# Team Today office check-in for Windows

> **Unsupported example.** These scripts are an example of an Intune script that uses the Team Today API to tell Team Today when people are in an office. Team Today manages the check-in API they connect to, but does not support the scripts. Review them, change them to suit your computers and test them on a pilot group before you deploy them.

This package records office visits in Team Today automatically. It adds a small scheduled task to each Windows computer. A minute or two after someone signs in, unlocks their computer or it joins a network, the task tells Team Today who is signed in.

Team Today only records a check-in when the message comes from one of your office internet addresses. Messages sent from home, a café or a hotel are ignored.

## What it sends

Each message contains:

- the signed-in person's email address (their Windows sign-in name)
- their Microsoft Entra ID object id, on Entra ID joined computers, so Team Today can still find them if their email address is different
- the name of the network the computer is on, for example the Wi-Fi name
- the computer's local date and time, and its time zone (for example Europe/London), so the report shows the time with it

It does not send location, device names, MAC addresses, browsing or anything else. A computer sends at most one message per person, per network, per day, however often they unlock it.

Nothing is sent while the computer is locked, because nobody may be at it.

## Files

| File | What it is for |
| --- | --- |
| `Install-TeamTodayOfficeCheckIn.ps1` | Installs or updates the check-in task. The only file you need for a platform script. |
| `Uninstall-TeamTodayOfficeCheckIn.ps1` | Removes everything the install script added. |
| `Detect-TeamTodayOfficeCheckIn.ps1` | Detection rule, only needed if you deploy it as a Win32 app. |

## Before you start

1. **Automatic check-in is switched on for your account.** Email support@team-today.com and we will do this for you.
2. **Your office internet addresses are approved.** Add the fixed public IPv4 address of each office in Team Today: **Settings** > **Offices and meeting rooms**, choose an office, choose **Automatic Check-in** and add it under **Office internet addresses**. Each address shows **Pending approval** until Team Today approves it. We only approve addresses that belong to your company or your internet provider.
3. **Check-ins leave through the office connection.** If your internet traffic goes through a cloud security service such as Zscaler or Netskope, let requests to `scim.team-today.com` go straight out through the office's own internet connection. Otherwise they arrive from the service's addresses and are ignored.
4. **Your office networks are mapped in Team Today.** Go to **Settings** > **Offices and meeting rooms**, choose an office, choose **Automatic Check-in** and add each network name people use there, including any guest network. Once one network is mapped, check-ins from networks that are not mapped are ignored. If you have one office, you can skip this and set `$SendNetworkName = $false`.
5. **People's Team Today email addresses match their Windows sign-in names.** If the domains are different, use `$SignInDomainToEmailDomain` (see below).

The computers need Windows 10 or 11. PowerShell 5.1 is already part of Windows.

## 1. Choose your settings

Open `Install-TeamTodayOfficeCheckIn.ps1` in a text editor and change the settings at the top.

| Setting | What to set |
| --- | --- |
| `$OfficeNetworks` | Your office network names, for example `@('Acme-Staff', 'Acme-Guest', 'acme.local')`. Computers then only contact Team Today while on one of these networks, so home network names never leave the device. Recommended. Leave empty to send from every network. |
| `$SendNetworkName` | `$true` (the default) to send the network name so Team Today knows which office someone is in. |
| `$SignInDomainToEmailDomain` | Only if sign-in names and Team Today emails use different domains, for example `@{ 'acme.onmicrosoft.com' = 'acme.com' }`. |
| `$ProxyUrl` | Only if these computers must use a proxy server to reach the internet. |

Network names must match exactly what Windows reports. To check, install the script on one computer at the office (see step 2), then run this in PowerShell as an administrator:

```powershell
& 'C:\Program Files\Team Today\Office Check-in\Send-OfficeCheckIn.ps1' -DryRun
```

It shows the message it would send, including the network name, without sending anything.

## 2. Deploy with Intune

1. In the Microsoft Intune admin center, go to **Devices** > **Scripts and remediations** > **Platform scripts** and choose **Add** > **Windows 10 and later**.
2. Name it **Team Today office check-in** and upload `Install-TeamTodayOfficeCheckIn.ps1`.
3. Use these settings:
   - **Run this script using the logged on credentials**: No
   - **Enforce script signature check**: No, unless you sign the script with your own certificate
   - **Run script in 64 bit PowerShell Host**: Yes
4. Assign it to a device group. Start with a small pilot group of computers at one office.

Intune runs the script once on each computer. If you change the settings and upload the script again, Intune runs it again and the new settings replace the old ones.

### Or as a Win32 app

If you prefer a Win32 app, which lets you uninstall through Intune:

1. Package the folder with the [Microsoft Win32 Content Prep Tool](https://github.com/microsoft/Microsoft-Win32-Content-Prep-Tool), using `Install-TeamTodayOfficeCheckIn.ps1` as the setup file.
2. **Install command**: `%SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Install-TeamTodayOfficeCheckIn.ps1`
3. **Uninstall command**: `%SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Uninstall-TeamTodayOfficeCheckIn.ps1`
4. **Install behavior**: System
5. **Detection rules**: use a custom script and upload `Detect-TeamTodayOfficeCheckIn.ps1`, with **Run script as 32-bit process on 64-bit clients** set to No.

When you release a new version of the install script, change `$ExpectedVersion` in the detection script to match, so Intune installs it again.

## 3. Check it is working

On a pilot computer at the office:

1. Sign out and back in, or lock and unlock the computer, and wait three minutes.
2. Open `C:\ProgramData\TeamToday\OfficeCheckIn\checkin.log` as an administrator. You should see a line like:

   ```
   2026-10-01 08:54:12  Sent check-in for jane.smith@acme.com on 'Acme-Staff' (HTTP 204).
   ```

3. In Team Today, go to **Settings** > **Reports, data and audit logs** > **Office usage** and choose **Automatic office check-in**. The visit should appear within a minute.

To run a check-in straight away instead of waiting, run this as an administrator:

```powershell
Start-ScheduledTask -TaskPath '\Team Today\' -TaskName 'Office check-in'
```

A computer only sends once per person, network and day. To send again while testing, delete the `sent-*.txt` files in `C:\ProgramData\TeamToday\OfficeCheckIn`.

## Troubleshooting

Team Today always answers `HTTP 204`, whether or not it recorded the visit, so a 204 in the log only means the message arrived. If the visit does not appear in the report, look at **Ignored check-ins** on the same report page: it lists messages from your approved addresses that could not be recorded and why. Otherwise, check that:

- the message came from an office address that Team Today has approved (with a cloud security service, see "Before you start")
- the network name in the log is mapped to an office in Team Today
- the email address in the log is the one the person uses in Team Today

Messages in the log:

| Message | What to do |
| --- | --- |
| `Network '...' is not one of the office networks in config.json` | Add the name to `$OfficeNetworks` and deploy the script again. |
| `Network '' is not one of the office networks` | Windows did not report a network name. On Windows 11 24H2 and later, Wi-Fi names are only available when location services are on. The script then uses the Windows network name, so run `-DryRun` and add whatever it shows. |
| `Could not find the sign-in name` | The person's account is not an Entra ID or Active Directory work account, so the script can't tell who they are. |
| `Nobody is signed in at the computer itself` | Expected when the computer joins a network before anyone signs in. |
| `The computer is locked` | Expected. A computer left signed in and locked, for example overnight at the office, may have nobody at it. It checks in when someone unlocks it. |
| `Check-in failed: ...` | Usually no internet connection, or a proxy is needed. Set `$ProxyUrl` if so. |

## Removing it

Deploy `Uninstall-TeamTodayOfficeCheckIn.ps1` as a platform script with the same settings, or use the Win32 app's uninstall. It removes the scheduled task, `C:\Program Files\Team Today\Office Check-in` and `C:\ProgramData\TeamToday\OfficeCheckIn`.

## What it installs

- **Scheduled task** `\Team Today\Office check-in`, running as SYSTEM. It starts 2 minutes after sign-in, 1 minute after unlock, and 1 minute after the computer joins a network. Anyone can see it in Task Scheduler under **Team Today**.
- **Program files** in `C:\Program Files\Team Today\Office Check-in`: the check-in script and its settings (`config.json`).
- **Data** in `C:\ProgramData\TeamToday\OfficeCheckIn`: the log and a note of what was sent today. Only administrators and SYSTEM can open this folder.

## Questions

The scripts are not supported. For questions about the check-in API they connect to, email support@team-today.com.