Deployment
One machine in ten minutes, or a fleet with no human at any of them — and what the agent asks of a network.
On this page
Two shapes, and which one you want depends on whether a person is going to touch each machine.
Supported platforms
| macOS | 12 or later, universal package — Developer ID signed, notarised, stapled |
| Windows | 10 1809 / Server 2019 or later, x86_64, MSI with a silent install |
| Linux | .deb and .rpm, plus a tarball for containers and CI runners |
The installers come from your own deployment, not from the public internet. That is what makes an air-gapped rollout work at all, and every response carries the artifact's SHA-256 in a header so a download can be verified before it is trusted.
One machine, in about ten minutes
Install
From your console's download page. One URL redirects by user agent, which is the one worth pasting into an email.
Point it at your deployment
Two lines in the managed configuration file. Delivery is off until this exists — before it, nothing leaves the machine.
Connect the device
The menu-bar item on macOS, or the tray item on Windows, offers Connect this device and shows a short
claim code. Somebody signed into the organisation types it into the console. Or run endlayer enroll
from a terminal, which prints the same code.
Read the first snapshot
Within one scan interval, or immediately with endlayer run --once. endlayer doctor is the first
thing to run if anything looks wrong.
A fleet, with no human at any machine
One enrolment secret with a device ceiling, an expiry and default tags. The console generates the exact PowerShell, the shell equivalent and the matching configuration file with your deployment URL already filled in. The secret is shown once — only its hash is stored.
The rollout page then shows devices enrolled per secret and remaining capacity, so a rollout that stalls at 40 of 500 is visible without checking machines one by one.
Fleet installs have no menu-bar app: the script does the connecting, so the installer leaves it out.
If you manage Windows clients and Macs with Intune, there is a shorter route that needs no scripts at all: Microsoft.
What it asks of a network
Outbound HTTPS to one host — your deployment. No telemetry endpoint, no update server, no third party, and nothing listens for inbound connections.
TLS-inspecting proxies and custom roots are supported. Certificate verification is not: there is no config key, no environment variable and no flag that disables it.
After the first devices report
The step most easily missed. Until policy baselines are set, most signals report and stay
ungraded on purpose — because ungraded is the honest answer to "does this match policy" when nobody
has said what the policy is. Four inputs change that: corporate domains, permitted agent modes,
required blocked domains, and what you pay per tool.
Everything above in full: deployment overview and fleet rollout.