If your users installed Microsoft Scout and still can’t sign in, the app itself isn’t the problem. Microsoft Scout access runs through two separate admin gates, and both have to be fully complete before a single sign-in attempt succeeds. This guide breaks down exactly what each gate requires, in what order, so you can get users signed in without guessing which setting is missing.
Why Microsoft Scout Won’t Sign In After Installation
Installing Microsoft Scout always works. The download itself carries no access restrictions. Signing in is where access actually gets enforced, and that only happens after two independent gates are cleared:
- Gate 1 turns on Frontier, and therefore Microsoft Scout, for your organization at the tenant level.
- Gate 2 enables the app on individual devices through an Intune policy and a required admin attestation.
A GitHub Copilot license by itself does not grant Frontier access. Frontier access by itself does not work without a Copilot Business or Enterprise license. Both gates have to be fully complete, together, before sign-in succeeds. If a user tries signing in before that happens, the attempt gets blocked and Scout gives no clear indication in the app of why. That silent failure is the single most common support ticket admins see with a new Scout rollout.
Microsoft Scout Access Flow: From Install to Sign-In
Here’s the complete path from an unconfigured tenant to a user actually signed in and working:
- Admin enrolls the organization in Frontier and turns on Copilot Frontier in the Microsoft 365 admin center
- Admin configures the Microsoft Scout Intune policy on target devices
- Admin completes the Frontier organization sign-up (attestation) form
- User downloads the Microsoft Scout app
- User installs the Microsoft Scout app
- User confirms they have a GitHub account
- User signs in, which only succeeds once every admin step above is complete
Steps 1 through 3 are entirely on the admin side. Nothing a user does in steps 4 through 6 can work around a gate that isn’t finished yet. The next two sections walk through gates 1 and 2 in detail.
Gate 1: Turn On Frontier Access
This gate switches on Frontier, and Microsoft Scout along with it, for your tenant. You configure it directly in the Microsoft 365 admin center.
- Sign in to the Microsoft 365 admin center.
- In the left navigation, select Copilot, then Settings, then View all.
- In the search box, enter Frontier, then select Copilot Frontier.
- Set access for your organization. Choose one of the following: No access, All users, or Specific users.
- Select Save.
Once saved, allow up to about three hours for the change to propagate before Frontier features become available to the users you selected.
Completing Gate 1 makes Frontier available to those users, but it does not, on its own, let anyone sign in to Microsoft Scout. Gate 2 still has to be finished separately.
Gate 2: Complete Admin Enablement
Gate 2 covers three required admin actions, covered one at a time below. All three need to be done before any user can sign in.
1. Enable access through an Intune policy
An IT admin has to configure an Intune policy for Microsoft Scout that sets the required registry and device conditions and enables the app’s login capability. Without this policy assigned and synced, users cannot sign in even after a successful install.
This step has enough moving parts (ADMX import, a Windows policy, and a separate macOS profile) that it gets its own full walkthrough in How to Deploy Microsoft Scout via Intune. Once that policy is in place, come back here to finish the remaining two actions below.
2. Complete the attestation and opt-in
Microsoft Scout can route data outside Microsoft 365 to third-party inference paths, including GitHub. Because of that, admins must explicitly attest to and opt in for their organization before users get access. This attestation is a separate gating layer on top of Frontier enrollment, and it applies even if Gate 1 is already fully complete. You record this by completing the Microsoft 365 Admin Frontier organization sign-up form.
3. Provision GitHub Copilot licenses
Admins need to confirm that users actually have GitHub Copilot licenses assigned. This step only matters for users who aren’t already licensed. Since Scout uses GitHub for token billing, a user without a Copilot license cannot sign in regardless of how the other gates are configured.
Microsoft Scout Sign-In Requirements for Users
Once you have cleared both gates as the admin, here is what the process looks like from a user’s side. Users have a short checklist of their own before Scout works:
- Download and install the Microsoft Scout app
- Have a GitHub account, since Scout uses it for token billing and every user needs one before signing in
- Sign in with their work credentials, which only succeeds once all of Gate 1 and all three parts of Gate 2 (Intune policy, attestation, and Copilot licensing) are complete
If a user tries to sign in early, the app blocks the attempt without a clear explanation. Confirm with your admin team that Frontier access, the Intune policy, and the attestation are all genuinely in place before troubleshooting anything on the client side.
Quick Reference: What Blocks Sign-In
If you just need the short version to check against, use this table to match the symptom to the missing piece.
| Situation | What’s Missing |
|---|---|
| User installed the app but sign-in fails immediately | One or both admin gates are incomplete |
| Frontier is enabled but sign-in still fails | Gate 2 (Intune policy, attestation, or Copilot license) isn’t finished |
| User has a Copilot license but Frontier access shows no access | Gate 1 hasn’t been configured or saved yet in the M365 admin center |
| Everything looks configured but sign-in still fails | Frontier access may not have propagated yet, allow up to three hours after saving |
Frequently Asked Questions
Why does installing Microsoft Scout always succeed even when access isn’t configured?
The app download itself isn’t gated. Microsoft enforces access at sign-in, not at install, so the installer will always complete successfully regardless of whether your organization has finished either admin gate.
Does a GitHub Copilot license alone let users sign in to Microsoft Scout?
No. A Copilot license alone does not grant Frontier access, and Frontier access alone does not work without a Copilot Business or Enterprise license. Both are required together, alongside the Intune policy and attestation.
What should I check first if users report they can’t sign in?
Verify both admin gates before troubleshooting on the client. Confirm Frontier access is enabled and has had time to propagate, then confirm the Intune policy is assigned and synced, the attestation form is complete, and the user has a GitHub Copilot license.
Can I enable Frontier access for specific users only, instead of the whole organization?
Yes. When configuring Gate 1 in the Microsoft 365 admin center, you can choose Specific users instead of All users, which lets you pilot Microsoft Scout with a smaller group before a wider rollout.
Is the GitHub Copilot license requirement part of Gate 2, or a separate step?
It is one of the three required actions inside Gate 2, alongside the Intune policy and the attestation. All three have to be complete, not just the Intune policy and attestation, before sign-in works.
