> ## Documentation Index
> Fetch the complete documentation index at: https://docs.velatir.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Deployment

> Roll Velatir for Desktop out across your fleet with Microsoft Intune, Jamf Pro, or any MDM

export const DesktopInstallGenerator = () => {
  const [ingestKey, setIngestKey] = useState("");
  const [os, setOs] = useState("windows");
  const [arch, setArch] = useState("x64");
  const [copied, setCopied] = useState("");
  const cleanArg = value => value.trim().replace(/"/g, "");
  const key = cleanArg(ingestKey) || "vltr_yourIngestKeyHere";
  const isWindows = os === "windows";
  const file = isWindows ? `Velatir-Bootstrap-${arch}.msi` : `Velatir-Bootstrap-macos-${arch}.pkg`;
  const downloadUrl = isWindows ? `https://releases.velatir.com/velatir-desktop/windows-${arch}/latest/${file}` : `https://releases.velatir.com/velatir-desktop/macos-${arch}/latest/${file}`;
  const command = isWindows ? `msiexec /i ${file} INGEST_KEY="${key}" /qn` : `sudo installer -pkg ${file} -target /`;
  const intuneArgs = `/qn INGEST_KEY="${key}"`;
  const archOptions = isWindows ? [{
    value: "x64",
    label: "x64"
  }, {
    value: "arm64",
    label: "arm64"
  }] : [{
    value: "arm64",
    label: "Apple Silicon"
  }, {
    value: "x64",
    label: "Intel"
  }];
  const selectOs = value => {
    setOs(value);
    setArch(value === "windows" ? "x64" : "arm64");
  };
  const copy = async (text, which) => {
    try {
      await navigator.clipboard.writeText(text);
      setCopied(which);
      setTimeout(() => setCopied(""), 2000);
    } catch (e) {}
  };
  const labelStyle = {
    display: "block",
    fontWeight: 600,
    fontSize: "14px",
    marginBottom: "2px"
  };
  const inputStyle = {
    width: "100%",
    boxSizing: "border-box",
    padding: "8px 12px",
    border: "1px solid rgba(128,128,128,0.4)",
    borderRadius: "8px",
    background: "transparent",
    color: "inherit",
    fontSize: "14px",
    marginTop: "4px"
  };
  const toggleButton = active => ({
    padding: "8px 16px",
    borderRadius: "8px",
    border: active ? "1px solid #F74F4F" : "1px solid rgba(128,128,128,0.4)",
    background: active ? "#F74F4F" : "transparent",
    color: active ? "#fff" : "inherit",
    fontWeight: 600,
    fontSize: "14px",
    cursor: "pointer"
  });
  const codeBox = {
    display: "block",
    width: "100%",
    boxSizing: "border-box",
    padding: "12px 14px",
    border: "1px solid rgba(128,128,128,0.3)",
    borderRadius: "8px",
    background: "rgba(128,128,128,0.08)",
    fontFamily: "monospace",
    fontSize: "13px",
    whiteSpace: "pre-wrap",
    wordBreak: "break-all",
    margin: 0
  };
  const copyButton = {
    padding: "6px 14px",
    borderRadius: "8px",
    border: "1px solid #F74F4F",
    background: "transparent",
    color: "#F74F4F",
    fontWeight: 600,
    fontSize: "13px",
    cursor: "pointer",
    marginTop: "8px"
  };
  return <div style={{
    border: "1px solid rgba(128,128,128,0.3)",
    borderRadius: "12px",
    padding: "20px",
    margin: "16px 0"
  }}>
      <div style={{
    marginBottom: "14px"
  }}>
        <label style={labelStyle}>Ingest key</label>
        <input type="text" value={ingestKey} onChange={e => setIngestKey(e.target.value)} placeholder="vltr_..." autoComplete="off" spellCheck={false} style={{
    ...inputStyle,
    fontFamily: "monospace"
  }} />
        <p style={{
    fontSize: "13px",
    opacity: 0.7,
    margin: "6px 0 0"
  }}>
          The ingest key maps each machine's traces to your organisation.
        </p>
      </div>

      <div style={{
    marginBottom: "14px"
  }}>
        <label style={labelStyle}>Platform</label>
        <div style={{
    display: "flex",
    gap: "8px",
    marginTop: "4px"
  }}>
          <button type="button" onClick={() => selectOs("windows")} style={toggleButton(isWindows)}>Windows</button>
          <button type="button" onClick={() => selectOs("macos")} style={toggleButton(!isWindows)}>macOS</button>
        </div>
      </div>

      <div style={{
    marginBottom: "16px"
  }}>
        <label style={labelStyle}>Architecture</label>
        <div style={{
    display: "flex",
    gap: "8px",
    marginTop: "4px"
  }}>
          {archOptions.map(opt => <button key={opt.value} type="button" onClick={() => setArch(opt.value)} style={toggleButton(arch === opt.value)}>
              {opt.label}
            </button>)}
        </div>
      </div>

      <label style={labelStyle}>Install command</label>
      <code style={codeBox}>{command}</code>
      <div style={{
    display: "flex",
    gap: "10px",
    flexWrap: "wrap",
    alignItems: "center"
  }}>
        <button type="button" onClick={() => copy(command, "cmd")} style={copyButton}>
          {copied === "cmd" ? "Copied" : "Copy command"}
        </button>
        <a href={downloadUrl} download style={{
    display: "inline-flex",
    alignItems: "center",
    gap: "7px",
    padding: "7px 16px",
    borderRadius: "8px",
    background: "#F74F4F",
    color: "#fff",
    fontWeight: 600,
    fontSize: "13px",
    textDecoration: "none",
    marginTop: "8px"
  }}>
          <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
            <path d="M12 3v12" />
            <path d="M7 11l5 5 5-5" />
            <path d="M5 21h14" />
          </svg>
          Download installer
        </a>
      </div>
      <p style={{
    fontSize: "12px",
    opacity: 0.6,
    marginTop: "6px",
    marginBottom: 0
  }}>{file}</p>

      {isWindows ? <details style={{
    marginTop: "16px"
  }}>
          <summary style={{
    cursor: "pointer",
    fontSize: "14px",
    fontWeight: 600
  }}>Microsoft Intune command-line arguments</summary>
          <p style={{
    fontSize: "13px",
    opacity: 0.7,
    margin: "8px 0"
  }}>
            For an Intune Line-of-Business app, upload {file} and paste these into <strong>Command-line arguments</strong>.
          </p>
          <code style={codeBox}>{intuneArgs}</code>
          <button type="button" onClick={() => copy(intuneArgs, "intune")} style={copyButton}>
            {copied === "intune" ? "Copied" : "Copy arguments"}
          </button>
        </details> : <p style={{
    fontSize: "13px",
    opacity: 0.75,
    marginTop: "14px",
    marginBottom: 0
  }}>
          macOS doesn't take the key on the install line. After installing, set it with <code style={{
    fontFamily: "monospace"
  }}>sudo velatir set-api-key --key {key}</code> on a single machine, or provision it through your MDM for a fleet (<code style={{
    fontFamily: "monospace"
  }}>com.velatir.agent</code> → <code style={{
    fontFamily: "monospace"
  }}>ApiKey</code>; see Enterprise deployment). Approve the Velatir system extension when macOS prompts.
        </p>}
    </div>;
};

Velatir for Desktop is a standard MSI (Windows) and PKG (macOS), so any MDM that deploys those works. One ingest key configures everything: no per-feature flags, no per-customer builds.

## Build your install command

Generate an ingest key on the **Setup** tab of the [Velatir dashboard](https://app.velatir.com). The same key works for every device.

<DesktopInstallGenerator />

## Deploy with your MDM

<AccordionGroup>
  <Accordion title="Microsoft Intune (Windows)" icon="microsoft">
    1. Go to **Apps → All apps → Add**, choose **Line-of-business app**, and upload the MSI from the builder above.
    2. Under **App information → Command-line arguments**, paste the Intune arguments from the builder.
    3. Assign to your device groups in **Required** mode. Intune handles elevation.

    To rotate the key later, update the command-line arguments and redeploy.
  </Accordion>

  <Accordion title="Jamf Pro (macOS)" icon="apple">
    1. Upload the PKG from the builder under **Packages** and deploy it with a policy scoped to your Macs (**Recurring Check-in**, **Once per computer**).
    2. Add a configuration profile, scoped to the same Macs, with two payloads:
       * **Application & Custom Settings** → preference domain `com.velatir.agent`, key `ApiKey` set to your ingest key. This is the macOS equivalent of the MSI's `INGEST_KEY`; update it later to rotate the key with no reinstall.
       * **System Extensions** → allow Team Identifier `AA7QLU3S4R` (Network Extension), so the agent activates with no end-user prompt.
  </Accordion>

  <Accordion title="Microsoft Intune (macOS)" icon="apple">
    1. Upload the PKG from the builder under **Apps → macOS → Add → Line-of-business app**, assigned **Required**.
    2. In **Devices → Configuration**, scope a profile to the same devices that:
       * sets the `com.velatir.agent` preference `ApiKey` to your ingest key (the macOS equivalent of the MSI's `INGEST_KEY`, updatable to rotate the key with no reinstall), and
       * allows the system extension with Team Identifier `AA7QLU3S4R` (System Extensions).
  </Accordion>

  <Accordion title="SCCM and other tools" icon="server">
    Any tool that runs `msiexec` (Windows) or `installer` (macOS) works: use the command from the builder above. For a Windows detection rule, check for the `VelatirAgent` service or the install path `C:\Program Files\Velatir\`.
  </Accordion>
</AccordionGroup>

<Note>
  macOS never installs a certificate through MDM: Velatir generates a unique CA on each device, so there is no shared root to distribute.
</Note>

## Reference

<AccordionGroup>
  <Accordion title="MSI properties (Windows)" icon="table">
    | Property                  | Required    | Description                                                                                                                |
    | ------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------- |
    | `INGEST_KEY`              | Recommended | Stages the ingest key at install time. Hidden from MSI logs. (`VELATIR_API_KEY` is accepted as a deprecated alias.)        |
    | `VELATIR_HIDE_TRAY`       | No          | Set to `1` to hide the system-tray icon. Windows only; on macOS use `velatir hide`. `velatir show` reverses it at runtime. |
    | `VELATIR_BYO_CA_PATH`     | No          | Path to a PFX bundle for bring-your-own-CA installs.                                                                       |
    | `VELATIR_BYO_CA_PASSWORD` | No          | Password for the PFX bundle above.                                                                                         |
  </Accordion>

  <Accordion title="Rotate the ingest key" icon="key-round">
    **Windows.** Redeploy with the new key in the command-line arguments. The host restarts and picks it up.

    **macOS.** Update the `ApiKey` value in the `com.velatir.agent` managed preference in your MDM. Devices apply it on the next check-in, with no reinstall.
  </Accordion>

  <Accordion title="Monitor the fleet" icon="activity">
    Run `velatir status --json` as a Microsoft Intune Remediation or a Jamf Pro extension attribute. It reports client state, version, and the last trace timestamp, so you can spot drift across the fleet from your dashboard.
  </Accordion>

  <Accordion title="Pin a version" icon="git-branch">
    Velatir auto-updates by default. To coordinate updates with your own change-management process, contact support to enable a per-tenant update channel.
  </Accordion>

  <Accordion title="Bring your own CA" icon="shield-check">
    Supply your own certificate authority instead of the Velatir-issued one. See [Bring your own certificate](/desktop-app/bring-your-own-ca) for the format, distribution, and rotation.
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Permissions" icon="shield-check" href="/desktop-app/permissions">
    What the installer asks for on each platform.
  </Card>

  <Card title="Health checks" icon="heart-pulse" href="/desktop-app/health-checks">
    Monitor agent and capture health across the fleet.
  </Card>

  <Card title="VPN compatibility" icon="globe" href="/desktop-app/vpn-compatibility">
    Behaviour alongside corporate VPNs.
  </Card>

  <Card title="Troubleshooting" icon="life-buoy" href="/desktop-app/troubleshooting">
    Diagnose failures during scaled rollouts.
  </Card>
</CardGroup>