What it means                                    |
| ----------------------- | ------------------------------------------------ |
| **Microsoft Entra ID**  | The integration status (Active or Disconnected). |
| **Tenant**              | Your Entra tenant identifier.                    |
| **Consented by**        | The admin who accepted the Entra consent prompt. |
| **Connected / Updated** | When the connection was made and last refreshed. |
| **Disable integration** | Turns off silent sign-in for new devices.        |

## Connect Entra ID

<Steps>
  <Step title="Open Authentication">
    Go to **Settings** → **Authentication**.
  </Step>

  <Step title="Click Connect Microsoft Entra ID">
    Accept the Entra consent prompt. Fluency requests only `openid`, `profile`, and `email`. No mailbox, files, or calendar access.
  </Step>

  <Step title="Deploy the agent to Windows devices">
    Entra-joined Windows devices enroll without a browser prompt. See [Silent Authentication](/silent-authentication-entra-id) and [IT deploy](/it-deploying-fluency-agent) for the rollout steps.
  </Step>

  <Step title="Verify users are capturing">
    Open [Users](/settings-users) and confirm your fleet shows **Capturing**.
  </Step>
</Steps>

<Tip>
  Silent sign-in only works on Entra-joined Windows devices. macOS and non-Entra Windows devices fall back to a one-time browser sign-in.
</Tip>

## Disable the integration

Click **Disable integration** to turn off silent sign-in.

* New devices will no longer enroll silently.
* Existing devices keep working until their tokens expire.
* Users can still sign in with browser OAuth.

<Warning>
  Disabling Entra ID does not sign anyone out immediately. If you need to cut access now, revoke the token in Entra as well.
</Warning>

## Related

<CardGroup cols={2}>
  <Card title="Silent Authentication" icon="key" href="/silent-authentication-entra-id">
    Architecture, scopes, and device requirements.
  </Card>

  <Card title="Deploy the agent" icon="rocket" href="/it-deploying-fluency-agent">
    Roll out to Windows and macOS fleets.
  </Card>

  <Card title="Users" icon="user" href="/settings-users">
    Confirm users are capturing after connect.
  </Card>

  <Card title="PII Protection" icon="shield" href="/settings-pii-protection">
    Control what Fluency captures.
  </Card>
</CardGroup>