Provide the work sign-in
How to save employees from typing their work address: the sign-in script on Windows and the device profile that does the same on a Mac.
In this step you give each device the information BeeSensible needs to sign an employee in straight to the right organisation and the right account. Employees then do not have to type a work address or pick an account when they first sign in. On Windows a sign-in script does this; on a Mac a device profile does something similar, with one difference explained under On a Mac. The step only works once your domain and identity provider are set up, as described in Identity.
On Windows
For each work account signed in on the device, the sign-in script writes the work address into the browser policy for Chrome and Edge, and into a registry key for the desktop app. The extension and the app read that address and use it as a sign-in hint. The script runs in the system context, because a standard user has no write access to those policy keys. If the device only has a local Windows account, there is no work address to write, and Intune reports the script as failed. As a result, a green tick in Intune means that an address really was written.
Download the sign-in script
Add it as a platform script
Intune: Devices → Scripts and remediations → Platform scripts → Add → Windows 10 and later.
Fill in the settings as follows
| Intune field | Enter |
|---|---|
| Run this script using the logged on credentials | No (this runs it in the system context) |
| Enforce script signature check | No |
| Run script in 64 bit PowerShell Host | Yes |
Assign to your target group
Assign the script to the security group from What you need.
Windows fetches new scripts at every restart and at regular intervals in between. If you do not want to wait, start the sync on the device itself through Settings → Accounts → Access work or school → the connected work account → Info → Sync, or with the sync button in the Company Portal app.
Intune runs the script once per device or user, and again as soon as you edit and save the script. Adding a single space is enough to make it run again, which is useful when a user was not signed in the first time. Whether the script runs again by itself for a new user on an existing device is still to be confirmed in the pilot. Not yet validated
The script does not run, or loginHint is missing
If the script does not run or loginHint is missing, the cause is usually one of these three:
- The device is not joined to Microsoft Entra ID, or the user is not signed in with a work account. Check this with
dsregcmd /status(AzureAdJoined: YES,AzureAdPrt: YES). - The user was not signed in when the script ran, so there was no profile to write to. Edit the script and save it again while the user is signed in.
- The work address is on a domain that is not verified. The script writes the hint, but the extension does not recognise it as an address of your organisation. See Identity.
In Intune, the script's Monitor section shows the status per device. On the device itself there are two logs: AgentExecutor.log shows what the script did for each user, and IntuneManagementExtension.log shows whether and when the script was delivered. Both are in this folder:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
On a Mac
There is no sign-in script on macOS, because a configuration profile on the device channel cannot carry a per-user address. Instead of the work address, you therefore tell the Mac which organisation it belongs to. At sign-in, BeeSensible then goes straight to your organisation's identity provider without the employee having to choose an organisation. This also works for someone who signs in on that Mac for the first time weeks after the rollout.
Download the profile
The console offers the profile once your organisation has a connected identity provider, and fills that provider in for you.
Rollout console, Provide work sign-inThe profile with your organisation's identity provider.Add it as a custom profile
Intune: Devices → macOS → Configuration → New policy → Templates → Custom, and choose the device channel.
Assign it
Assign the profile to the same target group as for the other steps.
Microsoft still asks for confirmation
Whether Microsoft reuses the existing sign-in on the device is decided by the operating system, not by BeeSensible. On macOS, Microsoft's Enterprise SSO plug-in and Platform SSO handle this. You deploy those yourself through Intune; without the plug-in, Microsoft asks for confirmation once. For Windows, see Automatic Microsoft sign-in. Conditional Access can always enforce an extra check.
