Skip to main content
Version: 11.3.0

(Windows) Desktop SSO in Embedded Browsers

An embedded browser is a browser view drawn inside a desktop application rather than a standalone browser window. The Microsoft 365 sign-in dialog is the common example. HYPRspeed works in a standalone browser window with no endpoint configuration, but in an embedded browser it needs two Windows settings applied to the endpoint first.

Both settings act on Windows and on the Entra sign-in broker, not on HYPR and not on a browser. Neither is applied by default, and either one on its own produces no visible change, so apply both.

Requirements​

  • Windows 11 24H2 or later, on build 26100.7462 or 26200.7462 and above. The first setting below is a policy Microsoft added in those builds.
  • Administrative access to endpoint configuration, through Group Policy or your endpoint management tool. Neither setting requires cloud management.

Windows 11 23H2 and earlier, all Windows 10 versions, and the LTSC editions cannot apply the first setting, so Desktop SSO in an embedded browser is not available on them. Users on those versions sign in through the fallback link on the HYPR sign-in page instead. Size that population before you begin rather than discovering it during rollout.

Set the Rendering Engine for Entra Sign-In​

This policy tells Windows to render the Entra sign-in page with a modern engine, so the HYPR sign-in page can run at all. Without it nothing is attempted and the dialog simply waits.

New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\AAD' `
  -Name 'WebView2Integration' -Value 1 -PropertyType DWord -Force | Out-Null

To deploy it, set the same value through either mechanism:

MechanismWhere
Group PolicyComputer Configuration > Preferences > Windows Settings > Registry, as an Update action on HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AAD, value WebView2Integration, type REG_DWORD, data 1
IntuneSettings Catalog

Group Policy Preferences is the mechanism to use rather than Administrative Templates, because no ADMX template defines this value.

This setting is machine-wide

The policy changes the rendering engine for Entra authentication everywhere on the endpoint, not only for HYPR. Pilot it on a representative group before a broad rollout.

Allow the Sign-In Broker to Reach the HYPR Agent​

The Entra sign-in broker runs in an isolated container that cannot reach loopback addresses, so its request to the local HYPR agent never arrives. Exempting the broker's package from that isolation allows the request through.

CheckNetIsolation.exe LoopbackExempt -a -n="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy"

The package name is the same on every Windows endpoint, so it can be used as written.

The exemption does not persist

Windows updates and package servicing clear the exemption, which returns affected users to a sign-in dialog that waits and never completes. Whichever mechanism you choose must re-apply the exemption rather than set it once.

Run it as SYSTEM, on a schedule that repeats:

MechanismWhereRuns
Group PolicyComputer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup > PowerShell ScriptsEvery boot, before the broker starts
IntuneA remediation script, in 64-bit PowerShell and SYSTEM contextOn the schedule you set

A startup script suits this well: it runs before the sign-in broker starts and re-applies the exemption after an update has cleared it. What Group Policy gives up against Intune is compliance reporting, since a startup script cannot tell you which endpoints are currently in the desired state.

Never clear the whole exemption list

CheckNetIsolation.exe LoopbackExempt -c clears the exemption for every application on the endpoint, not only the sign-in broker. Add and list entries only. To see the current list, use CheckNetIsolation.exe LoopbackExempt -s.

Restart the Endpoint​

The sign-in broker starts at logon and does not pick up either setting while it is running. Restart the endpoint after applying both. Closing and reopening the desktop application is not sufficient.

Confirm It Works​

Sign in to a resource that presents the embedded dialog. HYPRspeed activates and the user reaches the resource without being asked to authenticate again.

If it still waits, check both settings and confirm the endpoint has restarted. The HYPR agent listens on the Workstation Port, 51992 by default, so a connection from the embedded browser process to that port that opens and completes is the signal that both settings are in effect. Where a requirement is not met, HYPRspeed does not activate and the user signs in to the resource normally.