Everbridge 360™ Device-Token Registration on Windows

Device-token registration

Note: Device-token registration is available in Everbridge 360 app version 26.9.0 and later. It is supported for Windows deployments that use the MSI package.

Device-token registration allows an organization to sign users in to the Everbridge 360 app automatically. Users do not need to enter an Everbridge password or complete an interactive single sign-on (SSO) flow.

The app combines an organization device token with an identifier that resolves to each contact.

Before you begin

Confirm the following before deploying device-token registration:

• Your organization has an Organization Code and is licensed for Everbridge 360 Desktop.

• Each user has an active contact in the organization.

• You have the Windows MSI package for the Everbridge 360 app and administrator access to your deployment tool.

• Any user who will test the flow is signed out of the Everbridge 360 app. Automatic sign-in runs only when the app does not already have an account.

Treat a device token like a password. Store it securely, distribute it only through an approved device-management tool, and do not include it in email, support cases, screenshots, or deployment logs.

Create a device token

An Organization Administrator creates and manages device tokens in Everbridge Suite.

1. Sign in to Everbridge Suite and select the required organization.

2. Go to Settings > Organization > Everbridge Mobile App, then open Device Tokens.

3. Select Create Device Token.

4. Enter a descriptive name that identifies the deployment, such as `Windows Corporate Devices`.

5. Select an expiration date that meets your organization's security policy.

6. Create the token.

7. Copy the token immediately and save it in an approved secret-management system. The full token is displayed only when it is created and cannot be retrieved later.

Note: If a token is lost, create a replacement. Do not use screenshots or unsecured documents to retain the token.

Deploy and manage device-token registration

Use the MSI properties below to configure a new deployment. The MSI creates the Everbridge360 app-configuration values and stores the device token in Windows Credential Manager. To change an existing deployment, see Update the App Configuration. If you use the MSI property USERNAME_REGKEY, see Prepare a registry-sourced identifier (if applicable).

Deploy the MSI

Deploy from an elevated PowerShell session, or configure the same properties in your device-management tool. For registry-source setup, see Prepare a registry-sourced identifier.

Note: ORG_CODE and DEVICE_TOKEN must be supplied together. Supplying only one does not enable device-token registration.

During an install, repair, or upgrade, supplying a USERNAME_SOURCE, USERNAME_REGKEY, or USERNAME_MATCH_FIELD property updates only that persisted setting. Omitting a property preserves its existing value. Use RESET_USERNAME_MATCHING=1 to clear all username-matching settings and return to the default behavior.

The examples show all properties on one line. You can use PowerShell line continuation when needed; enter the properties on one line when required by Microsoft Intune or another deployment tool.

Do not configure the legacy username and password automatic-login values at the same time. If both a username/password configuration and a device-token configuration are present, username/password automatic login takes precedence.

Update the App Configuration

Use the following locations to view or change the app-configuration values. Registry editing can change only the values listed below; it cannot add or replace the device token, which is stored in Windows Credential Manager. For an initial configuration or token rotation, use Deploy the MSI.

Computer\HKEY_CURRENT_USER\SOFTWARE\Everbridge360
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Everbridge360

Note: The MSI creates HKEY_LOCAL_MACHINE\SOFTWARE\Everbridge360 when it writes app-configuration values. To configure values manually, create the appropriate HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE path before adding values from this table.

Note: Setting enableDeviceToken to true does not itself supply a device token. The MSI writes these settings to HKEY_LOCAL_MACHINE\SOFTWARE\Everbridge360. When configured manually, a matching value in HKEY_CURRENT_USER\SOFTWARE\Everbridge360 takes precedence for that value.

Choose the username source

The Everbridge 360 app must resolve an identifier for the current user before it can sign the user in. The identifier can be a Windows username, a Windows User Principal Name (UPN), or a value supplied through the Windows registry.
In this section:

• Machine’s username means the username of the account currently signed in to the desktop.

• Contact’s username means the username stored in the contact’s record within Everbridge Suite.

• UPN means the Windows User Principal Name for the signed-in user, which commonly has the format user@company.com.

Choose the source that provides the identifier used to find the Contact.

To configure the selected source during installation, see Deploy the MSI for command-line and device-management examples.

If you do not set USERNAME_SOURCE, the Everbridge 360 app uses registry when USERNAME_REGKEY is set; otherwise, it uses username. If a registry key is already configured but you want to use the Windows username, set USERNAME_SOURCE=username.

Match the identifier to a Contact field (optional)

Set USERNAME_MATCH_FIELD only when the identifier from the selected source is stored in a Contact field other than the Contact username. The configured field must contain that identifier for every deployed user and identify exactly one Contact.

Prepare a registry-sourced identifier (if applicable)

Complete this section only when you use a registry-based username source. With USERNAME_SOURCE=username or USERNAME_SOURCE=upn, the Everbridge 360 app resolves the identifier directly from Windows. For a registry-based source, create a separate registry value for each user that contains the identifier used to match that Contact. USERNAME_REGKEY (MSI) and usernameRegKey (Registry Editor) store the path to that registry value, not the identifier itself.

Note: For an MSI deployment, supply that value’s full path through the USERNAME_REGKEY installer property. See Deploy the MSI. The MSI writes the path to usernameRegKey.

Note: Use Registry Editor only when you need to manually add or update the username-matching configuration. For those steps, see Update the App Configuration.

The full path must include:

• The registry hive

• The registry key path

• The registry value name

For example:

HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername

In this example:

• For an MSI deployment, set USERNAME_REGKEY to HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername. The MSI writes this path to usernameRegKey.

• Set the data in the referenced registry value to the Contact username when USERNAME_MATCH_FIELD is not configured. When it is configured, set the value to the value in that Contact field instead.

Note: The MSI writes the supplied path to usernameRegKey. It does not create the referenced registry value or set its data. Use your device-management process to create the registry value and populate it with the correct identifier for each managed user. To set usernameRegKey manually, see Update the App Configuration.

The referenced registry value:

• Must be a string value of type REG_SZ.

• Must contain the identifier expected by the configured username match field. If no username match field is configured, it must contain the Contact username.

Supported registry hives are:

• HKEY_CURRENT_USER or HKCU

• HKEY_LOCAL_MACHINE or HKLM

What the user experiences

When a user without an existing app account starts the Everbridge 360 app:

1. The app uses the configured Organization Code.

2. The app resolves the configured identifier and signs the user in without requesting a password.

3. The Everbridge 360 app Home page opens.

Device-token registration also follows this flow for organizations that normally use SSO; the user is not redirected to the organization's identity provider.

Rotate or revoke a device token

Rotate tokens before they expire and whenever a token may have been exposed.

1. Create a new device token in Everbridge Suite.

2. Redeploy or repair the MSI with the same ORG_CODE and the new DEVICE_TOKEN.

3. Verify automatic sign-in on a pilot device.

4. Complete the deployment to the remaining managed devices.

5. Delete the previous token from the Device Tokens page.

Deleting or expiring a device token prevents it from being used for future automatic sign-ins. It does not automatically sign out users who are already signed in.

When rotating only a token, you can omit USERNAME_SOURCE, USERNAME_REGKEY, and USERNAME_MATCH_FIELD; their existing persisted values are preserved.

Uninstalling the MSI removes the device-token registration data, including the persisted username-matching settings, from that Machine’s computer. It does not delete the organization token from Everbridge Suite.

Troubleshooting

Related articles

• 360™: Everbridge 360™ MDM on Windows

• 360™: Everbridge 360™ MSI Package Deployment

• 360™: Everbridge 360™ Windows Pre-Deployment