Auto login signs your people into the Kadence Agent when they start their computer, using the identity your company already trusts — Microsoft Entra or Okta. There's no Kadence password and no Kadence sign-in form.

On Windows with Entra, it's silent from the very first launch. On a Mac, or with Okta, the first launch asks for one step — every launch after that is silent.

Auto login currently supports Windows and macOS with Microsoft Entra or Okta. ChromeOS support is in progress.

If your company uses Google Workspace as its identity provider on Mac or Windows, auto login isn't available yet.

What Your People Will See

The first launch depends on platform and identity provider. Every launch after that is silent.

Platform + Identity Provider	First Launch
Windows + Entra	Nothing — not even the first time. The Windows sign-in already holds the credential the agent uses.
macOS + Entra	A Microsoft account picker — the person picks their account, no password. The Mac must be registered with Entra through Company Portal (Step 4c).
Windows + Okta	An embedded window shows the Okta sign-in once. With Okta Verify or FastPass, there's nothing to type.
macOS + Okta	The browser opens for one Okta sign-in.

If auto login can't run on a device — the configuration is missing, or the sign-in is declined — the agent quietly shows its normal sign-in screen instead.

One exception: if a person's identity is verified but their email doesn't match anyone in your Kadence workspace, the agent shows "Contact your admin." See Troubleshooting below.

Before You Begin

This guide is for IT administrators. It covers the one-time setup: prepare your identity provider, configure Kadence, generate your device configuration, and roll it out with your device management (MDM) service.

You'll need:

An administrator for your identity provider (Entra or Okta), for your MDM, and for Kadence (directory-sync access)
Managed devices — Auto login runs only on devices your company manages through an MDM service — never on unmanaged or personal machines
Supported systems — macOS 26 or later, and Windows 10/11. For Entra, Windows devices must be Microsoft Entra joined
Your Kadence workspace connected to your login provider — once this is complete, you'll be able to generate the required configuration files and deploy them

Kadence generates the device configuration for you as standard files — an Apple configuration profile for macOS and Windows policy settings — so any MDM can deploy them.

Step 1: Prepare Your Identity Provider

Pick the identity provider your company already uses for Kadence sign-in, and follow that section.

Option A: Microsoft Entra

Kadence ships its own Entra application, so you don't create one or share a client secret. You grant it permission to run in your tenant and, on Macs, add the Microsoft sign-in extension.

Grant admin consent to the Kadence Desktop Agent application in your Entra tenant. Have an Entra admin visit this URL and click Grant.
Note your Entra tenant ID (Directory ID) — you'll paste it into Kadence in Step 2. Find it in the Entra admin center under Overview for your tenant.
Windows devices need no further identity setup, as long as they're Microsoft Entra joined. The Windows sign-in already holds the credential the agent uses.
macOS devices need the Microsoft Enterprise SSO plug-in and Company Portal. You'll deploy both through your MDM in Step 4, and each user signs into Company Portal once to register their Mac — this is standard Microsoft setup.

Kadence configures the identity token claims on its side. You don't need to set optional claims in Entra.

Option B: Okta

Create a dedicated Okta application for the agent. Keep it separate from the Okta application you already use for Kadence browser sign-in — the two must not be shared.

In the Okta Admin Console, go to Applications → Create App Integration.
Choose OIDC — OpenID Connect, then application type Native Application. Select this exactly — a Native app uses PKCE and holds no client secret, which is what the agent needs.
Under Grant type, tick Authorization Code and Refresh Token. The refresh token is what lets later launches stay silent.
Set the Sign-in redirect URI to exactly: co.kadence.kadence-agent:/callback
Under Assignments, assign the application to the people or groups who will use the agent.
Check the application's sign-on policy lets your assigned users authenticate. The one-time first-launch sign-in follows this policy.

When the application is created, note two values for Step 2:

Your Okta org URL (for example https://your-company.okta.com) — use the plain org URL, not a custom authorization server address
The application's Client ID

Step 2: Configure Auto Login in Kadence

In Kadence, open Settings → Integrations → Auto login (directory-sync access required).
Choose your identity provider and enter its details:
- Entra: your Tenant ID from Step 1
- Okta: your Okta org URL and the agent application's Client ID from Step 1
Email claim order is optional. Leave the defaults unless your directory puts a person's real email somewhere other than the standard claim — for example, an Entra tenant synced from on-premises Active Directory, where the sign-in name is the reliable value. If unsure, leave it as is.
Click Save.

You enter these values once. Kadence puts the right values into the device configuration for you in Step 3, so there's nothing to copy by hand and nothing to keep in sync across two places.

Test with one person first. A wrong value here stops auto login for your whole workspace — confirm it works for a single user before rolling out to everyone.

Step 3: Generate Your Device Configuration

Kadence builds the exact configuration file each platform needs, filled in with your workspace's values. You don't write these by hand — they're standard formats any MDM can deploy.

On the same auto login settings screen, use Download configuration.
Download the file for each platform you deploy to:
- macOS: kadence-agent.mobileconfig — an Apple configuration profile
- Windows: a zip containing kadence-agent-intune.ps1 (a device policy script for Intune or any MDM that runs scripts) and kadence-agent-policy.reg (for on-premises fleets using Group Policy). Deploy one of the two, not both.
Keep these files for Step 4. If you later change any value in Step 2, download the files again — the old ones go out of date.

The configuration contains no passwords or secrets. It tells the agent which identity provider, which Kadence workspace, and which region to use.

Step 4: Deploy With Your MDM

Deploy three things: the Kadence Agent app, the auto login configuration from Step 3, and — for Entra on macOS — Microsoft's sign-in extension.

The configuration files are standard formats, so any MDM handles them.

The steps below use Microsoft Intune as a worked example — the same items apply in any MDM, each deploying the platforms it manages.

4a. The Kadence Agent App

Install the latest agent. These links always point at the current production build:

macOS (covers Intel and Apple Silicon): https://static.onkadence.co/kadence-agent/latest/kadence-agent-latest-universal.pkg
Windows (64-bit): https://static.onkadence.co/kadence-agent/latest/kadence-agent-latest-x64.msi
Windows (Arm): https://static.onkadence.co/kadence-agent/latest/kadence-agent-latest-arm64.msi

Deploy the file as an app and assign it to your device or user groups.

In Intune: add the .pkg as a macOS app and the .msi as a Windows app.

4b. The Auto Login Configuration

macOS: deploy kadence-agent.mobileconfig from Step 3 as a configuration profile, assigned to the same devices as the agent.

Any MDM that accepts a custom Apple configuration profile takes this file unchanged.

In Intune: Devices → Configuration → Create → macOS → Templates → Custom, and upload the .mobileconfig.

Windows: deploy kadence-agent-intune.ps1 from the zip as a device policy script, assigned to the same devices. It runs in the system context and writes the agent's policy settings under HKLM\SOFTWARE\Policies\Kadence\Agent.

On-premises fleets can deploy kadence-agent-policy.reg through Group Policy instead. Deploy one, not both.

In Intune: Devices → Scripts and remediations → Platform scripts → Windows, upload the .ps1, and assign it.

4c. macOS with Entra Only: The Microsoft Sign-In Extension

Windows with Entra, macOS with Okta, and Windows with Okta need no sign-in extension — skip 4c for those.

For Entra on Macs, the device also needs Microsoft's own sign-in components.

These are Microsoft's, not any one MDM's, so any MDM that supports the macOS single sign-on extension payload can deliver them.

Deploy Company Portal for macOS as a macOS app.
Deploy a Single sign-on app extension profile of type Microsoft Entra ID, assigned to your Macs.

This is Microsoft's Enterprise SSO plug-in, so every field is a fixed Microsoft value — not something Kadence provides — and is the same for every organization:

Field	Value
Extension Identifier	`com.microsoft.CompanyPortalMac.ssoextension`
Team Identifier	`UBF8T346G9` (Microsoft's Apple team ID, not Kadence's)
Type	Redirect
URLs	`https://login.microsoftonline.com` `https://login.microsoft.com` `https://sts.windows.net`

Each user signs into Company Portal once. This registers the Mac with Entra and is the one-time step behind the "one account picker" first launch.

Step 5: Confirm It Works

On a test device that has the app and the configuration, sign the user in and start the Kadence Agent.
Expect the first-launch step for that platform and provider (see What Your People Will See above), then a signed-in agent.
Restart the device and start the agent again. This time it should sign in with nothing shown.

If the agent shows its normal sign-in screen instead, see Troubleshooting below.

Troubleshooting

The agent shows the normal sign-in screen

Auto login couldn't run and fell back safely. Common causes:

The device configuration is missing, or was changed by hand and is now invalid. Re-download it from Kadence (Step 3) and redeploy it unchanged.
Auto login isn't yet enabled for your workspace. Confirm with your Kadence contact.
The device is unmanaged, or is on a platform or identity provider that auto login doesn't support. Those users keep the normal sign-in.

One person is asked to "Contact your admin"

Their identity was verified, but their email doesn't match any Kadence user in your workspace. Check that the person exists in Kadence under the same email your identity provider holds for them.

Okta: nobody can sign in silently

Confirm the agent's Okta application grants offline_access and has both Authorization Code and Refresh Token grant types (Step 1, Option B).

Entra on macOS: the account picker or a sign-in comes back every launch

The Mac isn't staying registered with Entra. Confirm Company Portal is installed and the user has signed into it, and that the Single sign-on app extension profile is assigned (Step 4c).

Entra: no Entra user can sign in

Confirm admin consent was granted to the Kadence Desktop Agent application in your tenant (Step 1, Option A).

Need Help?

For setup support, reach out to:
📩 [email protected]

Set Up Kadence Agent Auto Login