MDM rollout

This page is Endpoint Protection's deployment path; Proxara Connect installs nothing and needs none of it. Production device deployment rides the management tooling the firm already operates, and employees see none of it: no installer window, no prompt, no restart request. This page documents the Windows path in full, which is how device pilots deploy. The macOS path is summarized at the end.

Two things reach each Windows device: the firm's certificate profile and the signed agent installer. Both are assigned to a device group, and devices activate themselves.

The two pushes

How the install runs

• Intune runs the installer silently in the system context: no employee interaction, no administrator rights for any user, no visible window.
• Assignment is to a device group, never a user group, so the certificate and the agent land together on the same machines.
• Success and failure are visible per device in Intune, and each installed device appears in the firm's console as it comes up.
• On first start the agent registers the device against the firm's environment using the enrollment code, mints the device's own signing keys, clears the enrollment code from the device, and begins capture.

A firm that manages its Windows fleet through an IT provider's remote-management tool (an RMM) rather than Intune deploys the same signed MSI the same way: silently, in the system context, with the same installer properties. Nothing in the package is Intune-specific.

The staged rollout

The push is staged, and each stage is a gate:

1. One device-only group is created holding exactly one IT-controlled machine, and Single-device validation runs on it.
2. Only after that machine passes, and the firm's endpoint owner accepts the result, is the same group expanded to the exact agreed pilot cohort.
3. The Endpoint pilot clock starts when every intended device is active and reporting, never while deployment is still converging.

The group is never assigned broadly during validation, and no employee device is enrolled before the gate.

If the certificate does not land

Nothing breaks. The agent detects that its certificate is not trusted, stays in full passthrough, and alerts the operator. Employees notice nothing; the device simply is not covered until trust arrives. The never-block posture in The device proxy applies from first boot.

The Windows driver

The production Windows agent captures traffic with a network driver signed by Microsoft through its hardware certification program. The release pipeline refuses to package a driver Microsoft has not signed, so what a fleet receives is exactly what Windows itself verifies at load. The driver holds capture only while the agent is healthy; when it is not, its authorization lapses within seconds and traffic flows natively. Trial and sandbox installs use the operating-system proxy configuration instead and carry no driver, and every device reports which capture mode it runs. Coexistence describes the exact behavior beside the firm's VPN, endpoint security, and filtering.

Updates

Production installs receive signed, silent updates: the agent checks the firm's own endpoint, downloads from one pinned release host, verifies the file's hash against what the server declared and then the code signature, and installs without user interaction. Network endpoints lists both destinations.

Confirming the rollout

The console's Overview shows covered devices and AI surfaces, and devices appear in the record as they see their first AI traffic. A device that has been up for a while without appearing usually means the certificate has not landed, which the operator alert will already have said.

macOS

The macOS path has the same shape: a signed and notarized package plus a trust profile, pushed through Jamf, Kandji, Intune, or any MDM that can deliver a package and a configuration profile. On supervised or user-approved devices the trust profile lands silently. Pilots run on Windows; a firm with Macs in scope raises it at the review meeting and gets the exact current state rather than a promise.

The rest of the review path

Single-device validation is the checklist for the first device, Coexistence covers the security stack, Network endpoints lists what to allow, and Rollback and uninstall is the way back out, including the order to remove things in.