Add MFA to legacy Windows applications without rewriting them.
Older desktop and client/server applications often remain essential long after identity policy has moved on. Beanstalk gives those applications a practical path to modern SSO and MFA through a local authentication broker instead of a replacement project.
The awkward exception in many MFA rollouts.
A business can standardise on Microsoft Entra ID, Okta, Google, Auth0, ADFS, Keycloak or another identity platform and still have critical Windows applications using their own local login screens.
Those applications are often too important to replace quickly, too stable to disturb unnecessarily, and too old to natively support OIDC, PKCE, browser-based sign-in or modern MFA prompts.
The result is an identity-policy gap: everything modern is protected, while one important finance, operations, ERP or administration tool remains an exception.
Where Beanstalk fits
- Beanstalk runs beside the application and exposes a COM Automation interface that legacy Windows software can call.
- It opens the user’s normal browser, sends the user to the configured identity provider, completes the OIDC/PKCE flow, and returns a verified identity result to the calling application.
- The legacy application does not need to know how to perform browser sign-in, token exchange, JWKS validation, MFA, claim retrieval or provider-specific protocol details.
Good candidates
- Internal line-of-business applications where source changes are possible but a full authentication rewrite is not justified.
- ERP companion tools, finance applications, operational utilities, administrative tools and bespoke Windows software that still serve a real business purpose.
- Applications where the business requirement is not a new platform, but central sign-on, MFA enforcement and auditable identity.
What remains under your control
- Identity policy remains in the identity provider your organisation already governs.
- The application still decides how the verified user maps to its own user records, permissions and business rules.
- Beanstalk acts as the bridge, not as a new identity silo or a replacement security model.
Find out whether your application is a good candidate.
Tell us the application technology, current login method, identity provider and deployment model. We can usually tell quickly whether Beanstalk is a practical fit, what would need to change, and where the integration risk sits.