Skip to main content

Bulk enrollment with your MDM

Push Connect and one enrollment policy through your device platform. Each machine enrolls to the email the MDM assigns, with no browser and no sign-in prompt.

FleetLane
Managed MacsThe package and profile. Works with Jamf Pro, Kandji, Intune, or any MDM that installs a package and a profile.
Windows and LinuxA managed installer plus a policy file.
API-key fleet, SSO not connected yetA provisioning token.
Subscription (seat) fleetThe same Mac or Windows and Linux lane.

Contractors, BYOD machines, and anything outside your MDM take the one-command path. Depth on everything here is in the MDM reference.

Enroll managed Macs with the package and profile​

macOS 13 and later, Apple silicon and Intel. One profile and one package serve every Mac in scope, and each Mac still gets its own key.

1
Create the profile

Console, then Users, then Add user. Expand Enrolling a managed fleet via MDM? at the bottom, and on the macOS tab pick Create & download next to anyray-enroll.mobileconfig. Save it. It is shown once.

2
Set the assigned email

Jamf Pro, Kandji, and Intune fill the $EMAIL placeholder in EnrollmentEmail from the computer's assigned user. With another MDM, use its per-device email variable. Replace only $EMAIL, and never hardcode one address across the fleet.

3
Deploy the profile and the package

Download anyray-connect.pkg from the same console step and deploy both to the same Macs in device scope. Either order works.

The Mac is enrolled

No browser or password prompt appears. The user shows under Users with source MDM provisioning, anyray-connect doctor reports a valid enrollment, and the desktop app's dot turns green.

Deeper (admin-API mint, retries, rotation): Managed Macs.

Enroll Windows and Linux without a browser​

1
Download the files

Console, then Users, then Add user. Expand Enrolling a managed fleet via MDM?, choose Windows or Linux, and download the installer or package plus the generated policy file.

2
Deploy the policy file

Windows: import anyray-enroll.reg as SYSTEM. Connect reads HKLM\SOFTWARE\Policies\Anyray\Connect. Linux: put the JSON policy at /etc/anyray/anyray-enroll.json, root-owned, mode 0600.

Treat the file as a secret. Its EnrollmentUrl carries the reusable enp_… credential, so restrict it to administrators and rotate the link if it leaks.

3
Install Connect

Windows: run the managed installer once in each assigned user's context. Linux: deploy the signed .deb or .rpm from the releases page. Never run it as SYSTEM or root. It exits rather than write a privileged account's profile.

Windows managed installer
& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--managed"

Deeper (runner behavior, policy-file checks): Windows and Linux.

Enroll an API-key fleet with a provisioning token​

A provisioning token (enp_…) is a reusable credential that lives in your MDM. Each machine runs one command, gets its own ark_… key, and never needs the token again.

1
Mint the token

Console, then Users, then Add user, then Enrolling a managed fleet via MDM?. Copy the raw token into your MDM secrets vault. It is shown once. Leave Mode on email and pick the domain under Who can enroll (one per file, from the Email domains card). Matching is exact, so a subdomain does not satisfy its parent.

2
Deploy the enrollment command

Use the URL shown at mint. With another MDM, swap in its own user variable. Your MDM fills in the device owner's email, and an empty variable is rejected with email is required for this provisioning token.

Jamf
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enp_synthetic_example --user $EMAIL --yes
The fleet is enrolled

Enrolled users appear in Users with source MDM provisioning, one key per machine. Keys renew on their own while a machine stays in use.

Token lifetime and what the command configures

A token accepts new enrollments for 365 days. Expiry never touches issued keys, and no fleet artifact carries a static key. The command sets up tools only, and holds back Claude Desktop. A Default team is optional, and a SCIM-mapped team beats it. Machine mode, --endpoint, and the Desktop trade-off are in provisioning tokens.

After you connect SSO

Manual tokens no longer mint, rotate, or redeem. Use the Mac package or legacy lanes, which enroll with SSO on or off.

Subscription (seat) fleets​

A seat fleet enrolls through the Mac or Windows and Linux lane above, with nothing extra. Claude Code and Codex keep the developer's own seat sign-in for inference. Headless and CI machines get a service key instead.

Offboard​

Revoking a token stops new enrollments only

An enrolled machine holds a certificate that keeps renewing its key while the machine is in use, so waiting for expiry offboards nobody.

Revoke the user, then the live key. A machine-mode device offboards differently.

To rotate an exposed token, revoke it on the Users page, mint a fresh one with the same config, and push the new command. Enrolled devices carry on.