Enterprise Deployment

The Companion Agent is built to deploy across managed fleets with the MDM tools you already run. This guide covers packaging, configuration, and enrollment for Windows, macOS, and Linux.

Packages

Platform	Format
Windows	Signed MSI / MSIX for Intune or SCCM.
macOS	Signed & notarized `.pkg` for Jamf or MDM.
Linux	`.deb` and `.rpm`, plus a tarball for custom config management.

All installers are code-signed; verify checksums against the download center before distribution.

Configuration profile

The Agent reads a managed configuration profile delivered by your MDM. Core keys:

Key	Purpose
`tenant_id`	Your OSDF tenant identifier.
`idp`	Identity provider (`entra`, `okta`, `oidc`, `saml`, `piv`).
`origin_allowlist`	Origins permitted to call the loopback broker.
`policy_endpoint`	URL of the policy decision service.
`lease_max_ttl`	Maximum offline lease lifetime.
`require_hardware_key`	Enforce TPM / Secure Enclave backing.
`card_removal_action`	`lock` or `ignore` on smart-card removal.

json

{  "tenant_id": "acme-gov",  "idp": "entra",  "origin_allowlist": ["https://viewer.osdfsystems.com", "https://docs.acme.gov"],  "policy_endpoint": "https://policy.osdfsystems.com",  "lease_max_ttl": "300s",  "require_hardware_key": true,  "card_removal_action": "lock"}

Microsoft Intune (Windows)

Upload the signed MSI/MSIX as a Win32 or line-of-business app.
Attach the configuration profile as an OMA-URI or app config policy.
Scope to a device group of TPM-capable, managed endpoints.
Require device compliance (BitLocker on, Defender healthy) as a precondition.

Jamf (macOS)

Upload the notarized .pkg to Jamf Pro.
Deliver the configuration profile and a PPPC/TCC profile granting the Agent the entitlements it needs.
Scope to a smart group of Secure Enclave-capable Macs.

Linux MDM / config management

Distribute the .deb / .rpm via your repository, and the configuration file to /etc/osdf/companion-agent.json using Ansible, Puppet, or your tool of choice. Ensure the TPM 2.0 stack is present.

Enrollment at scale

On first launch under management, each Agent:

generates a hardware-backed device key,
registers its attested public key with the policy plane, and
associates the device with the signed-in user and your device records.

Zero-touch friendly

With MDM-delivered config and pre-staged IdP enrollment, the Agent can reach a Trusted state on first sign-in without manual steps.

Monitoring

Signed decision events stream to your configured audit sink and can be forwarded to a SIEM. See the security model for the audit event schema and integrity guarantees.