> ## Documentation Index
> Fetch the complete documentation index at: https://docs.originhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy the Origin Agent via MDM: Jamf, Intune, Tanium

> Push the Origin agent to your entire macOS or Windows fleet using Jamf Pro, Microsoft Intune, or Tanium — one configuration profile and a provisioning token.

MDM deployment is the recommended approach for fleet-wide Origin agent rollouts. Rather than installing the agent manually on each endpoint, your MDM platform handles distribution, profile delivery, and token provisioning automatically — at any scale. This overview covers all four supported MDM paths and the requirements common to each.

<Note>
  For manual installation on individual endpoints, see [macOS Install](/getting-started/macos-installation) and [Windows Install](/getting-started/windows-installation) instead. MDM deployment is intended for environments where per-endpoint installation is not practical.
</Note>

## Supported MDM methods

<CardGroup cols={2}>
  <Card title="macOS via Jamf Pro" icon="apple" href="/getting-started/macos-via-jamf">
    Silent fleet deployment using a Jamf Pro configuration profile, a JWT-staging script, and an enrollment-triggered install policy. Zero user interaction required.
  </Card>

  <Card title="macOS via Microsoft Intune" icon="microsoft" href="/getting-started/macos-via-intune">
    Deploy the Origin macOS agent through Intune using a Custom configuration profile, a shell script for JWT staging, and a macOS PKG app deployment.
  </Card>

  <Card title="Windows via Microsoft Intune" icon="windows" href="/getting-started/windows-via-intune">
    Package and push the Origin Windows MSI to managed endpoints as a line-of-business app with the provisioning JWT passed as a command-line argument.
  </Card>

  <Card title="macOS via Tanium" icon="shield" href="/getting-started/macos-via-tanium">
    Use Tanium Device Management to push the MDM profile and Tanium Deploy to install the agent — fully automated and gated on profile confirmation.
  </Card>
</CardGroup>

## Common requirements

Every MDM deployment method shares the same prerequisites. Gather these from the Origin console before opening your MDM platform.

| Requirement                                               | Where to get it                                     |
| --------------------------------------------------------- | --------------------------------------------------- |
| **Provisioning JWT** (install token)                      | Origin console → **Settings → Provisioning Tokens** |
| **Origin installer** (`Origin.pkg` or the Windows `.msi`) | Origin console → **Settings → Installers**          |

<Note>
  These are two separate views in Settings. Installers holds the agent downloads; the provisioning token is created under Provisioning Tokens. See [Provisioning Tokens](/getting-started/provisioning-tokens) — note that tokens carry an expiry and a use limit, so confirm both are sufficient for the size of your rollout.
</Note>

## macOS profile deployment

All three macOS MDM paths — Jamf Pro, Intune, and Tanium — follow the same profile-first model. One configuration profile must reach the endpoint before the Origin installer runs.

| Profile                        | What it does                                                                                                                                                                          | User action required |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
| **Privacy Preferences (PPPC)** | Grants Full Disk Access and Endpoint Security Client access to the Origin agent (Team ID `D3C73MWD7Y`, bundle ID `com.origin.agent`), eliminating TCC permission dialogs on first run | None                 |

<Warning>
  The PPPC profile must be confirmed installed on an endpoint **before** the Origin package runs. If the installer executes first, the agent hits interactive permission prompts and silent registration fails. Each MDM guide enforces this ordering — follow the steps in sequence.
</Warning>

Because the permissions are pre-approved by MDM policy, no end-user interaction is required at any point during or after installation. The agent registers silently and begins observing AI activity immediately.

## Deployment package

The macOS guides use a PPPC configuration profile and an MDM-specific install script. Download the current set before starting:

[**Origin MDM Deployment Package → Google Drive**](https://drive.google.com/drive/folders/1r3PYJdVMgnTVjzyJqzKvys8rTFqWsKKF)

The file you need is `origin-privacy.mobileconfig`, plus the install script for your MDM platform.

<Note>
  The bundle may still contain profiles from Origin's earlier proxy-based capture architecture — a proxy root CA template, a system-extensions policy, and a VPN/transparent-proxy profile. **These are no longer required and should not be deployed.** Origin now captures AI activity through OpenTelemetry, application hooks, and provider API integrations, none of which need a local proxy or a trusted root certificate. See [AI Provider Support](/getting-started/ai-providers) for how each application is captured.
</Note>