Bulk enrollment with your MDM

Push the Anyray desktop app and one enrollment policy through your MDM. Each machine enrolls to its assigned email with no sign-in prompt.

Devices	Lane
Managed Macs (Jamf Pro, Kandji, Intune, or any MDM that installs a package and a profile)	Package and profile
Windows and Linux	Installer plus policy file
Headless or shared machines, SSO not connected yet	Provisioning token
Subscription seats	Mac or Windows and Linux lane

Unmanaged machines: one-command path. Depth: MDM reference. Every lane starts at console Users > MDM Users > Add MDM profile.

Enroll managed Macs with the package and profile

macOS 13+, Apple silicon and Intel. One profile and package for every Mac; one key per Mac.

1

Create the profile

macOS tab > Create & download anyray-enroll.mobileconfig (shown once).

2

Set the assigned email

Jamf Pro, Kandji, and Intune fill $EMAIL in EnrollmentEmail. Other MDMs: replace $EMAIL with their per-device email variable, never one fixed address.

3

Deploy the profile and the package

Deploy both with anyray-connect-desktop-macos-universal.pkg to the same Macs in device scope, any order.

The Mac is enrolled

Users shows source MDM provisioning; anyray-connect doctor reports a valid enrollment.

More: Managed Macs. Claude Desktop is a separate step: Claude Desktop on managed devices.

Enroll Windows and Linux without a browser

1

Download the files

Pick Windows or Linux; download the installer and the policy file.

2

Deploy the policy file

OS	Policy
Windows	Import anyray-enroll.reg as SYSTEM. Connect reads HKLM\SOFTWARE\Policies\Anyray\Connect.
Linux	/etc/anyray/anyray-enroll.json, root-owned, mode 0600.

The policy file is a secret

EnrollmentUrl carries the reusable enp_… credential. Admins only; rotate the link if it leaks.

3

Install the desktop app

Windows: deploy anyray-connect-desktop-windows-x64.msi under Apps, as SYSTEM (details).

Linux: deploy anyray-connect-desktop-linux-x64.deb or .rpm. It replaces the anyray-connect CLI package (details).

More: Windows and Linux.

Enroll headless machines with a provisioning token

For machines that cannot run the desktop app. The enp_… token lives in your MDM; each machine redeems it once for its own ark_… key.

1

Mint the token

Headless (CLI) tab > Enroll as Signed-in user > Create token. Save it to your MDM vault (shown once). It accepts every Email domains card domain, exact match.

2

Deploy the enrollment command

Use the URL shown at mint, run as the signed-in user (never root or SYSTEM). Intune: Run this script using the logged on credentials = Yes. An empty email fails with email is required for this provisioning token.

Jamf

Jamf

console_user=$(/usr/bin/stat -f %Su /dev/console)
[ -n "$console_user" ] && [ "$console_user" != "root" ] || exit 0
/usr/bin/sudo -u "$console_user" -H /usr/bin/env EMAIL="$EMAIL" /bin/sh -c '
  cd "$HOME" || exit 1
  curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enp_synthetic_example --user "$EMAIL" --yes
'

Intune

Intune

& ([scriptblock]::Create((irm https://app.anyray.ai/connect.ps1))) "--enroll" "https://app.anyray.ai/enroll/enp_synthetic_example" "--user" "%LoggedOnUser%" "--yes"

The devices are enrolled

Users shows source MDM provisioning, one self-renewing key per machine.

Token lifetime and scope

Enrolls new machines for 365 days; issued keys are unaffected. Tools only, no Claude Desktop. Optional Default team (a SCIM team wins). Machine mode: provisioning tokens.

After you connect SSO

Manual tokens stop working. Use the Mac package lane.

Subscription seats

Same lanes, nothing extra; Claude Code and Codex keep the seat sign-in. Headless and CI: a service key.

Offboard

Revoking a token stops new enrollments only

Enrolled machines keep renewing their key.

Revoke the user, then the live key, or offboard a machine-mode device. Exposed token: revoke it on Users, mint a replacement, push the new command.