Add MFA to Windows desktop apps and Excel automation without rewriting them.
Excel/VBA tools, Access databases, desktop Office automation and older client/server applications often remain essential long after identity policy has moved on. Beanstalk gives them a practical path to modern SSO and MFA through Microsoft Entra ID, Okta, Google and other identity providers.
The awkward exception in many MFA rollouts.
A business can standardise on Microsoft Entra ID, Okta, Google, Auth0, ADFS, Keycloak or another identity platform and still have Excel workbooks, Access tools and critical Windows applications using local login screens, hidden passwords or inherited trust assumptions.
Those applications are often too important to replace quickly, too stable to disturb unnecessarily, and too old to natively support OIDC, PKCE, browser-based sign-in or modern MFA prompts.
The result is an identity-policy gap: everything modern is protected, while one important finance, operations, ERP or administration tool remains an exception.
Where Beanstalk fits
- Beanstalk runs beside the application and exposes a COM Automation interface that legacy Windows software can call.
- It opens the user’s normal browser, sends the user to the configured identity provider, completes the OIDC/PKCE flow, and returns a verified identity result to the calling application.
- The legacy application does not need to know how to perform browser sign-in, token exchange, JWKS validation, MFA, claim retrieval or provider-specific protocol details.
Good candidates
- Internal line-of-business applications where source changes are possible but a full authentication rewrite is not justified.
- ERP companion tools, finance applications, operational utilities, administrative tools and bespoke Windows software that still serve a real business purpose.
- Applications where the business requirement is not a new platform, but central sign-on, MFA enforcement and auditable identity.
What remains under your control
- Identity policy remains in the identity provider your organisation already governs.
- The application still decides how the verified user maps to its own user records, permissions and business rules.
- Beanstalk acts as the bridge, not as a new identity silo or a replacement security model.
Find out whether your application is a good candidate.
Tell us the application technology, current login method, identity provider and deployment model. We can usually tell quickly whether Beanstalk is a practical fit, what would need to change, and where the integration risk sits.