Device-token registration
Note: Device-token registration is available in Everbridge 360 version 26.7.0 and later. It is supported for Windows deployments that use the MSI package.
Device-token registration allows an organization to sign users in to the Everbridge 360 Windows app automatically. Users do not need to enter an Everbridge password or complete an interactive single sign-on (SSO) flow.
The app combines an organization device token with each contact’s username.
Before you begin
Confirm the following before deploying device-token registration:
Your organization has an Organization Code and is licensed for Everbridge 360 Desktop.
Each user has an active contact in the organization.
You have the Everbridge 360 Windows MSI package and administrator access to your deployment tool.
Any user who will test the flow is signed out of Everbridge 360. Automatic registration runs only when the app does not already have a signed-in account.
Treat a device token like a password. Store it securely, distribute it only through an approved device-management tool, and do not include it in email, support cases, screenshots, or deployment logs.
Create a device token
An Organization Administrator creates and manages device tokens in Everbridge Suite.
Sign in to Everbridge Suite and select the required organization.
Go to Settings > Organization > Everbridge Mobile App, then open Device Tokens.
Select Create Device Token.
Enter a descriptive name that identifies the deployment, such as `Windows Corporate Devices`.
Select an expiration date that meets your organization's security policy.
Create the token.
Copy the token immediately and save it in an approved secret-management system. The full token is displayed only when it is created and cannot be retrieved later.
Note: If a token is lost, create a replacement. Do not use screenshots or unsecured documents to retain the token.
Choose the username source
Everbridge 360 must resolve the current contact’s username before it can register the user.
In this section:
Machine’s username means the username of the account currently signed in to the desktop.
Contact’s username means the username stored in the contact’s record within Everbridge Suite.
Compare these two usernames and use the appropriate configuration below.
| Username scenario | Configuration |
Requirements and example |
The machine and contact’s usernames are the same |
Do nothing. |
Everbridge 360 will attempt to authenticate using the machine’s username. |
The machine and contact’s usernames are different |
Set USERNAME_REGKEY to the full path of a registry value containing the Contact’s username (more information about configuring USERNAME_REGKEY is explained below). |
The path must include the registry hive, key path, and value name. Example: HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername
|
Prepare the referenced username value
Use a registry-based username source when the machine’s username differs from the contact’s username. Create a separate registry value for each user that contains the exact contact username. USERNAME_REGKEY (MSI) and usernameRegKey (Registry Editor) store the path to that registry value, not the username itself.
Note: For an MSI deployment, supply that value’s full path through the USERNAME_REGKEY installer property. See Deploy the MSI. The MSI writes the path to usernameRegKey.
Note: Use Registry Editor only when you need to manually add or update usernameRegKey. For those steps, see Update the App Configuration.
The full path must include:
The registry hive
The registry key path
The registry value name
For example:
HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername
In this example:
For an MSI deployment, set USERNAME_REGKEY to HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername. The MSI writes this path to usernameRegKey.
Set the data in the EverbridgeUsername registry value to the exact username shown in the person’s Everbridge contact record.
Note: The MSI writes the supplied path to usernameRegKey. It does not create the referenced registry value or set its data. Use your device-management process to create the registry value and populate it with the correct contact’s username for each managed user. To set usernameRegKey manually, see Update the App Configuration.
The referenced registry value:
Must be a string value of type REG_SZ.
Must contain the exact contact’s username.
Supported registry hives are:
HKEY_CURRENT_USER or HKCU
HKEY_LOCAL_MACHINE or HKLM
Deploy and manage device-token registration
Use the MSI properties below to configure a new deployment. The MSI creates the Everbridge360 app-configuration values. To change an existing deployment, see Update the App Configuration. If you use the MSI property USERNAME_REGKEY, see Prepare the referenced username value.
Deploy the MSI
Deploy from an elevated PowerShell session, or configure the same properties in your device-management tool. If you use the MSI property USERNAME_REGKEY, create and populate the referenced registry value before the user first opens Everbridge 360. The MSI writes the supplied path to usernameRegKey.
| Scenario | Command |
Machine’s username already matches Contact’s username |
msiexec /package "C:\Path\To\Everbridge360.msi" /quiet /norestart ORG_CODE="MyOrgCode" DEVICE_TOKEN="PASTE_GENERATED_TOKEN_HERE" |
Use a registry value for the Contact’s username |
msiexec /package "C:\Path\To\Everbridge360.msi" /quiet /norestart ORG_CODE="MyOrgCode" DEVICE_TOKEN="PASTE_GENERATED_TOKEN_HERE" USERNAME_REGKEY="HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername" |
| MSI Property | Required | Description | Example |
| ORG_CODE | Yes | The Organization Code for the Everbridge organization. |
MyOrgCode |
| DEVICE_TOKEN | Yes | The complete device token copied from Everbridge Suite. |
PASTE_GENERATED_TOKEN_HERE |
| USERNAME_REGKEY | No | The full path of a registry value containing the Contact’s username. If omitted, the current Machine’s username is used. |
HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername |
Note: ORG_CODE and DEVICE_TOKEN must be supplied together. Supplying only one does not enable device-token registration.
The commands above use PowerShell line continuation. Enter the properties on one line when required by Microsoft Intune or another deployment tool.
Do not configure the legacy username and password automatic-login values at the same time. If both a username/password configuration and a device-token configuration are present, username/password automatic login takes precedence.
Update the App Configuration
Use the following locations to view or change the app-configuration values. For an initial configuration, use Deploy the MSI.
Computer\HKEY_CURRENT_USER\SOFTWARE\Everbridge360
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Everbridge360Note: This path will only be created automatically if using the MSI installer with specific parameters. In other cases this path can be created manually, either before or after installing the app.
| Registry Value | Required | Description | Example |
| enableDeviceToken | Yes | A true or false value indicating whether device-token registration is enabled. The MSI sets this value to true when DEVICE_TOKEN is supplied. |
true |
| orgCode | Yes | The Organization Code for the Everbridge organization. The MSI populates this value from ORG_CODE. |
EverbridgeOrgA |
| usernameRegKey | No | The full path to a separate registry value containing the Contact’s username. The MSI populates this value from USERNAME_REGKEY. |
HKEY_LOCAL_MACHINE\Software\Company\Identity\EverbridgeUsername |
Note: Setting enableDeviceToken to true does not itself supply a device token.
What the user experiences
When an unsigned-in user starts Everbridge 360:
The app finds the organization automatically.
The app displays the resolved Contact’s username and signs the user in without requesting a password.
The Everbridge 360 Home page opens.
Device-token registration also follows this flow for organizations that normally use SSO; the user is not redirected to the organization's identity provider.
Rotate or revoke a device token
Rotate tokens before they expire and whenever a token may have been exposed.
Create a new device token in Everbridge Suite.
Redeploy or repair the MSI with the same ORG_CODE and the new DEVICE_TOKEN.
Verify automatic sign-in on a pilot device.
Complete the deployment to the remaining managed devices.
Delete the previous token from the Device Tokens page.
Deleting or expiring a device token prevents it from being used for future automatic sign-ins. It does not automatically sign out users who are already signed in.
Uninstalling the MSI removes the device-token registration data installed on that Machine’s computer. It does not delete the organization token from Everbridge Suite.
Troubleshooting
| Symptom | What to check |
The normal sign-in page opens and automatic registration does not start. |
Confirm the user is signed out. Confirm that both ORG_CODE and DEVICE_TOKEN were included in the MSI deployment. Confirm that the username can be resolved. Remove any legacy automatic-login username and password values. |
Automatic Login Failure: The username or device token is invalid. |
Confirm that the resolved username exactly matches an active Contact in the same organization. Confirm that the token belongs to that organization and has not expired or been deleted. Create and deploy a replacement token if necessary. |
Organization Code does not exist. |
Confirm that ORG_CODE exactly matches the Organization Code configured in Everbridge Suite. |
The wrong username appears. |
Correct the value referenced by USERNAME_REGKEY, or remove USERNAME_REGKEY if the Machine’s username is the correct Contact’s username. |
The deployment works for some users but not others. |
Compare each affected user’s resolved username with their Contact’s username and confirm that their Contact’s account is active. |
A replacement token is not being used. |
Redeploy or repair the MSI with the same ORG_CODE and the complete new DEVICE_TOKEN, then sign out of Everbridge 360 before testing again. |
Related articles