> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfors.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise deployment

> Roll out the Enfors watcher to a fleet via MDM (Jamf/Mosyle on macOS, Intune/GPO on Windows).

For individual machines, the [watcher installer](/integrations/gateway-installer) is
the fastest path. For a fleet, the watcher deploys via **Jamf or Mosyle** on macOS, or
**Intune / Group Policy / a login script** on Windows — and because there is **no CA to
trust and no proxy to configure** on either platform, the rollout is much lighter than the
old proxy-based approach. (Agent SDKs integrate with the gateway separately and need no
per-machine certificate.)

<Info>
  The exact scripts and MDM runbook ship in the **IT & CISO Deployment Package** (provided
  under NDA). This page is the high-level shape.
</Info>

## How fleet deployment works

<Steps>
  <Step title="Package the watcher">
    <Tabs>
      <Tab title="macOS">
        Bundle `enfors_watcher.py`, the `watcher.env` config, and the
        `ai.enfors.watcher.plist` LaunchAgent template.
      </Tab>

      <Tab title="Windows">
        Use the installer script directly (`enfors-install-windows.ps1`) — it registers
        its own Scheduled Task, so there's no separate template to bundle.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Deploy silently">
    <Tabs>
      <Tab title="macOS (Jamf/Mosyle)">
        Push the files to `~/.enfors/hooks/` and load the LaunchAgent as a Jamf script.
        No certificate profile, no `sudo`, no keychain changes.
      </Tab>

      <Tab title="Windows (Intune/GPO)">
        Run the installer command as a policy or login script:
        `irm https://get.enfors.ai/install.ps1 | iex`. No certificate, no admin
        elevation — it only touches per-user files and a per-user Scheduled Task.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Scope and test">
    Scope the policy to your AI-engineering group and test on one machine per platform
    before fleet rollout.
  </Step>

  <Step title="Each user signs in once">
    Because auth is per-user Cognito OAuth, each user runs `enfors login` once (a browser
    sign-in). After that, tokens refresh automatically.
  </Step>
</Steps>

<Note>
  The menu bar / tray
  [disclosure indicator](/integrations/gateway-installer#the-menu-bar-and-tray-indicator) is
  compiled on the endpoint. On macOS this requires the **Xcode Command Line Tools** — on
  machines without them the installer skips it (monitoring is unaffected); ship CLT via MDM,
  or re-run the installer after installing them, to get the visible-monitoring mark
  fleet-wide. On Windows it compiles unconditionally — nothing extra to ship.
</Note>

## Review checklists

<Tabs>
  <Tab title="IT Admin">
    * Package the watcher files + LaunchAgent (macOS) or point the policy at the
      installer command directly (Windows)
    * Deploy silently via Jamf/Mosyle (macOS) or Intune/GPO/login script (Windows)
    * Scope to the AI-engineering group; test on one machine per platform first
    * Communicate the one-time `enfors login` step to users
  </Tab>

  <Tab title="CISO / Security">
    * Review [data captured vs. not captured](/security/data-handling)
    * Confirm [data residency](/security/data-residency-retention) with your Enfors rep
    * Confirm there is **no CA / no TLS interception** on the Claude Desktop path, on
      either platform (see [Network & TLS](/security/network-tls))
    * Confirm a DPA is in place with Enfors Labs
  </Tab>
</Tabs>

## Fleet revocation & offboarding

* **Revoke a user:** disable them in Cognito → watcher uploads stop and tokens can't refresh.
* **Offboard a machine:** `enfors stop`, then remove the LaunchAgent (macOS) or Scheduled
  Task (Windows) and `~/.enfors/hooks/` via your MDM/GPO policy.
* **Nothing to untrust:** there is no CA in the keychain (macOS) or certificate store
  (Windows), and no proxy to remove, on either platform.