SSO Auto Login signs users in to the HPE Networking SSE agent with the Microsoft Entra ID identity they already used to sign in to Windows, so they don't have to sign in twice. The agent uses the Windows Web Account Manager (WAM) and the Windows session's Primary Refresh Token (PRT).

Since users are not prompted again, you can set a shorter re-authentication interval. Changes made in Entra ID then reach HPE Networking SSE sooner.

• Authentication belongs to the user signed in to Windows. On devices with more than one user, each Windows user's tokens and sessions are kept separate.
• Entra ID Conditional Access policies and MFA are always enforced. Windows Hello for Business is supported.

Login Modes

• Manual (default) – The user signs in to the agent interactively.
• Auto Login – The agent signs in automatically on startup. A progress indicator appears, but there's no credential prompt.
• Auto Login + Minimize on start up – The agent starts minimized in the system tray and signs in and re-authenticates in the background. This option provides a silent login experience.

Prerequisites

• An Azure (Entra) IdP set up in HPE Networking SSE. See Azure (Entra) IdP Integration.
• Users provisioned to HPE Networking SSE. See SCIM Provisioning with Azure (Entra).
• Devices running Windows 11 Pro or Enterprise that are Microsoft Entra ID joined or hybrid Active Directory joined.
• HPE Networking SSE Agent version 3.107.

Step 1: Create an App Registration for the HPE Networking SSE Agent in Entra ID

1. Create an app registration with the following settings:
   • Application type
   • Supported account types (single tenants)
   • Redirect URI (Mobile and desktop applications)
   • Allow public client flows (Authentication > Advanced settings)
   • Client secret
   • API permissions (Microsoft Graph, Delegated)
2. Copy the Application (client) ID and the Tenant ID.

Step 2: Enable SSO Auto Login

1. In the Management Console, go to Settings > Identity Providers.
2. Hover over your Azure IdP and select the edit option.
3. Go to Advanced Settings > Atmos Agent SSO.
4. Turn on the auto-login option.
5. Enter the Tenant ID and Application ID.
6. Click Save and then click Commit Changes.

Step 3 (optional): Enable Silent Login

Silent Login requires SSO Auto Login to be on. Contact HPE Support to enable Silent Login

Changes in Entra ID reach HPE Networking SSE when the agent re-authenticates. To keep the two in sync, set a shorter agent application authentication lifetime on the IdP.

Important Points

• SSO Auto Login and Silent Login are off by default for both new and upgraded tenants. Upgrading the agent doesn't change existing sign-in behaviour.
• When you turn either setting on, it applies at the next authentication event (sign-in, session renewal or agent restart). You don't need to reinstall the agent.
• When you turn SSO Auto Login off, the agent goes back to interactive sign-in at the next authentication event.
• The agent falls back to interactive sign-in when:
  • The Windows session has no valid PRT.
  • The device isn't Entra ID joined or hybrid joined.
  • Conditional Access requires step-up authentication. An interactive WAM prompt appears.
  • When authentication fails.

Integration with Other Features

• Multiple IdP – This feature is not supported when customer is configured for multiple IDP.
• Machine Token – Machine Token works alongside Auto Login. When the user logs out, Machine Token behaves as it does today.