Skip to main content
MDM deployment is the recommended approach for fleet-wide Origin agent rollouts. Rather than installing the agent manually on each endpoint, your MDM platform handles distribution, profile delivery, and token provisioning automatically — at any scale. This overview covers all four supported MDM paths and the requirements common to each.
For manual installation on individual endpoints, see macOS Install and Windows Install instead. MDM deployment is intended for environments where per-endpoint installation is not practical.

​
Supported MDM methods

macOS via Jamf Pro

Silent fleet deployment using a Jamf Pro configuration profile, a JWT-staging script, and an enrollment-triggered install policy. Zero user interaction required.

macOS via Microsoft Intune

Deploy the Origin macOS agent through Intune using a Custom configuration profile, a shell script for JWT staging, and a macOS PKG app deployment.

Windows via Microsoft Intune

Package and push the Origin Windows MSI to managed endpoints as a line-of-business app with the provisioning JWT passed as a command-line argument.

macOS via Tanium

Use Tanium Device Management to push the MDM profile and Tanium Deploy to install the agent — fully automated and gated on profile confirmation.

​
Common requirements

Every MDM deployment method shares the same prerequisites. Gather these from the Origin console before opening your MDM platform.
These are two separate views in Settings. Installers holds the agent downloads; the provisioning token is created under Provisioning Tokens. See Provisioning Tokens — note that tokens carry an expiry and a use limit, so confirm both are sufficient for the size of your rollout.

​
macOS profile deployment

All three macOS MDM paths — Jamf Pro, Intune, and Tanium — follow the same profile-first model. One configuration profile must reach the endpoint before the Origin installer runs.
The PPPC profile must be confirmed installed on an endpoint before the Origin package runs. If the installer executes first, the agent hits interactive permission prompts and silent registration fails. Each MDM guide enforces this ordering — follow the steps in sequence.
Because the permissions are pre-approved by MDM policy, no end-user interaction is required at any point during or after installation. The agent registers silently and begins observing AI activity immediately.

​
Deployment package

The macOS guides use a PPPC configuration profile and an MDM-specific install script. Download the current set before starting: Origin MDM Deployment Package → Google Drive The file you need is origin-privacy.mobileconfig, plus the install script for your MDM platform.
The bundle may still contain profiles from Origin’s earlier proxy-based capture architecture — a proxy root CA template, a system-extensions policy, and a VPN/transparent-proxy profile. These are no longer required and should not be deployed. Origin now captures AI activity through OpenTelemetry, application hooks, and provider API integrations, none of which need a local proxy or a trusted root certificate. See AI Provider Support for how each application is captured.