Use Microsoft Intune to run the preset PowerShell scripts. The scripts set up F5 Workforce AI Security proxy settings on Windows devices.

Supported platforms

64-bit Windows 10 version 1709 and later
64-bit Windows 11

Use the Pro, Enterprise, or Education edition. Intune can't run PowerShell scripts on Windows Home or on Windows in S mode.

About this document

This article covers three ways to run the preset PowerShell scripts through Microsoft Intune: platform scripts, Remediations, and Win32 apps. Each script installs the root certificate. It also sets the URL of the proxy auto-config (PAC) file.

This article doesn't explain how to enroll devices in Microsoft Intune. It also doesn't explain how to manage other parts of Microsoft Intune.

Background

Proxy auto-config file

Workforce AI Security distributes its proxy information in a PAC file. The PAC file sends generative AI traffic to the Workforce AI Security proxy service. All other traffic takes its typical route.

With the PAC file, Workforce AI Security can update the list of generative AI domains. Most operating systems and browsers request the PAC file every hour or two. If a device can't retrieve a new file, it keeps using the current one.

Root certificate

Workforce AI Security uses certificate trust to intercept connections to generative AI websites. It then applies policy to those connections. Other vendors of network security and secure access service edge (SASE) work the same way. Every device that Workforce AI Security governs must trust the SurePath AI Root CA Certificate.

Get the deployment files

Before you deploy, create a Proxy connector and download the deployment files.

Create a Proxy connector

In CONFIGURE, go to Connectors.
Select ADD CONNECTOR.
Enter a descriptive name for the connector, such as Windows Intune Deployment.
Select Proxy as the connector type.
Select SAVE.

Download the deployment files

Only the deploy scripts contain the PAC URL for this connector, the root certificate, and its thumbprint. The detect scripts contain only the thumbprint. You don't copy a PAC URL or download a certificate.

On the Proxy connector details page, find the MDM Files section.
Select DOWNLOAD to download the deployment files for mobile device management (MDM).
Extract the ZIP file.

The windows folder of the ZIP file has one folder for each scenario. Each folder has a deploy script and a detect script with a preset already set. The configmgr-detect folder has one more detect script for each scenario, for Win32 apps. For the full folder layout, see Use the Proxy connector deployment files.

The detect script checks the script version of the deployment. Use the deploy script and the detect script from the same ZIP file. When you download a newer ZIP file, upload both scripts again.

Choose the scripts

Choose the folders for your devices. The folders identify users with a globally unique identifier (GUID) or with an email address. You don't edit the scripts, except in the cases that this article names.

Device type	User identification	Folders	Intune context
Single-user	GUID	`default`	System
Single-user	Email address	`email`	System
Shared	GUID	`baseonly`, then `user`	System, then user
Shared	Email address	`baseonly`, then `user-email`	System, then user

A single-user device has one primary user. Examples are personal work devices and dedicated workstations. A shared device has many users, such as a kiosk, a shared workstation, or a terminal server.

With a GUID, each user logs in to Workforce AI Security once in a browser. That login links the GUID to the user. With an email address, users don't log in. For more information about authentication, see Understanding the Proxy Connector (PAC).

The email script runs as system, but it reads the sources of the user who is logged in. If no user is logged in, it reads only the device-level sources. By default, when the script finds no email address, it stops with an error. For the email sources, the source order, and the -FallbackGUID parameter, see the email rollout section in Use the Proxy connector deployment files.

Choose the Intune context

Intune runs a script in the system context or in the user context:

System context: The script runs with system privileges. It can install the certificate and change settings for the whole device. Use the system context for default, email, baseonly, and remove.
User context: The script runs as the logged-in user. It changes settings for that user only. Use the user context for user, user-email, and remove-user.

Don't run a user or user-email script in the system context. In the system context, the script changes the settings of the system account, not the settings of the user.

Set the PowerShell architecture

The scripts must run in 64-bit PowerShell. In 32-bit PowerShell, they stop with an error. For each script in Intune, set the 64-bit PowerShell option to Yes.

Choose an Intune method

Use one method for each folder:

Platform scripts: Intune runs the script one time on each device. Use this method for a simple rollout.
Remediations: Intune runs the detect script on a schedule. If the device isn't compliant, Intune runs the deploy script. This method repairs a deployment that a user or another process changes. Remediations need extra licenses.
Win32 apps: Intune installs the folder as an app and uses the detect script as the detection rule. If you manage software as Win32 apps, use this method.

Deploy with platform scripts

Add one platform script for each folder that you chose.

Go to Devices > Scripts and remediations > Platform scripts.
Select Add.
Select Windows 10 and later.
On the Basics tab, do these steps:
1. Enter a descriptive Name, such as Workforce AI Security Proxy - Single-User Devices.
2. Select Next.
On the Script settings tab, do these steps:
1. Select the folder icon.
2. Select the deploy script of the folder. For example, select default\f5.wais.deploy.ps1.
3. For Run this script using the logged on credentials, select No for the system context. Select Yes for the user context.
4. For Enforce script signature check, select No.
5. For Run script in 64 bit PowerShell Host, select Yes.
6. Select Next.
On the Assignments tab, do these steps:
1. Select Add groups.
2. Select the device groups that contain the target devices.
3. Select Next.
On the Review + add tab, select Add.

Intune runs the script at the next sync of each device. A user-context script that you assign to device groups runs for each new user who logs in to the device.

For shared devices, add two platform scripts. Add baseonly\f5.wais.deploy.baseonly.ps1 in the system context. Then add user\f5.wais.deploy.user.ps1 or user-email\f5.wais.deploy.user-email.ps1 in the user context. Assign both scripts to the same device groups. The user scripts never install the certificate, so the baseonly script must also run on each device.

Deploy with Remediations

A Remediation script package runs the detect script on a schedule. If the detect script exits with code 1, Intune runs the deploy script. The deploy script installs the configuration, repairs a changed setting, or updates an older version.

Check the prerequisites

Each user of the devices needs one of these licenses:

Windows Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
Windows Education A3 or A5 (included in Microsoft 365 A3 or A5)
Windows Virtual Desktop Access (VDA) per user

Devices must also be Microsoft Entra joined or Microsoft Entra hybrid joined. They must be enrolled in Intune and run Windows Enterprise, Professional, or Education edition. Co-managed Windows devices also work.

Prepare the scripts

Use the detect script of a folder as the detection script. Use the deploy script of the same folder as the remediation script. The two scripts have the same preset, so you don't edit them.

If you change a preset, set the same parameters in both scripts, with two exceptions:

-Force: Add it to the deploy script only. The detect script rejects it.
-ConfigMgr: Don't add it to either script for Remediations. The deploy script rejects -ConfigMgr. With -ConfigMgr, when the device isn't compliant, the detect script exits with code 0. Intune then never runs the deploy script. For the same reason, don't use the scripts in the configmgr-detect folder for Remediations.

Some devices might already have a deployment with different parameters, for example from an earlier rollout. On these devices, the deploy script stops with exit code 1 and the message "Use -Force to overwrite". To replace the earlier deployment, add -Force to the preset of the deploy script. For example, in email\f5.wais.deploy.email.ps1, set this line:

$argumentOverride = "-Email -Force"

If the new preset also uses a GUID, -Force keeps the stored GUID, so User Activity history stays linked. If the new preset uses -Email, the identifier changes to the email address. For how to change a preset, see Use the Proxy connector deployment files.

Create the script package

Create one script package for each folder that you chose.

Go to Devices > Scripts and remediations > Remediations.
Select Create script package.
On the Basics tab, do these steps:
1. Enter a descriptive Name, such as Workforce AI Security Proxy - Single-User Devices.
2. Select Next.
On the Settings tab, do these steps:
1. For Detection script file, select the detect script of the folder. For example, select default\f5.wais.detect.ps1.
2. For Remediation script file, select the deploy script of the same folder. For example, select default\f5.wais.deploy.ps1.
3. For Run this script using the logged-on credentials, select No for the system context. Select Yes for the user context.
4. For Enforce script signature check, select No.
5. For Run script in 64-bit PowerShell, select Yes.
6. Select Next.
On the Scope tags tab, add the scope tags that you need.
Select Next.
On the Assignments tab, do these steps:
1. Select Add groups.
2. Select the device groups that contain the target devices.
3. Under Schedule, set how often the detection script runs.
4. Select Next.
On the Review + create tab, select Create.

For shared devices, create two script packages. Use the baseonly folder in the system context. Use the user folder or the user-email folder in the user context.

Choose a run schedule

The schedule sets how often Intune runs the detection script on each device:

Hourly: Set an interval from 1 through 23 hours. Use this schedule to repair a changed configuration quickly.
Daily: Set a time of day. When a daily check is enough, use this schedule.
Once: Run the detection script and the remediation script one time only. This schedule doesn't repair the configuration later.

With the email and user-email scripts, the detect script also starts an email recheck. After seven passing runs, the next run reports the device as not compliant one time. Intune then runs the deploy script, which finds the email address again. To change the number of runs, set -EmailRecheckRuns in the preset of the detect script. To stop the recheck, set -EmailRecheckRuns 0.

If a device is offline or asleep, it misses a scheduled run. When the device is active again, Intune runs the detection script. Schedules use the local time of the device by default. For the same time in all time zones, select Use UTC.

Deploy as a Win32 app

A Win32 app installs the deploy script and uses the detect script as its detection rule. Create one app for each folder that you chose.

Choose the detect script

For a Win32 app, the detect script must use the detection rules of Microsoft Configuration Manager (ConfigMgr). The configmgr-detect folder has these detect scripts, with -ConfigMgr already in the preset. You don't edit them.

Folder	Detect script for the Win32 app
`default`	`configmgr-detect\f5.wais.configmgr.detect.ps1`
`email`	`configmgr-detect\f5.wais.configmgr.detect.email.ps1`
`baseonly`	`configmgr-detect\f5.wais.configmgr.detect.baseonly.ps1`
`user`	`configmgr-detect\f5.wais.configmgr.detect.user.ps1`
`user-email`	`configmgr-detect\f5.wais.configmgr.detect.user-email.ps1`

A script in the configmgr-detect folder exits with code 0 when it finishes. When the device is compliant, the script also writes a line to standard output. Intune then reports the app as installed. When the device isn't compliant, the script writes nothing, and Intune reports the app as not installed.

Package the folder

Use the Microsoft Win32 Content Prep Tool to create a .intunewin file from the folder. Set the deploy script as the setup file.

Add the app

Go to Apps > All apps.
Select Create.
For App type, select Windows app (Win32).
Select Select.
Select the .intunewin file.
On the App information tab, do these steps:
1. Enter a Name.
2. Enter a Publisher.
3. Select Next.
On the Program tab, do these steps:
1. For Install command, enter this command. Replace <DEPLOY_SCRIPT> with the file name of the deploy script, such as f5.wais.deploy.ps1.
```
C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\<DEPLOY_SCRIPT>
```
2. For Uninstall command, enter the same command, and add -Remove at the end. Use the full path, because the uninstall command doesn't expand environment variables.
3. For Install behavior, select System for the system context. Select User for the user context.
4. Select Next.
On the Requirements tab, set the operating system architecture and the minimum operating system.
Select Next.
On the Detection rules tab, do these steps:
1. For Rules format, select Use a custom detection script.
2. For Script file, select the detect script from the configmgr-detect folder for this folder.
3. For Run script as 32-bit process on 64-bit clients, select No.
4. For Enforce script signature check and run script silently, select No.
5. Select Next.
Select Next until you get to the Assignments tab.
Under Required, add the device groups that contain the target devices.
Select Next.
On the Review + create tab, select Create.

If you assign the app as Available, not Required, stop the email recheck. Add -EmailRecheckRuns 0 to the preset of the detect script. An app that is available doesn't install again by itself. After a recheck, Intune shows the app as not installed.

The install command uses the Sysnative path because the Intune Management Extension starts install commands as a 32-bit process. The Sysnative path starts 64-bit PowerShell from a 32-bit process.

For shared devices, create two apps. Create the baseonly app with System install behavior. Create the user or user-email app with User install behavior.

Remove the deployment

Before you remove the deployment, remove the assignments of the deploy scripts, the script packages, or the apps. If you don't, Remediations, Win32 apps, and user-context platform scripts can run the deploy script again.

Platform scripts and Remediations: Deploy the scripts of the remove folder in the system context. On a shared device, first deploy the scripts of the remove-user folder in the user context. Then deploy the remove folder. With Remediations, the remove detect script treats a device with no deployment as compliant.
Win32 apps: Change the assignment of each app to Uninstall. Intune runs the uninstall command, which adds -Remove to the preset of the deploy script.

For details on the remove folders, see Use the Proxy connector deployment files.

Verify the integration

After you deploy the files, open the Ready tool on a configured device to check certificate trust and network configuration. For how to read the results, see Verify the integration.

Deploy to Windows with Microsoft Intune