Configure the device assistant’s model and limits
Select the available model, test its key, choose command behavior, and save explicit conversation and output budgets.
Before you start
- An administrator in the selected organization.
- A platform AI key or a tenant API key for the configured provider.
- Device assistant enabled in the policies of endpoints where it will be used.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Select the model and thinking behavior
Open Admin → AI Assistant. In Model, choose a model from the deployment’s offered list. Toggle Extended thinking to use adaptive reasoning on harder problems or turn it off. Model and switch changes save as you change them; wait for the control to finish saving before making the next change. Use the visible list as the authority for available models.
Choose and test the API key
Read the API key status: Tenant key configured, Using the platform key, or No key available. To use a tenant key, paste it in the password field and choose Save key. It is stored encrypted and is not displayed again. Remove removes the tenant key and falls back to the platform key if one is available. Choose Test connection and inspect the reply, latency, and reported key source.
What you should see: A successful test confirms this model/key connection at that moment; an endpoint must still be online and enabled to run a conversation.
Set command behavior
Under Capabilities & limits, enable Shell tool to let the assistant request shell commands under the approval engine. With it off, the assistant is limited to probes and file reads. Auto-run read-only commands lets read-only diagnostics run without technician approval; turn it off to require a technician approval for every command. These settings do not remove approvals for device-changing actions.
Save the network allowlist
Enter additional permitted hostnames in Network allowlist, one per line, such as corp.example.com. A leading wildcard such as *.vendor.net covers subdomains. Choose Save hosts after editing. Well-known vendor and public-DNS hosts are already allowed; access to other hosts is held for a technician. Enter hosts, not a pasted command or an entire policy document.
Set each conversation budget
Edit each numeric field and leave the field to save the valid value. Out-of-range or non-integer input reverts to its saved value. Set budgets deliberately for the diagnostic work your team performs.
| Field or control | What to do |
|---|---|
| Max turns per conversation | 1–200 model steps before the conversation pauses for you. |
| Max session minutes | 1–240 minutes of elapsed conversation time. |
| Max tool output (characters) | 1,000–60,000 characters retained from command/probe output before the model sees it. |
| Max output tokens | 1,024–32,000 tokens as the ceiling on each model reply. |
Verify a conversation on an enabled device
Open the target endpoint’s assistant, provide a specific diagnostic request, and watch the resulting tool requests and output. Check that read-only actions follow the setting and that requested device changes wait for the required approval. If the assistant pauses at a budget, review the collected results before deciding to continue or adjusting the organization’s budget.
If something doesn’t work
The assistant cannot run even though the page loads.
Check the API key badge and Test connection first. Then check the endpoint heartbeat and effective policy’s Device assistant module.
A numeric limit changed back.
The field accepts only whole numbers within its displayed range and saves on leaving the field. Enter a valid value and wait for saving to complete.
A network request waits for approval.
Check the requested host against Network allowlist. Save the exact additional hostname or permitted wildcard only if it is intended for your organization.