Begin with representative devices and a question worth answering. Validate the evidence, the operating controls and the fit for your environment before expanding.
Confirm the exact OS, architecture and agent release. Measurements and supported actions differ by platform and configuration.
Windows Installer and .NET Framework 4.7.2+. Administrator installation; SYSTEM runtime.
Root installation and runtime. Deployment uses the startup disk and a launchd-managed system service.
Root, systemd, CA certificates, curl, OpenSSH signature verification and a SHA-256 utility.
OS releases must receive vendor security updates. No 32-bit, preview, beta, containerized or end-of-life operating systems. These are compatibility baselines—not completed acceptance for every device or future OS release.
The agent is a privileged machine service. Review its identity, network path and allowed capabilities as part of the deployment—not after it.
SYSTEM on Windows
root on macOS / Linux
DNS + system trust
No inbound opening
Signed policy and permitted work
Device observations and results
Tenant roles
Action verification
Review evidence
Approve applicable actions
Test the service account. Enrollment and ongoing operation both need access. A working browser is not enough.
Keep certificate verification on. Proxy and TLS-inspection settings need explicit validation with your security team.
Use this as an evaluation outline, then agree the scope and acceptance criteria with your team. Select a stage to see its checks.
Define a small, representative evaluation with a named owner and a clear stop condition.
Define the purpose and data scope with your privacy and security teams. Device telemetry is not an individual productivity rating.
Explore governanceSigned policy controls collection modules. Routine telemetry excludes keystrokes, screenshots, clipboard, browsing history and document or message content.
Agree employee notices and permitted purposes. Optional workforce analytics have additional access controls and minimum-group privacy thresholds.
Operator prompts, authorized script output and explicitly requested file transfers can contain content. Scope those permissions and AI disclosures separately.
Review an eligible release before it becomes a target for your fleet.
Choose automatic adoption within the selected channel and rollout policy.
Withhold new update attempts while your team reviews the release.
Signed release and policy checks, cohort eligibility and maintenance windows still apply. An installation already in progress may finish; directly assigned MDM packages are a separate change channel.
Review release controlsRapport is at the beta and pilot stage. Confirm the specific agent release, platform, workflow and acceptance criteria with the team. The platform baselines on this page are planning guidance, not a claim that every OS, architecture or optional capability has completed customer acceptance.
Windows MSI and universal macOS PKG support IT-managed installation. Linux uses a verified installation script through your configuration-management process. Enrollment is tenant-scoped, expiring and use-limited. Agree the package version and deployment instructions before distributing credentials or assigning packages.
Device age alone does not determine suitability. Windows laptop planning guidance is a compatible 64-bit processor with at least two cores, 8 GB RAM, 1 GiB free space for agent files and local data, and preferably an SSD. These are recommendations, not validated minimums or guaranteed resource limits. Assess lower-specification devices with normal workloads and security software; updates and software installations can need additional space.
No inbound agent listening port or firewall exception is required. DNS and outbound HTTPS on TCP 443 must work from the SYSTEM or root service account during enrollment and runtime. Optional patch and software downloads need their vendor destinations as well. The team supplies the designated service endpoints for your deployment.
Validate both enrollment and ongoing operation under the service identity. PAC/WPAD discovery and integrated NTLM/Kerberos proxy authentication are not built in. TLS inspection requires an approved CA in the system trust store used by the agent; certificate verification stays enabled. Browser connectivity alone does not prove agent connectivity.
A tenant hold withholds future built-in updater attempts; an installation already in progress may finish. It cannot prevent a device-management administrator from explicitly installing a package. Assign only the intended, tenant-approved version, and treat package distribution and built-in updates as separate change channels.
No. Interactive terminal and MCP/public API access are withheld from beta customers. A visible interface or a source implementation does not establish availability. Scope the pilot around the capabilities explicitly approved for its release.
Bring your OS mix, representative device specifications, deployment tools and proxy/EDR requirements. We’ll use them to scope the evaluation.
