Auto login signs your people into the Kadence Agent when they start their computer, using the identity your company already trusts — Microsoft Entra or Okta on Windows and Mac, and Google Workspace on Chromebooks. There's no Kadence password and no Kadence sign-in form.

On Windows with Entra, it's silent from the very first launch. On a Mac, on a Chromebook, or with Okta, the first launch asks for one step — every launch after that is silent.

The first launch depends on platform and identity provider. Every launch after that is silent.

If auto login can't run on a device — the configuration is missing, or the sign-in is declined — the agent quietly shows its normal sign-in screen instead.

This guide is for IT administrators. It covers the one-time setup: prepare your identity provider, configure Kadence, generate your device configuration, and roll it out with your device management (MDM) service.

You'll need:

Pick the identity provider your company already uses for Kadence sign-in on Windows and Mac, and follow that section. If you also have Chromebooks, follow Option C as well.

Kadence ships its own Entra application, so you don't create one or share a client secret. You grant it permission to run in your tenant and, on Macs, add the Microsoft sign-in extension.

Create a dedicated Okta application for the agent. Keep it separate from the Okta application you already use for Kadence browser sign-in — the two must not be shared.

When the application is created, note two values for Step 2:

Kadence ships its own Google sign-in client, so there's nothing to create in Google Cloud and no client ID to enter.

You enter these values once. Kadence puts the right values into the device configuration for you in Step 3, so there's nothing to copy by hand and nothing to keep in sync across two places.

Kadence builds the exact configuration file each platform needs, filled in with your workspace's values. You don't write these by hand — they're standard formats any MDM can deploy.

Deploy three things: the Kadence Agent app, the auto login configuration from Step 3, and — for Entra on macOS — Microsoft's sign-in extension.

The configuration files are standard formats, so any MDM handles them.

The steps below use Microsoft Intune as a worked example — the same items apply in any MDM, each deploying the platforms it manages.

For Chromebooks, you deploy the app and its configuration from the Google Admin console instead — see 4d.

Install the latest agent. These links always point at the current production build:

Deploy the file as an app and assign it to your device or user groups.

macOS: deploy kadence-agent.mobileconfig from Step 3 as a configuration profile, assigned to the same devices as the agent.

Any MDM that accepts a custom Apple configuration profile takes this file unchanged.

Windows: deploy kadence-agent-intune.ps1 from the zip as a device policy script, assigned to the same devices. It runs in the system context and writes the agent's policy settings under HKLM\SOFTWARE\Policies\Kadence\Agent.

On-premises fleets can deploy kadence-agent-policy.reg through Group Policy instead. Deploy one, not both.

For Entra on Macs, the device also needs Microsoft's own sign-in components.

These are Microsoft's, not any one MDM's, so any MDM that supports the macOS single sign-on extension payload can deliver them.

Each user signs into Company Portal once. This registers the Mac with Entra and is the one-time step behind the "one account picker" first launch.

On Chromebooks, the Google Admin console installs the agent and delivers its configuration in one place.

If the agent shows its normal sign-in screen instead, see Troubleshooting below.

For setup support, reach out to:
📩 [email protected]

See also:
📄 Kadence Agent Setup & Management Guide
📄 Use the Kadence Agent