> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usefluency.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Silent Authentication via Microsoft Entra ID

> Enable zero-touch login for the Fluency Agent on Entra-joined Windows devices using Microsoft Entra ID.

Silent authentication eliminates manual login for users on Entra-joined Windows devices. Instead of entering credentials or clicking through browser OAuth, the Fluency Agent automatically authenticates using the user's existing Windows corporate account.

**Benefits:**

* **Zero user interaction**: no login prompts.
* **Seamless deployment**: users launch and start working immediately.
* **Centralized identity**: leverages your existing Entra ID infrastructure.

***

## Prerequisites

### IT Administrator Requirements

* Global Administrator or Application Administrator role in Microsoft Entra ID
* Access to the Fluency admin portal
* Organization uses Microsoft Entra ID (Azure AD)

### End User Device Requirements

* Windows 10 or later
* Device is Entra-joined (Azure AD joined)
* User signed into Windows with their corporate account

<Note>
  For devices that don't meet these requirements, the agent falls back to standard browser-based login.
</Note>

### Network Requirements

For silent authentication to work reliably, ensure the following Microsoft authentication endpoints are accessible from your network:

* `login.microsoftonline.com`
* `login.microsoft.com`

***

## Setup Instructions

### 1. Grant Admin Consent (One-Time)

This connects your organization's Entra ID tenant to Fluency and enables silent authentication for all users.

1. Log into the Fluency admin portal at [dashboard.usefluency.com](https://dashboard.usefluency.com).
2. Navigate to **Settings → Authentication**.
3. Click **Connect Microsoft Entra ID**.
4. Review the permissions dialog:
   * `openid` - Basic authentication
   * `profile` - User's name and username
   * `email` - User's email address
5. Click **Accept** to grant consent.
6. Verify the connection shows **Microsoft Entra ID Connected**.

<Note>
  These are delegated permissions with no elevated access. Fluency cannot read user data, emails, or files. Only basic identity information.
</Note>

### 2. Deploy the Agent

Deploy the Fluency Agent using your standard MDM deployment process (Intune, SCCM, Group Policy). See the [IT - Deploying Fluency Agent](/it-deploying-fluency-agent) guide for detailed instructions.

No changes are required. Silent auth works automatically once admin consent is granted. The same installer and deployment commands apply.

### 3. Verify

**IT administrator verification:**

* Open the Fluency admin portal → **Authentication**.
* Confirm your organization's Entra ID appears with a connected status.

**End user experience:**

1. User launches the Fluency Agent.
2. Agent silently authenticates in the background (2–3 seconds).
3. User sees the agent's home page.

***

## How It Works

When a user launches the Fluency Agent on an Entra-joined device, authentication proceeds through four stages.

### 1. Device Detection

* Agent checks whether the device is Entra-joined using `dsregcmd /status`.
* Looks for `AzureAdJoined: YES` in the output.

### 2. Silent Token Acquisition

* Agent requests an authentication token via the Windows Authentication Manager (WAM).
* WAM uses the Primary Refresh Token (PRT) from the user's Windows login.
* The PRT is device-bound and TPM-protected.

Microsoft Entra ID validates:

* PRT signature (cryptographic proof from the device TPM)
* Device compliance (if Conditional Access policies are enabled)
* Admin consent status for the Fluency application

Entra ID then returns an ID token (JWT) to the agent.

### 3. Token Exchange

* Agent sends the Entra ID token to the Fluency backend: `POST /agent/enroll/entra`.
* Backend validates the token by:
  * Verifying the JWT signature against Microsoft's JWKS keys
  * Checking issuer, audience, and expiration
  * Confirming the tenant has granted admin consent
* Provisions the user account just-in-time if it doesn't already exist.
* Generates a Fluency vision token.
* Returns the vision token and organization region to the agent.

### 4. Operation Begins

* Agent stores the vision token locally.
* Fetches the monitoring policy from the Fluency API.
* Begins observation based on that policy.

**Total time:** 2–5 seconds, completely transparent to the user.

### Fallback Behavior

If silent auth fails (for example, the device is not Entra-joined, the PRT is unavailable, or there are network issues) the agent automatically falls back to a browser-based OAuth2 flow. The user clicks **Login**, the browser opens for authentication, and then returns control to the agent.

***

## Data Privacy

What Fluency accesses via Entra ID:

* User's email address
* User's display name
* User's Entra ID object ID (internal identifier)

***

## FAQ

**Does this work on macOS?** No. Silent authentication via Entra ID is Windows-only. macOS users will see the standard browser login flow.

**What if a user's device is not Entra-joined?** The agent automatically falls back to browser-based OAuth login. No configuration is needed.

**How often does the user need to re-authenticate?** Once per device. The vision token renews automatically.

**Can users opt out?** Users on Entra-joined devices will automatically use silent auth. To opt out, they would need to use a non-Entra-joined device.

**What happens if admin consent is revoked?** New devices cannot authenticate via silent auth. Existing devices continue working until their token expires.

***

## Troubleshooting

### Admin Consent Fails

**Verify admin role:**

* Go to **Entra ID → Roles → Your user**.
* Confirm the user has the **Global Administrator** or **Application Administrator** role.

**Check tenant settings:**

* Go to **Entra ID → Enterprise applications → Consent and permissions**.
* Verify that **Users can consent to apps accessing company data on their behalf** is not blocked.

***

## Support & Contacts

Oliver Farnill (Co-Founder)

[oliver@usefluency.com](mailto:oliver@usefluency.com)

We will get back to you as soon as possible.