Microsoft Entra ID Single Sign-On (SSO) provides silent authentication for MyQ Desktop Client on Windows. When Desktop Client starts on a supported joined device, it can use the signed-in Windows identity to obtain an Entra ID token and authenticate the user to MyQ without prompting for credentials.
Compared with Integrated Windows Authentication (IWA), Entra ID SSO is based on Microsoft cloud identity rather than Kerberos or NTLM. It is usually the preferred silent-authentication option for cloud-first or hybrid environments where Windows devices meet the required Entra ID join conditions.
Prerequisites:
Before deploying Entra ID SSO, make sure:
-
MyQ Print Server 10.2 patch 6 or later is installed.
-
MyQ Desktop Client is running Windows. Entra ID SSO is not supported on macOS.
-
Windows devices are Entra ID joined, Active Directory joined, or hybrid joined.
-
MyQ is connected to Microsoft Entra ID
-
Sign in with Microsoft is enabled for the authentication server in MyQ > Settings > Authentication Servers.
Configure the Microsoft Entra Application
Entra ID SSO uses the Microsoft Entra application configured for the MyQ Entra ID connection. The application requires additional configuration for MyQ Desktop Client SSO, including the appropriate redirect URI and client configuration.
If MyQ manages the application automatically, the required configuration can be created or updated during authorization. If your organization manages the application manually, configure the Desktop Client SSO settings in the existing MyQ application registration.
How Entra ID SSO Works
When MyQ Desktop Client starts:
-
Desktop Client requests an Entra ID token using the identity of the signed-in Windows user.
-
If the device and user meet the Entra ID authentication requirements, Microsoft issues the token without requiring user interaction.
-
Desktop Client uses the token to authenticate the user to MyQ.
When silent authentication succeeds, the user does not enter MyQ or Microsoft credentials in Desktop Client.
Authentication Fallback
If Entra ID SSO cannot authenticate the user, Desktop Client can fall back to other configured authentication methods:
-
Integrated Windows Authentication (IWA), if enabled.
-
Manual sign-in, if enabled.
If both Entra ID SSO and IWA are enabled, Entra ID SSO is attempted first.
This combination can be useful in hybrid environments. Devices that meet the Entra ID SSO requirements can authenticate through Entra ID, other supported domain-joined Windows devices can use IWA, and remaining users can use a configured manual authentication method.