--- title: "How SSO Works on Windows Devices with Scalefusion|Authentication Guide" slug: "how-sso-works-on-windows-devices" description: "Learn how SSO works on Windows devices using Scalefusion MDM for seamless SSO authentication. Discover step-by-step instructions to manage user authentication, OTP generation, and compliance checks for secure access." tags: ["Windows device authentication", "secure login Windows devices", "Scalefusion SSO", "sso for Windows", "windows sso", "Windows SSO authentication", "SSO Windows devices"] updated: 2025-04-24T08:54:23Z published: 2025-04-24T08:54:23Z canonical: "help.scalefusion.com/how-sso-works-on-windows-devices" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt > Use this file to discover all available pages before exploring further. # End User Experience on Windows Devices Once SSO configuration is created, users can sign in to the application when authenticated. The document describes how Scalefusion authenticates any user using SSO Configuration when they try to sign in to Gmail on Windows devices. ## Pre-requisites 1. [SSO Configuration](/docs/configure-app-with-ssoconfiguration) is created on Scalefusion Dashboard 2. Users have been assigned with the SSO configuration 3. Authenticator app is available on device (on device managed by Scalefusion and OneIdP user is logged in to the device) 4. [Scalefusion MDM agent](/docs/scalefusion-mdm-agent-application) is installed on device ### Case 1: Device is Unmanaged (not enrolled with Scalefusion) On Windows devices which are unmanaged you can sign in to the application with an OTP. Let us assume in the SSO configuration, the Conditional Access > Device Policy is configured to allow access to Gmail application **If the device is managed by Scalefusion or an OTP using OneIdP Authenticator app from a managed device**. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1718090121925.png) ### Prerequisite - One another device enrolled with Scalefusion having Authenticator app, should be available. ### Steps Following steps are to be performed on an **unmanaged Windows** device: 1. Open Chrome browser and type **www.gmail.com** in the address bar 2. On the **Sign in** screen, enter your email (the user's email to which you have assigned the application in SSO configuration). Click **Next** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1717403748728.png) 3. You will be redirected to **OneIdP** sign in page. Enter your email id and password and click on **Sign In**. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745483555187.png) 4. On the next screen, click on **Check Compliance & Sign In** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745483700974.png) 5. Please wait for the authentication.![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745483779420.png) 6. On the next screen you will be asked to enter the **OTP** generated on Authenticator app. At this point, go to the device enrolled with Scalefusion and click on **Authenticator app** to get the OTP. **Note**: Here we have shown a Windows device enrolled in Scalefusion with SSO configurations applied. It can be any other device also managed by Scalefusion. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1718091208125.png) 7. The OTP that is shown inside Authenticator app needs to be entered here on your unmanaged windows device. Enter **OTP** and click on **Log in** **![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745484778138.png)** 8. Once authentication takes place, you will be signed in to **Gmail** with that user. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1718362995057.png) ## Case 2: Device is managed by Scalefusion Let us assume in the SSO configuration, the Conditional Access > Device Policy is configured to allow access of application only if **Device is managed by Scalefusion.** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1718092596161.png) ### Prerequisite - Device should be enrolled with Scalefusion with Authenticator app on it. ### Steps Following steps are to be performed on a **managed Windows** device: 1. Open Chrome browser and type **www.gmail.com** in the address bar 2. On the **Sign in** screen, enter your email (the user's email to which you have assigned the application in SSO configuration). Click **Next** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1717403748728.png) 3. You will be redirected to **OneIdP** sign in page. Enter your email id and password and click on **Sign In**. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745483983900.png) 4. On the next screen, click on **Check Compliance & Sign In** **![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745484012661.png)** 5. Please wait for the authentication. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745484078006.png) 6. You will get a pop-up to allow opening Gmail. Click on **Open** ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1745484266348.png) 7. Once authentication completes, you will be signed in to the gmail account. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-1718363044133.png)