Bulk enrollment with your MDM
Push Connect and one enrollment policy through your device platform. Each machine enrolls to the email the MDM assigns, with no browser or SSO prompt.
| Fleet | Lane |
|---|---|
| Managed Macs | The package and profile. Works with Jamf Pro, Kandji, Intune, or any MDM that installs a package and a profile. |
| Windows and Linux | A managed installer plus a policy file. |
| API-key fleet, SSO not connected yet | A provisioning token. |
| Subscription (seat) fleet | The same Mac or Windows and Linux lane. |
Contractors, BYOD machines, and devices outside your MDM take the one-command path. Depth on everything here is in the MDM reference.
Enroll managed Macs with the package and profile
macOS 13+, Apple silicon and Intel. One profile and one package serve every Mac in scope. Each Mac still gets its own key and DevCert.
Open Console → Users → Add user, expand Enrolling a managed fleet via MDM? at the bottom
of the modal, and on the macOS tab select Create & download next to
anyray-enroll.mobileconfig. Save the file. It is shown once.
Jamf Pro, Kandji, and Intune fill the $EMAIL placeholder in EnrollmentEmail from the
computer's assigned user record. With another MDM, swap in its per-device email variable.
Replace only $EMAIL. Leave EnrollmentUrl alone, and never hardcode one address fleet-wide.
Download anyray-connect.pkg from the same console step. Deploy both to the same Macs in device
scope. Either order works.
No browser or password prompt appears. The user shows under Users with source MDM
provisioning, anyray-connect doctor reports a valid enrollment, and the desktop app's dot
turns green.
It proves a Mac received the profile and binds the email the MDM wrote. It does not prove who is at the keyboard. Keep it in your MDM's protected file store, pair it with allowed email domains plus SCIM or IdP offboarding, and rotate the token if it leaks. Use one assigned desktop account per Mac, and keep shared lab and kiosk Macs off this lane.
Deeper (admin-API mint, retries, rotation): Managed Macs.
Enroll Windows and Linux without a browser
Open Console → Users → Add user, expand Enrolling a managed fleet via MDM?, choose Windows or Linux, and download the managed installer or package plus the generated policy file.
Windows: import anyray-enroll.reg as SYSTEM. Connect reads
HKLM\SOFTWARE\Policies\Anyray\Connect. Linux: place the JSON policy at
/etc/anyray/anyray-enroll.json, root-owned, mode 0600.
The file is a secret, because EnrollmentUrl carries the reusable enp_… credential. Restrict
it to administrators and rotate the link after suspected disclosure.
Windows: run the managed installer once in each assigned user's context. Linux: deploy the
signed .deb or .rpm from the
anyray-connect releases. Never run the
installer as SYSTEM or root. It exits rather than write a privileged account's profile.
& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--managed"
Deeper (runner behavior, policy-file checks): Windows and Linux.
Enroll an API-key fleet with a provisioning token
A provisioning token (enp_…) is a reusable enrollment credential that lives in your MDM. Each
machine runs the command once, gets a personal ark_… key, and never needs the token again.
Open Console → Users → Add user → Enrolling a managed fleet via MDM?. Copy the raw token
into your MDM secrets vault. It is shown once. Leave Mode on email and set Allowed email
domains. Matching is exact, so a subdomain does not satisfy its parent. A Default team is
optional. Request headers cannot override it, and a SCIM-mapped team supersedes it.
Use the origin-qualified URL shown once at mint. --yes keeps Connect non-interactive. Your MDM
substitutes the device owner's email, and an empty variable is rejected with
email is required for this provisioning token.
- Jamf / generic (swap in your MDM's user variable)
- Intune (PowerShell)
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enp_synthetic_example --user $EMAIL --yes
& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--enroll" "https://app.anyray.ai/enroll/enp_synthetic_example" "--user" "%LoggedOnUser%" "--yes"
Enrolled users appear in Users with source MDM provisioning, one personal key per machine. Keys renew on their own while a machine stays in use.
Token lifetime and what the command configures
Tokens accept new enrollments for 365 days. Expiry never affects issued keys, and fleet
artifacts carry no static key. The command configures tools only, and holds back Claude Desktop.
Machine mode, --endpoint, and the Desktop trade-off are in
provisioning tokens.
After you connect SSO
Manual tokens no longer mint, rotate, or redeem. Use the Mac package or legacy lanes, which enroll with SSO on or off.
Subscription (seat) fleets
A seat fleet enrolls through the Mac or Windows and Linux lane above. Nothing extra is needed. Each machine gets its own key at logon, Connect sets up every tool it finds, and Claude Code and Codex keep the developer's own seat sign-in for inference. Headless and CI machines get a service key instead.
Tools installed later
A developer who installs a new tool weeks after their machine was enrolled does not need to run anything. Connect rechecks on its ordinary refresh tick and configures what it finds, so the tool starts routing on its own. Two things it will not do on its own: a tool the developer deliberately reverted stays reverted, and Claude Desktop is never enrolled this way because it needs their explicit consent.
Machines outside your MDM get the same behavior from the deployment's tool policy, which enrolls every supported tool until an admin narrows it on Console -> Tool policy.
Offboard
Enrolled machines hold a DevCert that keeps renewing keys while the machine is in use, so waiting out expiry offboards nobody.
Revoke the user, then the live key. A machine-mode device offboards differently.
To rotate an exposed token: revoke it on the Users page, mint a fresh one with the same config, and push the updated command. New enrollments stop at once, and enrolled devices are unaffected.