Choose your rollout
Pick between a single workstation, a team, or an MDM-managed fleet, and see what each path requires.
Three ways to install AgentKeeper. They differ in who runs the installer and where the credential comes from.
Compare
| One workstation | Team | Fleet with MDM | |
|---|---|---|---|
| Who installs | The developer | The developer, with a shared key | Your MDM, silently |
| Credential | Device-code login in a browser | Org API key | Enrollment token in managed config |
| Scale | 1 machine | Up to ~50 | Unlimited |
| Time to first event | Under 5 minutes | Under 5 minutes per machine | Hours to days, including MDM approval |
| Uninstall | The developer can remove it | The developer can remove it | Protected by control integrity |
| Needs an admin | No | Yes, to create the key | Yes, MDM plus AgentKeeper admin |
Pick one
Evaluating AgentKeeper, or one developer
Use Connect one workstation. No MDM, no shared secret.
A team that shares a repo or a CI pipeline
Use Team deployment with an API key, and add GitHub repo hooks to cover agent activity in pull requests.
A managed fleet
Use Fleet with MDM. Start with one pilot group, prove a PASS and a BLOCK event, then widen the scope.
Fleet paths by platform
| Platform | Supported MDM | Guide |
|---|---|---|
| macOS | Jamf Pro, Microsoft Intune, Iru / Kandji | macOS |
| Windows | Microsoft Intune, Group Policy | Windows |
| Linux (RPM) | Configuration management, cloud-init | Linux |
| Browsers | Same MDM, plus Google Workspace | Browser extension |
You can mix them
Start one developer on the device-code flow while your MDM package goes through change approval. The same workstation can later be re-enrolled with a fleet token without reinstalling the agent.
Adding directory sync at any point maps existing workstations to real people and groups, so policy can target a team instead of a hostname.