Overview
This document describes how to set up Rippling to distribute two items to Windows devices. The items are the F5 Workforce AI Security proxy auto-configuration (PAC) file URL and the root certificate authority (CA) certificate. For macOS devices, see Deploy to macOS with Rippling.
Supported platforms
Windows 10 1809 and later (including Windows 11)
About this document
This document explains how to create the policy that distributes the proxy configuration and the root CA certificate. It doesn't cover other parts of the Rippling platform. It also doesn't cover how to enroll devices in Rippling.
Proxy auto-configuration file
Workforce AI Security distributes its proxy information in a PAC file. The PAC file has all the information needed to send only generative AI traffic to the Workforce AI Security proxy service. The device sends other traffic by its typical route.
Workforce AI Security uses the PAC file to update the list of generative AI domains. Most operating systems and browsers request the PAC file every 1 through 2 hours. If a device can't get a new file, the device keeps using the current file.
Root certificate
Workforce AI Security needs certificate trust to intercept connections and apply policy. Other network security and secure access service edge (SASE) vendors work the same way. This policy applies to connections to generative AI websites. All devices that Workforce AI Security governs must trust the Workforce AI Security root CA certificate.
Configure Rippling for Windows devices
All configuration in this section takes place in the Rippling admin dashboard at https://app.rippling.com/dashboard. Unless otherwise stated, all instructions start from this URL.
You must use an Admin account, not an Employee account, to complete this configuration. To check the active account type, select the user avatar in the dashboard.
Important note
Rippling doesn't support native Windows configurations or Group Policy Objects (GPOs) for distributing the PAC file URL or the root certificate. Instead, you use a single PowerShell script to configure Windows endpoints. The script sets both the Workforce AI Security PAC file URL and the Workforce AI Security root CA certificate. Because you deploy the configuration as a script, Workforce AI Security also provides a removal script. The removal script removes all configurations that the installation script made.
Prerequisites
Download the setup scripts
Log in to https://admin.surepath.ai.
In CONFIGURE, go to Connectors.
Select ADD CONNECTOR.
Enter a descriptive name for the connector, such as
PAC File - Active Directory.Select Proxy as the connector type.
Select SAVE to generate the unique PAC file URL and the scripts and profiles package.
On the connector details page, under MDM Files, select DOWNLOAD.
Create the Rippling script configuration to deploy the Workforce AI Security configuration
Go to IT > Devices.
Select the Scripts tab.
Select Add Script.
In the Add Script modal, enter these configuration values:
Enter a Script Name, such as
Workforce AI Security Configuration.For Target Platform, select Windows Machines Only.
In the Select menu, select Device.
Add the devices that receive this configuration.
For Frequency of execution, select One-time.
Select Run on newly enrolled devices meeting the group definition. F5 recommends this setting. The setting deploys the configuration to new Windows devices that join the Rippling inventory after you deploy the script.
Select Run the script now. F5 recommends this setting. The setting deploys the configuration to all Windows devices in the Rippling inventory.
Select Submit.
Verify the integration
After you complete the deployment, verify that the endpoint is integrated correctly. Use the Workforce AI Security Ready tool.