MEM-Assisted Authentication in the Egnyte Desktop App

When an organization has linked multiple Egnyte domains under Multi-Entity Management (MEM), users can add drives from those linked domains in the Egnyte Desktop App without being prompted for a password, a Single Sign-On (SSO) flow, or a multi-factor authentication (MFA) challenge. The Add Drive flow still needs to be initiated for each new domain, but the authentication step is shortened to username or e-mail address only when the domain is recognized as MEM-linked.

This article is intended for both Egnyte administrators, who can confirm the prerequisites described below, and end users, who can refer to the sections describing the Add Drive experience. 

 

Prerequisites

The following must be in place for MEM-assisted authentication to take effect. Administrators are responsible for confirming each of these items at the account level; end users do not need to take any setup action.

• MEM must be configured at the Egnyte account level: The domains in scope must be linked under MEM and must recognize the same user identity across those domains.

  To enable MEM, contact the Egnyte account manager.

• MEM-assisted authentication must be enabled for the organization by Egnyte: To get this feature enabled for the Desktop App, contact our products team. Once enabled, restart the Desktop App on each end-user device to apply the change. If the app is not restarted, the change is picked up automatically within 15–30 minutes.
• A supported Desktop App version must be installed on each end-user device: Windows devices must run Egnyte Desktop App v 4.5.0 or later, and Mac devices must run Egnyte Desktop App Core v 1.19.0 or later.
• The same e-mail address must be registered for the user across all the linked domains: Identity matching across MEM-linked domains is performed by e-mail. The authentication method does not need to be the same on each domain: one domain may be configured for a simple password, another for Single Sign-On, and another for two-factor authentication. As long as the user is recognised by the same e-mail on each linked domain, MEM-assisted authentication continues to work regardless of which method any individual domain uses.

 

What End Users Can Expect When Adding a Drive

Once the prerequisites are in place, the following behavior can be expected during the Add Drive flow:

• The Add Drive flow still needs to be initiated by the user for each linked domain: Drives from MEM-linked domains are not added automatically. The Add Drive option needs to be opened, and the target domain provided as before.
• Only the username or e-mail is requested: When the target domain is recognized as MEM-linked to a domain that has already been authenticated, the Desktop App accepts the identity input and proceeds without requesting a password.
• The SSO redirect and MFA challenge are skipped: For drives added via the MEM-assisted path, the SSO flow is not invoked again, and any MFA prompt is not requested again either.
• Domains that are not MEM-linked are unaffected: When a target domain is not linked under MEM to any already-authenticated domain, the Add Drive flow continues to behave as it did before, with the regular password or SSO/MFA experience.
• Token invalidation: If a drive is removed via the Desktop App or the Egnyte web UI, or if a server-side token revocation occurs, the authentication token for that domain may be invalidated. When this happens, the Desktop App automatically obtains a new token from another authenticated MEM-linked domain, allowing access to continue without requiring the user to sign in again.

 

Behavior With Mobile Device Management (MDM)

When the Egnyte Desktop App is deployed through a mobile device management (MDM) or other configuration management tools, MEM-assisted authentication can apply across every drive defined in the configuration profile at the same time. With such a profile installed, the user is asked to authenticate only once for all drives — rather than once per drive — when all domains defined in the profile are MEM-linked for the user. 

Every domain configured to mount as a drive must be part of the same MEM relationship and must recognize the user with the same e-mail address. If a domain in the profile is not MEM-linked, that drive falls back to the regular sign-in flow, while the rest of the profile drives continue to benefit from the shortened flow.

 

Limitations

• Remove Device option on a single domain may not remove the drive from the Desktop App if other MEM-linked domains remain authenticated on the same device. In this scenario, the Desktop App detects that another MEM-linked domain is still authenticated and automatically re-authenticates the affected drive using the existing authentication context. As a result, the drive may reconnect automatically, and the Remove Device action may not have the expected effect.