> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oriant.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy Oriant across your macOS fleet

> Prepare an Intune deployment for Oriant across managed macOS devices.

Use the managed deployment path when you are ready to roll Oriant out across
managed macOS devices with MDM.

## Generate the deployment template

1. In Oriant, open **Settings → Deployment**.
2. Select **Deploy to your fleet**.
3. Select **Generate deployment template**.
4. Package the generated Agent binary URLs and LaunchDaemon plists in your
   MDM. The dashboard provides artifacts for both Apple silicon (`arm64`) and
   Intel (`amd64`) Macs.

The template contains the Agent binary locations, an Agent LaunchDaemon, and a
watchdog LaunchDaemon. The watchdog manages the macOS system proxy and turns it
off if the Agent is continuously unhealthy, so a device fails open instead of
losing network access. This tunnel-only Agent needs no root CA or trust profile.

<Warning>
  The generated Agent plist contains an organization-wide collector token.
  Restrict the generated artifacts to your MDM administrators. Revoke exposed or
  unused tokens in **Settings → API Keys → Collector Tokens** and generate a new
  deployment template when needed.
</Warning>

## Stamp the user identity

Every managed installation needs a stamped identity. Configure the Agent plist
through Intune so `ORIANT_EMAIL` contains the assigned user's work email before
assigning it to devices. Configure `ORIANT_SCAN_HOME` when the MDM account does
not expose the user's home directory to the Agent. Do not deploy an unstamped
template.

## Verify the rollout

After assignment, check **Assets** for enrolled devices and their heartbeat
status, then check **Users** for attributed activity and coverage gaps. An idle
machine still reports its heartbeat, so device coverage does not depend on a
user visiting an AI provider.