Book a demo
Single sign-on for desktop · add-on

Single sign-on for Windows desktop apps, including the old ones.

Most single sign-on stops at the browser. Single sign-on for desktop extends My1Login to applications that run as executables on Windows, from legacy finance packages to Remote Desktop programs, Citrix and mainframe emulators. The desktop agent fills in the sign-in for your workforce, so the app opens and they're already in.

Book a 5-minute demoSee pricing
What J. Morgan sees: Sage, already signed in.
  • ExecutablesWindows desktop apps, including legacy software
  • Remote Desktopprograms run over Remote Desktop
  • Citrixpublished and virtualised apps
  • Mainframeterminal emulators and green screens

Your workforce doesn't only work in a browser.

Finance packages, line-of-business systems, Citrix-published apps and terminal emulators hold some of the most sensitive logins in any organisation, and cloud single sign-on can't reach them. Single sign-on for desktop brings them under the same sign-in, policies and audit trail as your web apps.

Web-only single sign-on

  • Stops at the browser
  • People type passwords into desktop apps
  • Desktop passwords get written down and reused
  • Desktop sign-ins aren't recorded
  • Old apps need custom integration work

With single sign-on for desktop

  • Covers apps that run as executables on Windows
  • The desktop agent fills them in
  • Passwords can be hidden and follow your policy
  • Desktop sign-ins in the same audit trail as web apps
  • Set up from a template, with no APIs needed

Desktop single sign-on, from setup to the last day.

Follow one desktop app from the moment IT sets it up to the day someone who uses it leaves. IT sets the rules at every step, and your workforce never types a password.

  1. 1Set upApp templates
  2. 2DeployedDesktop agent
  3. 3Signed inDesktop, RDP, Citrix
  4. 4ProtectedPassword policy
  5. 5LoggedAudit trail
  6. 6Access revokedOff-boarding
Step 1 · Set up

Set up each app once, from a template.

IT defines a template for each desktop app in the My1Login admin area: where the program lives, any command-line arguments it needs and which credentials it uses, with some simple scripting where an app needs it. There's no need to change the app or have an API.

  • Grouped credentials. Apps that share a login can share a credential policy, so their passwords stay in step.
  • Step-by-step guidance. How to define a desktop app template
Step 2 · Deployed

The desktop agent does the typing.

The My1Login desktop agent runs on your Windows PCs, and IT deploys it centrally through Group Policy, Microsoft Intune or both, so nobody installs anything themselves. With Zero Login, people are signed in to My1Login as soon as they sign in to Windows with their directory account, so the agent is ready before they open their first app.

  • Zero UI. The agent works in the background, with nothing new on screen.
  • Nothing to learn. People open their apps the way they always have.
Step 3 · Signed in

Old software, remote apps and green screens.

When someone opens a desktop app, from the Windows desktop or from the My1Login vault, the agent recognises the sign-in screen and fills in the username and password. It works the same way for programs on the PC, Remote Desktop programs, Citrix-published apps and mainframe emulators.

  • Started however people like. Most apps can be started from the Windows desktop or the My1Login vault. A small number of external applications restrict how they can be signed in to, so those are started from the vault instead.
  • Several accounts per app. People with more than one identity pick the right one, without typing a password.
Step 4 · Protected

Desktop passwords nobody writes down.

Passwords for desktop apps can be hidden from your workforce and generated to your policy, just like web apps. People can't write down, reuse or hand over a password they've never seen.

  • A policy for each app. Length, characters and how often it changes.
  • Grouped apps stay in step. A change to a shared login applies to every app that uses it.
Step 5 · Logged

Desktop sign-ins in the same audit trail.

Every desktop sign-in is recorded alongside web sign-ins: who opened which app, and when. Compliance reviews and investigations get one record instead of two.

  • Ready-made and custom reports. For audits, access reviews and software asset management.
Step 6 · Access revoked

Leavers lose desktop access too.

Disable someone in your directory and My1Login stops signing them in to every desktop and web app. They never knew the passwords, so there's nothing for them to use from another machine.

  • One switch for web and desktop. No separate list of desktop accounts to chase.
Builds on

An add-on to single sign-on for web.

Together they give your workforce one sign-in for web, cloud, mobile and desktop apps, with one set of policies and one audit trail.

See single sign-on for web

And the details that make it work.

  • Zero Login

    Signing in to Windows with a directory account signs people in to My1Login automatically.

  • Zero UI

    Nothing for your workforce to learn. The agent works in the background.

  • Several accounts per app

    People with more than one login for an app choose the right one from a list.

  • Command-line arguments

    Templates can pass the right settings to an app when it starts from the vault.

  • Desktop apps that use web logins

    Some desktop apps ask for a web account's login, such as accountancy software that posts filings through Government Gateway. My1Login fills those in too, so nobody has to see or copy the password.

  • Signed in, no extra clicks

    My1Login fills in the username, password and code and submits them, so people aren't clicking through each step. Password managers that fill in codes usually still leave that to the user.

  • Passwords never seen

    People don't see or copy desktop app passwords, so they can't share or reuse them.

  • Every sign-in recorded

    Desktop sign-ins sit in the same audit trail as web apps: who, which app and when.

Zero-knowledge encryption

We can't read your passwords. Nobody outside your organisation can.

The keys that unlock your stored passwords are only available inside your organisation's own network. What My1Login stores is encrypted and unreadable to anyone outside it, and that includes us.

Where the encryption keys are kept Your organisation's network holds the encryption keys and your workforce's sign-ins. Only encrypted passwords travel to and are stored in the My1Login service, which has no keys and cannot read them. YOUR ORGANISATION'S NETWORK Encryption keys Only ever here Your workforce Signed in to their apps encrypted MY1LOGIN SERVICE Encrypted passwords No keys here, so nobody at My1Login can read them

Independently recognised

  • KuppingerCole Leadership Compass 2025My1Login featured in the Privileged Access Management report
  • SC Awards Europe 2025, winnerBest Identity and Access Management Solution
  • Cyber Essentials PlusCertified. Penetration tested by CREST-approved testers: rated A+ and suitable for use in defence
Trust centreSecurity overview (PDF)

Part of one platform, with one policy and one log.

Single sign-on for desktop shares its directory connection, policies and audit trail with the rest of My1Login.

Setting up desktop single sign-on

Desktop single sign-on questions

What is desktop single sign-on?

Desktop single sign-on signs people in to applications installed on their Windows PC, not just to web apps in the browser. My1Login's desktop agent fills in the username and password when the app asks for them.

Do we need single sign-on for web as well?

Yes. Single sign-on for desktop is an add-on to single sign-on for web, so web, mobile and desktop apps share one sign-in, one set of policies and one audit trail. See single sign-on for web

Which desktop apps does it work with?

Applications that run as executables on Windows, including legacy software, Remote Desktop programs, Citrix-published apps and mainframe emulators. Most can be started from the Windows desktop or the My1Login vault. Because of limitations in a small number of external applications, those few need to be started from the vault instead.

Do our applications need changing?

No. Each app is set up from a template in the My1Login admin area, with some simple scripting where it's needed, and no APIs or changes to the application. My1Login's Customer Success team can help.

How is the desktop agent deployed?

IT deploys the desktop agent centrally through Group Policy, Microsoft Intune or both, so nobody in your workforce installs anything themselves. It supports Windows 10 and later.

Can My1Login see our passwords?

No. With zero-knowledge encryption the keys are only available inside your organisation's network, so nobody outside it can read your stored passwords, including My1Login.

What does the adoption guarantee cover?

Adoption is guaranteed wherever the zero-login configuration has been deployed. Every provisioned user who signs in to your corporate directory, such as Microsoft Entra ID or Active Directory, during the contract term counts as adopted. Signing in to the directory signs them in to My1Login automatically, so your workforce doesn't have to enrol in or open My1Login.

How much does it cost?

Single sign-on for desktop is priced separately, as an add-on to single sign-on for web, with a minimum of 100 users. Our pricing page has the details. See pricing

Bring your oldest desktop app to a 5-minute demo.

We'll set it up from a template while you watch, then show you what your workforce sees: the app, already signed in.

  • 5 minutes, on your own apps
  • A specialist replies within one working day
  • No obligation
Book a 5-minute demoStart a 14-day free trialThe full product, on your own apps.
Book a 5-minute demoFree trial