Device Agent Overview
The ConcertoGRC device agent is a lightweight background service that reports device security posture, agent health, and policy evaluation results to your ConcertoGRC tenant. It gives your compliance program continuous, first-party evidence of endpoint controls — disk encryption, host firewall, screen-lock/passcode, and operating-system currency — without an MDM round-trip for every check.
The agent is designed for compliance monitoring, not surveillance. It does not collect application inventories, browser history, document contents, keystrokes, or employee credentials. See the Security & Privacy Data Sheet for the full disclosure.
How it fits together
- Generate a deployment token in Security Operations > Endpoint Management > Agents. A deployment token is a reusable, capped enrollment secret.
- Deploy the agent to your fleet — either through your MDM (Jamf Pro or Microsoft Intune) with the token placed in managed configuration, or by running the installer manually and supplying the token at first run.
- Devices enroll by presenting the deployment token once. Each device receives its own rotating credential — the shared deployment token is never reused for ongoing heartbeats.
- Devices report posture on a heartbeat; enrolled devices appear in the Agents enrollment table with their version, update state, and posture.
Where to go next
| Task | Page |
|---|---|
| Deploy the agent (MDM vs. self-serve, per OS) | Deployment |
| Understand tokens, enrollment, and rotation | Token & Enrollment Lifecycle |
| Revoke a token, a lineage, or an enrolled device | Revoke Semantics |
| Review what is and isn't collected | Security & Privacy Data Sheet |
| Diagnose enrollment and heartbeat problems | Troubleshooting |