Deploying the Device Agent

There are two supported ways to get the agent onto a device. Both use a deployment token — a reusable, capped enrollment secret you generate in Security Operations > Endpoint Management > Agents. The agent reads that token at first run to enroll.

Signed installers

Signed .pkg (macOS), .msi (Windows), and Linux packages are published from the Agents screen once available. Until then, deploy through your MDM using a deployment token.

Choosing a deployment method

	MDM (recommended)	Self-serve manual install
Best for	Managed fleets already in Jamf Pro or Intune	Unmanaged devices, pilots, contractors
Token delivery	Managed configuration (plist / JSON)	Entered at first-run setup
Scale	Whole fleet at once	One device at a time
Token exposure	Stays inside MDM	Handled by the installer

MDM deployment

1. In Agents, choose Generate deployment token. Give it a name and an enrollment cap; expiry is optional.
2. Copy the managed configuration snippet shown once at generation. The key is always enrollmentToken.
3. Place the snippet in your MDM's managed app configuration and scope the app to your target devices.

Jamf Pro

Add an Application & Custom Settings profile (or the app's managed config) with this plist:

<dict>
  <key>enrollmentToken</key>
  <string>YOUR_DEPLOYMENT_TOKEN</string>
</dict>

Microsoft Intune

Add an app configuration policy with this JSON:

{
  "enrollmentToken": "YOUR_DEPLOYMENT_TOKEN"
}

The installer picks up the token from managed configuration as it deploys to the fleet. Devices enroll automatically on first run.

Self-serve manual install

For devices not under MDM, run the installer directly and provide the deployment token when prompted during first-run setup.

macOS

1. Run the signed .pkg installer.
2. When prompted, paste the deployment token to complete enrollment.
3. Approve the background item / system extension if macOS requests it.

Windows

1. Run the signed .msi installer (double-click, or msiexec /i concertogrc-agent.msi for silent/scripted installs).
2. Provide the deployment token at first-run setup.
3. The agent registers as a Windows service and begins reporting posture.

Linux (beta)

1. Install the distributed package for your distribution.
2. Supply the deployment token via the first-run setup prompt.
3. The agent runs as a systemd service.

After deployment

Each device presents the deployment token once, enrolls, and receives its own rotating credential. Enrolled devices appear in the Agents enrollment table with their posture, agent version, and update state. To understand what happens next, see Token & Enrollment Lifecycle.

Handling the token safely

The plaintext deployment token is shown only once at generation. Store it only in your MDM managed configuration — never in a ticket, chat message, or shared document. A single token is reusable up to its enrollment cap. If a token may have been exposed, revoke it.