Install and enroll the Rapport agent
Use an install link, a verified terminal command, or an MDM package, then confirm enrollment and the first heartbeat.
Before you start
- An MFA-verified administrator in the intended organization.
- Administrator/root access on the endpoint and access to your deployment’s published release packages.
- For bulk deployment, an Intune, Configuration Manager, Group Policy, Jamf, or equivalent device-management assignment.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Open the installer for the correct organization
Open Admin → Agent Fleet and choose Install agent. For command installation, wait for Verified signed release and its version. A release verification error deliberately hides executable commands; use Retry after the release problem is resolved. A test project may explicitly offer unsigned internal preview packages instead. Check the page’s release label before choosing a package.
Send a guided install link to one person
In Send an install link, set the number of Devices, Valid for days, and optional Place devices in OU (for example, Finance). Choose Create install link, copy the link or the Ready to send message, and send it to the intended recipient through your approved channel. They open the link on the target PC or Mac, download the offered installer, and open it; the link supplies enrollment without asking them to type a token.
| Field or control | What to do |
|---|---|
| Devices | Maximum enrollments permitted by this link; use 1 for one person. Deployment tokens are capped at 100 devices. |
| Valid for days | Expiry window, up to 7 days. A link stops working after expiry, exhaustion, or revocation. |
| Personal Windows PC (BYOD) | Enable only when intentionally permitting the displayed weaker drive-permission condition. The agent flags that device because another local user could tamper with its files. |
Install directly on Windows
For a technician-led installation, choose Generate token under Install token; it enrolls one device and expires after 24 hours. Select Windows and copy the current Install command. Open PowerShell as Administrator on the device, run that command, and enter the token at its secure prompt. Use the command produced by your console because it pins the published release and verifies its signed hash. Under Verify it’s running, run the displayed check.
Get-ScheduledTask -TaskName DexIQAgentWhat you should see: The registered background task should be present. This local check still needs the console enrollment check in the final step.
Install directly on macOS or Linux
Select macOS and run the copied command in Terminal, or select Linux and run it as root or with sudo. Enter the generated token when prompted; the command does not put the token in process arguments. The installer configures launchd on macOS or systemd on Linux so the agent starts on boot and runs without an open terminal. Use the corresponding Verify it’s running command.
# macOS
sudo launchctl print system/com.rezolveai.dexiq-agent | grep state
# Linux
systemctl status dexiq-agentDeploy Windows packages with device management
In Deploy with device management, set the device count, expiry, and optional OU, then choose Generate deployment token. Download the published Windows package for the correct architecture. In Intune, use Apps → Windows → Add → Line-of-business app, upload the MSI, and set Command-line arguments to DEXIQ_TOKEN=<token>. Assign it to your device groups. For Configuration Manager, a Group Policy script, or RMM, run the displayed MSI command as SYSTEM or an administrator.
msiexec /i DexIQAgent-windows-x64.msi DEXIQ_TOKEN=<token> /qn /norestart /l*v "%WINDIR%\Temp\DexIQAgent-install.log"Deploy the macOS package and enrollment profile
Upload the PKG through Intune Apps → macOS → Add → macOS app (PKG), or Jamf Pro Packages and an installation policy. Separately deploy a preference profile for domain com.rezolveai.dexiq-agent containing EnrollmentToken. In Intune use Devices → macOS → Configuration → Templates → Preference file; in Jamf use Configuration Profiles → Application & Custom Settings → Upload. Enrollment starts when both package and profile arrive, in either order.
<dict>
<key>EnrollmentToken</key>
<string>YOUR_DEPLOYMENT_TOKEN</string>
</dict>Confirm the endpoint enrolled and is reporting
Open Endpoints or Admin → Agent fleet, search the hostname, and inspect Last heartbeat, reported agent version, assigned OU, and tags. Open View for the device to confirm its inventory and the intended policy. A completed installer or scheduled task alone does not prove enrollment. Wait for a fresh heartbeat and evidence from enabled modules before considering onboarding complete.
What you should see: The target device is visible in the intended organization, with a recent heartbeat and its expected scope.
Close the deployment and remove agents when needed
Revoke unused links/tokens after the deployment wave. Use the console’s platform-specific Uninstall command for command installations. For MSI deployment, the UI documents msiexec /x DexIQAgent-windows-x64.msi /qn; it revokes the device first. An offline Windows uninstall requires DEXIQ_FORCE_UNINSTALL=1, followed by console removal. macOS packages provide sudo /usr/local/dexiq-agent/uninstall.sh, with FORCE_UNINSTALL=1 for offline removal. To restore credentials while keeping device history, use an endpoint-bound Recovery token from Agent fleet.
If something doesn’t work
No install command or package appears.
A command requires a generated token and verified signed release metadata. Install links require published MSI/macOS packages. Resolve the stated release or package availability problem and retry; do not substitute an unrelated download URL.
The token is rejected or already used.
Check Install tokens for Revoked, Expired, or Used status and the install count. Generate a new bounded token for a new device. Use Agent fleet → Recovery token for an existing endpoint whose credentials must be replaced.
The installer finished but the device is missing.
Verify the local service/task is running, confirm the install link/token belonged to the intended organization, and check the token’s last-use/count. Inspect local enrollment/network errors and return to Agent fleet for a fresh heartbeat.