Use the managed deployment path when you are ready to roll Oriant out across
managed macOS devices with MDM.
Generate the deployment template
- In Oriant, open Settings → Deployment.
- Select Deploy to your fleet.
- Select Generate deployment template.
- Package the generated Agent binary URLs and LaunchDaemon plists in your
MDM. The dashboard provides artifacts for both Apple silicon (
arm64) and
Intel (amd64) Macs.
The template contains the Agent binary locations, an Agent LaunchDaemon, and a
watchdog LaunchDaemon. The watchdog manages the macOS system proxy and turns it
off if the Agent is continuously unhealthy, so a device fails open instead of
losing network access. This tunnel-only Agent needs no root CA or trust profile.
The generated Agent plist contains an organization-wide collector token.
Restrict the generated artifacts to your MDM administrators. Revoke exposed or
unused tokens in Settings → API Keys → Collector Tokens and generate a new
deployment template when needed.
Stamp the user identity
Every managed installation needs a stamped identity. Configure the Agent plist
through Intune so ORIANT_EMAIL contains the assigned user’s work email before
assigning it to devices. Configure ORIANT_SCAN_HOME when the MDM account does
not expose the user’s home directory to the Agent. Do not deploy an unstamped
template.
Verify the rollout
After assignment, check Assets for enrolled devices and their heartbeat
status, then check Users for attributed activity and coverage gaps. An idle
machine still reports its heartbeat, so device coverage does not depend on a
user visiting an AI provider. 
