Skip to main content

Deploy to Windows with Microsoft Intune

Describes deploying proxy PAC URL and root CA to Windows through Intune using PowerShell or OMA-URI. Covers single/shared device modes, email identification, and verification.

This article explains how to set up Microsoft Intune to distribute two items to Windows devices. The items are the F5 Workforce AI Security proxy auto-config (PAC) URL and the root certificate authority (CA) certificate. Microsoft Intune has more than one deployment method. This article covers the recommended PowerShell script method and the manual Open Mobile Alliance Uniform Resource Identifier (OMA-URI) method.

Supported platforms

  • Windows 10 version 1709 and later

About this document

This article covers two ways to deploy Workforce AI Security proxy settings through Microsoft Intune. The recommended way is a PowerShell script. The script is simple to deploy and works on single-user and shared devices. It also supports email-based user identification and gives you more flexibility to manage configurations. The alternative is manual OMA-URI configuration profiles. If you prefer policy-based deployment or must fit into existing Intune policies, use the manual OMA-URI configuration profiles.

Both methods deploy two items. The Workforce AI Security PAC URL sets the proxy settings. Workforce AI Security uses the root CA certificate to intercept traffic. This article doesn't explain how to enroll devices in Microsoft Intune. It also doesn't explain how to manage other parts of Microsoft Intune.

Background

Proxy auto-config file

Workforce AI Security distributes its proxy information in a PAC file. The PAC file sends generative AI traffic to the Workforce AI Security proxy service. All other traffic takes its typical route.

With the PAC file, Workforce AI Security can update the list of generative AI domains. Most operating systems and browsers request the PAC file every hour or two. If a device can't retrieve a new file, it keeps using the current one.

Root certificate

Workforce AI Security uses certificate trust to intercept connections to generative AI websites. It then applies policy to those connections. Other vendors of network security and secure access service edge (SASE) work the same way. Every device that Workforce AI Security governs must trust the Workforce AI Security root CA certificate.

Configure Microsoft Intune

You do all configuration in this section in the Microsoft Intune admin center. Unless a step says otherwise, start each set of instructions there.

Get the deployment files

Before you deploy Workforce AI Security through Microsoft Intune, get the root certificate, the PAC URL, and the deployment script. Do the tasks in this section.

Download the root certificate

  1. In CONFIGURE, go to Organization > Integration.

  2. In the File Downloads section, find the SurePath AI Root CA Certificate.

  3. Download the certificate with the CER option.

Create a Proxy connector and get the proxy auto-config URL

  1. In CONFIGURE, go to Connectors.

  2. Select ADD CONNECTOR.

  3. Enter a descriptive name for the connector, such as Windows Intune Deployment.

  4. Select Proxy as the connector type.

  5. Select SAVE to generate the unique PAC file URL.

  6. Copy the PAC file URL from the connector details page. You need it in the deployment steps below.

Download the PowerShell deployment script

The PowerShell deployment script is a flexible, automated way to configure proxy settings on Windows devices. To download the script:

  1. On the Proxy connector details page, find the MDM Files section.

  2. Select DOWNLOAD to download the mobile device management (MDM) deployment files.

  3. Extract the ZIP file to get SurePath.AI.deploy.ps1 for Windows deployment.

Deploy with a PowerShell script (recommended)

Use the PowerShell deployment script to deploy Workforce AI Security proxy settings to Windows devices through Microsoft Intune. It is the most flexible method. It is the recommended method for most deployments.

Script features

The PowerShell script has these features:

  • Simplified deployment: One script handles all proxy settings, the certificate, and security policies. You don't create many separate configuration profiles.

  • User identification: The script can detect user email addresses and add them to the PAC URL. Workforce AI Security can then link native application traffic to a specific user, not only to the connector. This improves visibility in User Activity logs. You can also apply user-specific policy.

  • Flexible configuration: Script parameters cover single-user devices and shared computers. They also control optional features such as email detection.

  • Easier maintenance: To update proxy settings, you change the script parameters. You don't recreate many configuration profiles.

  • Automatic detection and fallback: The script detects the deployment context automatically. It can also remove its own configuration. It has fallback mechanisms.

How script assignments work in Intune

When you deploy PowerShell scripts through Intune, the assignment target and the execution context work together. They set how the script behaves.

For single-user devices, assign scripts to device groups. Run them in system context (Run this script using the logged on credentials = No). Each device has only one primary user. The script can install the certificate, set the PAC URL, and apply all settings in one deployment. The deployment uses administrative privileges, so it gives a complete system-wide configuration in one step.

For shared/multi-user devices, use a two-step approach:

  • Machine setup: Assign to device groups. Run in system context (Run this script using the logged on credentials = No). This step installs certificates and security policies once for each device.

  • User-level PAC configuration: Assign to device groups. Run in user context (Run this script using the logged on credentials = Yes). The script then runs for every new user who logs in to the device. Each user gets a personal PAC URL.

The Run this script using the logged on credentials setting is critical. It controls the execution context:

  • No (system context): The script runs with system privileges. It can change machine-wide settings in the HKEY_LOCAL_MACHINE (HKLM) registry hive. It can install certificates to the Local Machine store. Use this for single-user device deployments and for machine setup on shared devices.

  • Yes (user context): The script runs as the logged-in user. It can change user-specific settings in the HKEY_CURRENT_USER (HKCU) registry hive. If you assign it to device groups with this setting, the Intune Management Extension runs the script. It runs for every new user who logs in to that device. Use this for user-level PAC configuration on shared devices.

64-bit PowerShell requirement

The Workforce AI Security deployment script must run in 64-bit PowerShell on 64-bit Windows systems. When you set up the script in Intune, always set Run script in 64-bit PowerShell to Yes for standard Windows 10/11 deployments. Select No only for 32-bit Windows systems. These systems are rare in enterprise environments.

Single-user device deployment

Use this method for devices where only one user regularly logs in. The PowerShell script deploys a complete system-wide configuration in one deployment. This method suits personal work devices, dedicated workstations, and devices assigned to one user. Each device has only one user, so the script can run with system privileges. In one pass, it installs the certificate, sets the PAC URL, and applies security policies.

Configure the script for single-user deployment

Before you deploy the script through Intune, set the argumentOverride variable. It holds the deployment parameters. The Intune Scripts feature can't pass command-line parameters. For that reason, the script uses an embedded configuration variable to control its behavior.

By default, the script adds a globally unique identifier (GUID) to the PAC URL. The GUID identifies the user. This method works in all environments.

It doesn't need email address detection. Some identity setups have no email information. The GUID gives consistent user tracking in User Activity logs. You can also apply user-specific policy.

To use the default GUID-based identification, leave the argumentOverride variable empty. You can also leave the script unmodified:

$argumentOverride = ""

The script does these tasks automatically:

  • Installs the Workforce AI Security root CA certificate to the Local Machine trusted certificate store

  • Deploys proxy settings system-wide, so they apply to all users on the device

  • Generates a unique GUID and adds it to the PAC URL for user tracking

Use email-based identification (optional)

You can also set the script to detect the user's email address and use it for identification. With email-based identification, users don't need to authenticate to use generative AI services through Workforce AI Security. Workforce AI Security identifies each user from the email address in the PAC URL. This method needs email information from an identity source. Sources include Active Directory, Entra ID, Intune, and user environment variables.

To turn on email-based identification:

  1. Open the SurePath.AI.deploy.ps1 file in a text editor.

  2. Find the $argumentOverride = "" line near the top of the script.

  3. Set the override to turn on email detection:

$argumentOverride = "-Email"

  1. Save the modified script file.

With this setting, the script tries to detect the user's email address from these sources, in this order:

  1. Active Directory - Queries on-premises Active Directory for the user's email attribute.

  2. Entra ID - Uses the whoami command to query Azure AD (Entra ID) user information.

  3. Entra ID registry - Checks the device registry for Azure AD join information.

  4. Intune - Queries Intune MDM enrollment data for user email.

  5. User environment - Checks user session environment variables for email information.

If email detection fails, the script falls back to a GUID. To require email-based identification with no fallback, add the -NoGUID flag (for example, $argumentOverride = "-Email -NoGUID"). With this flag, if the script can't detect an email address, deployment fails.

Deploy the script through Intune

After you set the argumentOverride variable, deploy the script to target devices with the Intune Scripts feature:

  1. Go to Devices > Scripts and remediations > Platform scripts.

  2. Select Add.

  3. Select Windows 10 and later.

  4. On the Basics step, do these steps:

    1. Enter a descriptive Name such as Workforce AI Security Proxy - Single User Devices.

    2. Add an optional Description.

    3. Select Next.

  5. On the Script settings step, do these steps:

    1. Select the folder icon.

    2. Select the modified SurePath.AI.deploy.ps1 file.

    3. For Run this script using the logged on credentials, select No. This setting makes the script run with system privileges, so it can install the certificate and set system-wide settings.

    4. For Enforce script signature check, select No.

    5. For Run script in 64-bit PowerShell, select Yes.

    6. Select Next.

  6. On the Assignments step, do these steps:

    1. Select Add groups.

    2. Select the device groups that contain single-user devices. Assignment to device groups applies the configuration to the device itself. This suits single-user scenarios, where the device has a dedicated user.

    3. Select Next.

  7. On the Review + add step, check the configuration.

  8. Select Add.

The script deploys to assigned devices at the next Intune sync cycle. Each device gets the complete configuration. The complete configuration includes the certificate, the PAC URL, and the security policies.

Shared/multi-user device deployment

Use this method for devices where many users log in, such as shared workstations, kiosks, or terminal servers. It has two steps. The first step installs the root CA certificate and sets security policies at the machine level. The second step deploys user-specific proxy settings when each user logs in.

Overview of the two-step approach

Machine setup (once for each device)

Machine setup configures the components that apply to all users on the device:

  • Installs the Workforce AI Security root CA certificate to the Local Machine trusted certificate store

  • Sets policies that prevent users from changing proxy settings

You can do this step with OMA-URI configuration profiles. You can also use a PowerShell script with the -NoProxy flag. Both ways give the same result. Choose the one that fits your existing Intune policies and preferences.

User-level proxy configuration (runs at each user's first login)

After machine setup, each user who logs in needs their own proxy configuration. This step writes the PAC URL to each user's HKCU registry hive. The PAC URL has a user-specific identifier (a GUID by default, or optionally an email address). With this identifier, Workforce AI Security can track activity by individual user, not only by device.

Machine setup options

Option A: Use manual configuration profiles for the certificate and lockdown

You can deploy the root CA certificate and the proxy lockdown policies with standard Intune configuration profiles. This option fits well with existing certificate and policy management workflows.

For the certificate, follow the steps in Distribute the root certificate.

For the proxy lockdown policies, follow the steps in Prevent users from changing the configuration (optional).

Option B: Use the PowerShell script with the -NoProxy flag

You can also use the PowerShell deployment script. It installs the certificate and sets security policies without setting the PAC URL. If you prefer one script for all components, this option suits you.

To configure the script for machine setup:

  1. Open the SurePath.AI.deploy.ps1 file in a text editor.

  2. Find the $argumentOverride = "" line.

  3. Set the override to configure machine setup without a proxy:

$argumentOverride = "-NoProxy"

  1. Save the modified script file.

Deploy this version of the script with the Intune Scripts feature and this configuration:

  1. Go to Devices > Scripts and remediations > Platform scripts.

  2. Select Add.

  3. Select Windows 10 and later.

  4. On the Basics step, enter a descriptive Name such as Workforce AI Security - Machine Setup (Shared Devices).

  5. Select Next.

  6. On the Script settings step, do these steps:

    1. Select the folder icon.

    2. Select the modified SurePath.AI.deploy.ps1 file.

    3. For Run this script using the logged on credentials, select No. This setting makes the script run with system privileges, so it can install the certificate to the Local Machine store.

    4. For Enforce script signature check, select No.

    5. For Run script in 64-bit PowerShell, select Yes.

    6. Select Next.

  7. On the Assignments step, do these steps:

    1. Select Add groups.

    2. Select the device groups that contain shared/multi-user computers.

    3. Select Next.

  8. On the Review + add step, check the configuration.

  9. Select Add.

The script installs the certificate and sets lockdown policies without setting the PAC URL.

Set up user-level proxy auto-config

After machine setup, deploy a second instance of the PowerShell script. Configure it for user-level proxy settings. This script must run when each user logs in. Then every user gets the proxy configuration with their own unique identifier.

By default, the script adds a GUID to the PAC URL for each user. This method works in all environments and gives consistent per-user tracking in Workforce AI Security. It doesn't need email address detection. Each user who logs in to the shared device gets a unique identifier in the PAC URL.

To configure the script with default GUID-based identification:

  1. Open a new copy of SurePath.AI.deploy.ps1 in a text editor. If you didn't use Option B, you can use the same file.

  2. Find the $argumentOverride = "" line.

  3. Set the override to configure the user-level proxy:

$argumentOverride = "-User"

  1. Save the modified script file with a different name, for example SurePath.AI.deploy.user.ps1. The different name distinguishes this script from the machine setup script.

Use email-based identification (optional)

You can also turn on email-based identification. With email-based identification, users don't need to authenticate to use generative AI services. The script detects each user's email address from identity sources and adds it to the PAC URL. The sources are Active Directory, Entra ID, and Intune. If email detection fails for a user, the script falls back to a GUID.

To turn on email-based identification, use this setting:

$argumentOverride = "-User -Email"

With the -Email flag, the script tries to detect the user's email address from several sources. These include Active Directory, Entra ID, the Entra ID registry, Intune, and user environment variables. The first email address that the script detects goes into the PAC URL.

Deploy this version through Intune:

  1. Go to Devices > Scripts and remediations > Platform scripts.

  2. Select Add.

  3. Select Windows 10 and later.

  4. On the Basics step, enter a descriptive Name such as Workforce AI Security Proxy - User Level (Shared Devices).

  5. Select Next.

  6. On the Script settings step, do these steps:

    1. Select the folder icon.

    2. Select the modified script file (for example, SurePath.AI.deploy.user.ps1).

    3. For Run this script using the logged on credentials, select Yes. With this setting, the script can change each user's registry settings in HKCU.

    4. For Enforce script signature check, select No.

    5. For Run script in 64-bit PowerShell, select Yes.

    6. Select Next.

  7. On the Assignments step, do these steps:

    1. Select Add groups.

    2. Select the same device groups that you used for the machine setup script. Assignment to device groups makes the script run for every new user who logs in to these shared devices. Each user gets a per-user proxy configuration with a unique identifier.

    3. Select Next.

  8. On the Review + add step, check the configuration.

  9. Select Add.

This configuration writes the PAC URL to each user's HKCU registry hive. The URL has the user's unique identifier. By default, the identifier is a GUID. If you set the -Email flag, the identifier is an email address.

Machine setup already installed the certificate. The script finishes quickly for each user. Every user who logs in to the shared device gets their own proxy configuration the first time they log in. The Intune Management Extension makes this happen.

Use Remediation scripts for recurring enforcement (v3.4.0 and later)

You can deploy the Workforce AI Security deployment script as an Intune Remediation script package instead of a Platform script. Remediation script packages work from version v3.4.0. With a Remediation, the script runs on a recurring schedule. It checks and enforces the proxy configuration on enrolled devices.

When to use Remediation scripts

Use the Remediation method in these scenarios:

  • Persistent configuration: You want the Workforce AI Security proxy PAC configuration to stay on devices at all times. The Remediation continuously monitors the configuration. It restores the configuration if a user or another process removes or changes it.

  • Migration from a previous deployment method: Devices are moving from an earlier Workforce AI Security integration method (such as manual OMA-URI configuration profiles) to the PowerShell script. A Remediation script package brings all devices into compliance on a schedule. You don't need manual work on each device.

Platform scripts run only once for each device. They can't detect or correct configuration drift over time. Remediations solve this because they run on a recurring schedule that you set.

How it works in v3.4.0 and later

From version v3.4.0, the Workforce AI Security deployment script has exit code behavior for Intune Remediations:

  • Exit code 0 (success): The script completed successfully. Either the configuration already matched the intended deployment, or the script applied the configuration.

  • Exit code 1 (failure): A Workforce AI Security configuration is on the device. It doesn't match what the script is set to deploy. The existing configuration must be overwritten.

Exit code 1 means a mismatched configuration is already on the device. For that reason, the remediation script must use the -Force parameter to overwrite it. Without -Force, the script doesn't overwrite an existing deployment. The detection script and the remediation script are therefore two separate script files. The detection script runs with the typical deployment arguments to check the current state. The remediation script runs with the same arguments plus -Force to correct the mismatch.

On each scheduled run, Intune runs the detection script. If it exits with code 1, Intune automatically runs the remediation script (with -Force). The remediation script overwrites the existing configuration and brings the device into compliance.

Prerequisites for Remediations

Intune Remediations have licensing requirements beyond standard Intune enrollment. Devices must have one of these licenses:

  • Windows Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)

  • Windows Education A3 or A5 (included in Microsoft 365 A3 or A5)

  • Windows Virtual Desktop Access (VDA) per user

Devices must also be Microsoft Entra joined or Microsoft Entra hybrid joined. They must be MDM-enrolled in Intune and run Windows Enterprise, Professional, or Education edition. Or they must be co-managed devices that run Windows.

Configure the scripts for Remediation deployment

The detection and remediation scripts have different roles. Prepare two separate copies of SurePath.AI.deploy.ps1 with different argumentOverride values. Do this before you upload them to Intune.

Detection script: Configure it with the target deployment arguments only (no -Force):

  • For single-user devices, leave the default ($argumentOverride = ""). You can also use -Email for email-based identification.

  • For shared/multi-user devices, use -NoProxy for the machine-level script or -User for the user-level PAC script.

Remediation script: Configure it with the same arguments as the detection script, plus -Force at the end:

  • For single-user devices: $argumentOverride = "-Force" (or "-Email -Force" if you use email identification).

  • For shared/multi-user devices: $argumentOverride = "-NoProxy -Force" or $argumentOverride = "-User -Force" as appropriate.

Save these as two separate files: SurePath.AI.detect.ps1 (detection script) and SurePath.AI.deploy.ps1 (remediation script). This keeps them distinct when you upload them to Intune.

For details on the argument settings, see Single-user device deployment and Shared/multi-user device deployment above.

Create and deploy the Remediation script package

  1. Go to Devices > Scripts and remediations > Remediations.

  2. Select Create script package.

  3. On the Basics step, do these steps:

    1. Enter a descriptive Name such as Workforce AI Security Proxy - Remediation Enforcement.

    2. Add an optional Description.

    3. Select Next.

  4. On the Settings step, do these steps:

    1. For Detection script file, select the folder icon. Then select the detection script (SurePath.AI.detect.ps1) that you configured without -Force.

    2. For Remediation script file, select the folder icon. Then select the remediation script (SurePath.AI.deploy.ps1) that you configured with -Force added to the argumentOverride.

    3. For Run this script using the logged-on credentials, choose based on the deployment scenario. Select No for system context (single-user devices, or machine-level setup for shared devices). Select Yes for user context (user-level PAC configuration for shared devices).

    4. For Enforce script signature check, select No.

    5. For Run script in 64-bit PowerShell, select Yes.

    6. Select Next.

  5. On the Scope tags step, assign any scope tags you need.

  6. Select Next.

  7. On the Assignments step, do these steps:

    1. Select Add groups.

    2. Select the right device groups.

    3. Under Schedule, set how often the detection script runs. See the schedule guidance below.

    4. Select Next.

  8. On the Review + Create step, check the configuration.

  9. Select Create.

Choose a run schedule

The schedule sets how often Intune runs the detection script on assigned devices. Choose a frequency based on how fast you want to detect and correct configuration drift:

  • Hourly: Set an interval between 1 and 23 hours. Use this to detect and restore a removed or changed configuration quickly.

  • Daily: Set a time of day for the script to run. Use this for less urgent enforcement, where a daily check is enough.

  • Once: Run the detection and remediation one time only. A once-only schedule behaves like a Platform script deployment and doesn't enforce the configuration continuously. Use Hourly or Daily for ongoing enforcement.

If a device is offline or asleep, it misses a scheduled run. Intune then runs the detection script as soon as the device is back online and active. Schedules use the local time of the device by default. If you need consistent scheduling across time zones, select Use UTC in the schedule settings.

Deploy with manual configuration profiles (alternative)

The manual OMA-URI method deploys Workforce AI Security proxy settings through standard Intune configuration profiles. If you use policy-based management exclusively, use this method. Use it also if you must combine Workforce AI Security settings with existing configuration profiles or if you prefer not to deploy custom scripts.

The manual method needs three separate configuration profiles. One sets the PAC URL and proxy settings. One prevents users from changing proxy settings. One distributes the root CA certificate. This method gives fine control over each component. It takes more administrative effort to create and maintain than the PowerShell script method.

Distribute the proxy auto-config URL

This configuration profile sets the three registry keys that set up the proxy PAC URL on Windows devices. To create the profile:

  1. Go to Devices > Configuration.

  2. Select Create > New Policy.

  3. For Platform, select Windows 10 and later.

  4. For Profile type, select Templates.

  5. From the Template name menu, select Custom.

  6. Select Create.

  7. On the Basics step, enter a Name. You can also enter a Description.

  8. Select Next.

  9. On the Configuration settings step, select Add. Then do these steps:

    1. For Name, enter AutoDetect.

    2. For OMA-URI, enter ./Vendor/MSFT/NetworkProxy/AutoDetect.

    3. For Data Type, select Integer.

    4. For Value, enter 0.

    5. Select Save.

  10. Select Add again. Then do these steps:

    1. For Name, enter SetupScriptUrl.

    2. For OMA-URI, enter ./Vendor/MSFT/NetworkProxy/SetupScriptUrl.

    3. For Data Type, select String.

    4. For Value, enter the Proxy PAC URL that you copied earlier.

    5. Select Save.

  11. Select Add again. Then do these steps:

    1. For Name, enter ProxySettingsPerUser.

    2. For OMA-URI, enter ./Vendor/MSFT/NetworkProxy/ProxySettingsPerUser.

    3. For Data Type, select Integer.

    4. For Value, enter 0.

    5. Select Save.

  12. Select Next.

  13. On the Assignments step, add the device groups that receive the proxy policy. This is a device-based policy, so assign it to groups of devices.

  14. Select Next.

  15. On the Applicability Rules step, you can create a rule that targets the Windows devices you want. For example, for Rule, select Assign profile if. For Property, select OS Edition. For Value, select all editions of Windows in the organization.

  16. Select Next.

  17. On the Review + create step, confirm the configuration is correct.

  18. Select Create.

Prevent users from changing the configuration (optional)

You can deploy an extra policy that prevents users from changing the proxy settings. This policy stops users from bypassing Workforce AI Security governance. We recommend this policy.

  1. Go to Devices > Configuration.

  2. Select Create > New Policy.

  3. For Platform, select Windows 10 and later.

  4. For Profile type, select Settings catalog.

  5. Select Create.

  6. On the Basics step, enter a Name. You can also enter a Description.

  7. Select Next.

  8. On the Configuration settings step, select Add settings. Then do these steps:

    1. In the Settings picker panel, go to Browse by category and browse to Administrative Templates > Windows Components > Internet Explorer.

    2. In the Setting name section, select the Prevent changing proxy settings (User) setting.

    3. Close the Settings picker panel.

    4. Turn on the setting.

    5. Select Next.

  9. On the Scope tags step, select any scope tags that apply.

  10. Select Next.

  11. On the Assignments step, add the users or device groups that receive the policy.

  12. Select Next.

  13. On the Review + create step, confirm the configuration is correct.

  14. Select Create.

Distribute the root certificate

This configuration profile deploys the Workforce AI Security root CA certificate to the Local Machine trusted certificate store on Windows devices. To create the profile:

  1. Go to Devices > Configuration.

  2. Select Create > New Policy.

  3. For Platform, select Windows 10 and later.

  4. For Profile type, select Templates.

  5. From the Template name menu, select Trusted certificate.

  6. Select Create.

  7. On the Basics step, enter a Name. You can also enter a Description.

  8. Select Next.

  9. On the Configuration settings step, select the Select a valid .cer file box.

  10. Browse to the SurePath AI Root CA Certificate that you downloaded earlier, and select it.

  11. Select Next.

  12. On the Assignments step, add the device groups that receive the certificate policy. This is a device-based policy, so assign it to groups of devices, not to users.

  13. Select Next.

  14. On the Applicability Rules step, you can create a rule that targets the Windows devices you want. For example, for Rule, select Assign profile if. For Property, select OS Edition. For Value, select all editions of Windows in the organization.

  15. Select Next.

  16. On the Review + create step, confirm the configuration is correct.

  17. Select Create.

Certificate requirements for user-level deployments

The PowerShell deployment script can run in user context (Run this script using the logged on credentials = Yes). In that context, it sets the PAC URL in the current user's HKCU registry hive. It can't install certificates to the Local Machine trusted certificate store, because that action needs administrative privileges. Any deployment that uses the -User flag must therefore distribute the Workforce AI Security root CA certificate to devices in another way.

Distribute the certificate with one of these methods, before or along with the -User script deployment:

  • PowerShell script in system context: Deploy a separate instance of the script with the -NoProxy flag. Run it in system context (Run this script using the logged on credentials = No). The script installs the certificate and sets lockdown policies without setting the PAC URL. See Machine setup options in the shared device deployment section above.

  • OMA-URI configuration profiles: Deploy the certificate with the Trusted certificate profile in Distribute the root certificate. Also deploy Prevent users from changing the configuration (optional) to prevent proxy bypass. We recommend this policy.

Verify the integration

After you complete the deployment, use the Workforce AI Security Ready tool to verify that the endpoint is integrated.

Related Articles
Did this answer your question?