Deployment | AI Agent Security

Deploying the AI Agent Security agent means establishing trust first, then installing and enrolling. Enrollment uses a deployment key (an enrollment secret the agent presents the first time it runs). The Agent Deployment page is where you start a deployment, create those keys, and manage the ones already issued.

A deployment key is a credential. Anything holding a valid key can enroll an agent into your environment, so treat the keys on this page with the same care as any other secret.

Scope of this guide

This guide explains the Agent Deployment page, the Deploy an agent wizard, and the Deployment keys list. It does not cover each operating system's install steps in detail; those are in Windows manual install and Mac manual install.

Prerequisites

You have administrator access to the tenant.

Open the Agent Deployment page

Go to Settings > Deployment.

The page shows the Deploy an agent button and, below it, the Deployment keys list.

Deploy an agent

Select Deploy an agent to open the wizard. Choose the operating system with the Windows or macOS tab at the top, then work through the four steps listed on the left. You can move between steps at any time with Back and Continue, or by selecting a step in the list.

Step	Description
Trust the CA	Choose how your tenant's root certificate reaches your machines.
Create a key	Create the deployment key the agent uses to enroll.
Install and enroll	Copy the install command, or download the installer, with the key already filled in, and watch for the machine to check in.
Test	Run a short AI coding session and confirm that it appears in AI Agent Security.

Trust the CA

Your tenant has its own root certificate authority (CA), and each machine has to trust it. Without that trust, the agent cannot read the encrypted traffic between AI tools and their servers, so none of your policies can apply.

Choose how the CA reaches your machines.

Option	Description
Push it with device management	Recommended. On Windows, Intune or Group Policy installs the CA into every machine's Trusted Root store before the agent runs; select Download .cer to get the file. On macOS, your MDM installs a configuration profile that trusts the CA and approves the agent's system extensions, and you download that profile on the Install and enroll step. The result is consistent across the fleet, and you can withdraw the CA later.
Let the agent install it	Windows only. The agent downloads the CA from your tenant and installs it when it activates. Simplest for one machine or a trial.
Install it yourself	macOS only. Select Download .cer and run the trust command the step shows on the Mac. Simplest for one machine or a trial.

A Mac cannot trust the CA on its own, so a Mac needs either device management or the hands-on steps.

Choose device management for anything beyond a trial. Central management is what lets you withdraw the CA later. A certificate the agent installed on each machine individually has to be removed the same way.

Create a key

The Create a key step creates the deployment key.

Field	Description
Name	A name for the machine or batch the key is meant for. The name is required.
Usage	One-time use enrolls a single machine, then the key is spent. Multiple uses enrolls several machines, up to the number in Max uses; leave Max uses blank for no limit.
Expires after	How long the key stays valid: 24 hours, 7 days (the default), 30 days, 90 days, 1 year, or No expiry.

Select Create & get command. You never copy the key from a dialog: the wizard puts it into the install commands on the next step, and the new key appears in the Deployment keys list.

Install and enroll

The Install and enroll step shows numbered steps for the chosen operating system, with your key and console URL already in every command.

Windows: choose an install method. One command (recommended) downloads, verifies, installs, and enrolls the agent from an elevated PowerShell session, then confirms that the service started. Downloaded script runs the same install from a copy of install.ps1 you can read first. MSI (Intune / GPO) gives you the MSI download and the silent install command for your distribution tool.
macOS: with device management, download the configuration profile for your MDM, download the pkg, and paste the post-install enrollment script into your MDM. With the hands-on option, install the pkg, turn on the two system extensions, and run the enroll command in Terminal.

Once a key exists, the step waits for the agent to check in and shows the machine's hostname followed by enrolled when it does.

Test

The Test step gives a command for each supported AI coding assistant to confirm that AI Agent Security receives its activity. Choose the assistant you installed, run the command, then select Open AI Sessions to see the session or View in Endpoints to see the machine.

Deployment keys

The Deployment keys list groups keys by platform under a Windows heading and a macOS heading. A key's platform is the operating system tab it was created from; it groups the list but does not restrict which machines can enroll with the key. Keys with no platform appear under Any platform if they have enrolled machines, or Unused if they have never been used.

To find a key, enter part of its name in Search deployment keys. The search covers every heading at once.

Column reference

Column	Description
Name	The name given to the key when it was created.
Status	Whether the key can still be used. See Statuses.
Context	What the key enrolls, such as Host.
Usage	How many times the key has been used, against its limit, such as `1 / 1`.
Created	The date the key was created.
Expires	The date the key expires, or No expiry for a key that does not.
Revoke	A trash icon for revoking the key.

Statuses

Badge	Description
Active	The key has not expired.
Expired	The key has passed its expiry date and can no longer be used.
Revoked	The key has been revoked and can no longer be used.

Status follows the expiry date, not usage. A key showing Active with a usage of 1 / 1 has been used up but has not yet expired, and a key showing Expired with 0 / 1 was never used at all.

Revoke a key

Select the trash icon at the end of the key's row. In the Revoke this key? dialog, select Revoke. Agents can no longer enroll with the key.

The trash icon appears only on Active keys. Revoking does not remove the row: a revoked key stays in the list with a Revoked badge, so revoked and expired keys accumulate over time.

Deployment key details

Select a key in the list to open its details panel. The header shows the key name and its status badge, with the key's use limit below, such as One-time use for a key that can enroll one machine. To close the panel, select the X in the top right corner.

Key fields

Field	Description
Context	What the key enrolls, such as Host.
Usage	How many times the key has been used, against its limit.
Created	The date the key was created.
Expires	The date the key expires.
Created by	The account that created the key.

Created by appears only here, not in the list. When you are working out whether a key is still needed, it tells you who to ask.

Enrolled endpoints

The Enrolled endpoints section lists the machines enrolled with this key, with a count in the heading.

Column	Description
Endpoint	The endpoint name, with its platform icon.
System	The operating system and architecture, such as `macOS 26.6.2 · Apple Silicon`.
Enrolled	The date the endpoint enrolled.

This section is the audit trail for the key: it tells you exactly what the secret was used to bring into your environment. Check it before revoking, and check it on any key whose usage you did not expect.

Select View in Endpoints to open these machines on the Endpoints page.

Revoke from the details panel

Select Revoke key at the bottom of the panel, then confirm.

Revoking stops the key being used for any further enrollment. It does not remove the endpoints already enrolled with it. Those stay in your inventory and keep reporting. To remove one of them, revoke that endpoint from the Endpoints page instead.

Verify the results

After creating a key, confirm it appears under the right platform heading with the Expires date you intended. After revoking one, confirm its row shows a Revoked badge.

Open a key and check its Enrolled endpoints count against its Usage. A key that enrolled a machine you do not recognize is a key to revoke.

Manage your keys

A deployment key is a credential with a lifetime, and the list is worth reviewing on a schedule rather than only when you deploy.

Set an expiry. A key showing No expiry stays valid indefinitely. If it leaks, it stays useful to whoever has it for as long as your environment exists.
Keep expiry dates short. A key needs to be valid only long enough to enroll the machines you are deploying to. Compare the Created and Expires dates on your keys. A week is a reasonable window, a year is a standing liability.
Revoke keys you have finished with. Once a key has been used for its intended deployment, revoke it rather than leaving it active until it expires.
Watch for unused keys. A key at 0 / 1 that expired was never used. Either the deployment did not happen, or it happened another way. Both are worth knowing.

Next steps

Review every key showing No expiry and decide whether it should exist.
Revoke the Active keys you no longer need.
Confirm each newly enrolled machine appears on the Endpoints page.