Deploying Connect with JumpCloud

This page takes a JumpCloud administrator from an empty device group to computers whose AI traffic shows up in Usage Insights, with no per-device clicks. It is the JumpCloud-specific companion to Endpoint Enrollment, which explains what Connect does and how a computer is tied to an employee. If you use Microsoft Intune instead, see Deploying Connect with Microsoft Intune.

On every operating system you push exactly two things, both downloaded from Agent Fleet → Deploy with an MDM:

1. The installer — puts AgentWatch Connect on the computer.
2. One settings file — tells Connect which AgentWatch server to use and which organization it belongs to (and, on macOS, carries your organization’s Connect certificate). Connect reads it from a place only an administrator or the MDM can write, so an employee cannot point it somewhere else.

After that nothing is clicked on the computer — not by the employee and not by IT. Connect enrolls the signed-in employee, switches interception on and keeps it on by itself. The one exception is described in What does the employee see?

What do I need before I start?

Item	Where to get it	Used for
An enrollment token	AgentWatch console → Agent Fleet → Agent Connect Settings → Enrollment Token. If the field is empty, click Regenerate token beside it. Sign in as an administrator of the organization the computers belong to	Written into every settings file. Without one, the Settings downloads refuse and the console says so
Your employee email domain	For example acme.com	Typed into Deploy with an MDM → Employee email domain, so Connect can identify <computer sign-in name>@acme.com
Employees in AgentWatch	SSO/SCIM, CSV import, or Employee Management → Add	Every computer is enrolled as an existing employee
JumpCloud device groups	One per operating system is simplest: AgentWatch – Windows, AgentWatch – macOS, AgentWatch – Linux	Binding the software, policies and commands
JumpCloud MDM for macOS	Required by JumpCloud for configuration profiles and for software deployed from its private repository on Macs	macOS steps

The enrollment token identifies your organization, not a person. Treat it like a building badge: anyone who holds it can attempt to enroll a computer into your organization. If it leaks, click Regenerate token, download the settings files again and replace them in the JumpCloud policies below. Computers that are already enrolled keep working; they received their own employee key at enrollment. You do not need a gateway ak_ key for an MDM rollout.

Where do I download the two files?

In the AgentWatch console, open Agent Fleet → Deploy with an MDM:

1. Type your domain into Employee email domain (for example acme.com).
2. For each operating system you deploy, click Installer and Settings:

OS	Installer	Settings	Where the settings land on the computer
Windows 10/11, x64	AgentWatch-Connect-Setup-<version>-windows-x64.exe (signed)	agentwatch-connect.reg	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\AgentWatch\Connect — REG_SZ values ServerURL, EnrollmentToken, EmailDomain
macOS 12+, Apple silicon and Intel	AgentWatch-Connect-<version>-macos-universal.pkg (signed and notarized)	agentwatch-connect.mobileconfig	a configuration profile; Connect reads /Library/Managed Preferences/ai.iterate.agentwatch-connect.plist
Linux x86_64 / aarch64 (Ubuntu/Debian)	agentwatch-connect_<version>_amd64.deb / _arm64.deb	connect.json	/etc/agentwatch/connect.json, owned by root

Each Settings download is recorded in Settings → Audit Logs as fleet.mdm_config_downloaded. The installers are also served directly by your server, which is useful for a script:

curl -fsS https://agentwatch.acme.com/agent/version
# {"latestVersion":"1.0.148", ..., "installers":{"windows-x64":"/agent/bundle/AgentWatch-Connect-Setup-1.0.148-windows-x64.exe",
#   "darwin-pkg":"/agent/bundle/AgentWatch-Connect-1.0.148-macos-universal.pkg", "linux-x64-deb":"/agent/bundle/agentwatch-connect_1.0.148_amd64.deb", ...}}

RHEL-family Linux uses the one-line installer described in Endpoint Enrollment.

How is each computer tied to an employee without a sign-in?

Connect works out the employee’s email by itself, in this order:

1. Email in the managed settings, if your MDM substitutes a per-user value into it (an unsubstituted placeholder such as $EMAIL, {{mail}} or %EMAIL% is ignored, never sent).
2. On Windows, the signed-in user’s Microsoft Entra ID / Active Directory sign-in address (UPN), for example jdoe@acme.com. The Connect service reads it itself, so Entra-joined and domain-joined PCs need nothing more.
3. <computer sign-in name>@EmailDomain, for example macOS short name jdoe → jdoe@acme.com.

If one of these is an employee in AgentWatch, the computer is enrolled as that employee and nobody is asked anything. Only when none of them produces a provisioned employee — or Agent Fleet → Agent Connect Settings → Require sign-in to approve each computer is on — does the employee see a one-time sign-in code. That is the only case in which anyone touches the computer.

The settings file from the console carries ServerURL, EnrollmentToken and EmailDomain. For reference, these are all the keys Connect accepts — every value is a string (on Windows REG_SZ; Connect ignores DWORD and multi-string values):

Key	Value	Required
ServerURL	https://agentwatch.acme.com — no trailing path	Yes
EnrollmentToken	the token from Agent Fleet → Agent Connect Settings	Yes (or apiKey, below)
Email	the employee’s email, if your MDM can substitute it per user	No
EmailDomain	acme.com	No, but recommended
apiKey	a single employee’s ak_ gateway key instead of a token. Only for a computer that belongs to one known person — a key pushed to many computers attributes them all to that one person	No

How do I deploy to Windows?

Step 1 — push the settings

Option A — a Command with the downloaded .reg (simplest). Device Management → Commands → +, a Windows command, type PowerShell. Under the command’s file upload, attach the agentwatch-connect.reg you downloaded; JumpCloud places it in C:\Windows\Temp\ before the command runs. Command:

# Runs as SYSTEM. /reg:64 writes the 64-bit registry view whichever host runs it.
reg.exe import "C:\Windows\Temp\agentwatch-connect.reg" /reg:64
reg.exe query "HKLM\SOFTWARE\Policies\AgentWatch\Connect" /reg:64

Bind it to AgentWatch – Windows and run it (or set it to run on device-group membership).

Option B — a registry policy. If you prefer a policy that JumpCloud keeps enforcing: Device Management → Policy Management → +, the Windows tab, Advanced: Custom Registry Keys. Name it AgentWatch Connect – configuration and add one row per line of the downloaded .reg. Registry Key Location is SOFTWARE\Policies\AgentWatch\Connect (the policy always writes under HKEY_LOCAL_MACHINE), Type is SZ:

Value Name	Type	Data
ServerURL	SZ	https://agentwatch.acme.com
EnrollmentToken	SZ	your enrollment token
EmailDomain	SZ	acme.com

On the Device Groups tab select AgentWatch – Windows, then Save. JumpCloud documents that this policy can need a device restart to apply; Option A does not.

The order of Step 1 and Step 2 does not matter. The Connect service checks for its settings every minute, so if the installer lands first it simply enrolls once the settings arrive.

Step 2 — push the installer

Option A — Software Management (recommended). Device Management → Software Management → the Windows tab → + Add New → JumpCloud Private Repo, then upload AgentWatch-Connect-Setup-<version>-windows-x64.exe.

• Silent Install Flags: /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /NOTRAY=1
• Installation Detection Rules: Registry — the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8C7A4F0E-5C2A-4A9D-9E8B-2F4C5D3E1A6B}_is1 exists (the installer’s fixed product ID, so it survives upgrades). If you prefer a file rule, use C:\Program Files\AgentWatch Connect\agentwatch-connect.exe.
• On the Device Groups tab select AgentWatch – Windows, Save, and confirm.

Option B — a Command. If you do not use Software Management:

$v   = '1.0.148'                                  # from /agent/version
$url = "https://agentwatch.acme.com/agent/bundle/AgentWatch-Connect-Setup-$v-windows-x64.exe"
$exe = "$env:TEMP\AgentWatch-Connect-Setup.exe"
curl.exe -fsSL -o $exe $url
Start-Process -FilePath $exe -Wait -ArgumentList '/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/NOTRAY=1','/LOG="C:\Windows\Temp\AgentWatch-Setup.log"'

Setup runs with the rights the MDM already has, so nobody sees a UAC prompt. In that one run it installs Connect under C:\Program Files\AgentWatch Connect, trusts the Connect certificate for the whole computer and registers the AgentWatchConnect service, which starts immediately and at every boot. /NOTRAY=1 stops Setup from starting a tray in the MDM’s SYSTEM session; the tray icon appears at the employee’s next sign-in and only shows status.

Keep employees as standard users: removing Connect needs administrator rights. Leave the Software Management app bound to the group — if Connect is ever removed by an administrator, the detection rule no longer matches and JumpCloud installs it again.

How do I deploy to macOS?

Two pushes to the same device group, in either order. Connect waits for the profile and redirects nothing until macOS trusts the certificate, so browsing is never broken in between.

Step 1 — push the profile

Upload the agentwatch-connect.mobileconfig you downloaded from Deploy with an MDM unchanged. It carries:

• your organization’s AgentWatch Connect root certificate (com.apple.security.root). This is why a profile is needed at all: since macOS 11, a certificate is trusted silently only when an MDM installs it in a profile — no installer, script or root process can do it;
• the Connect settings (ServerURL, EnrollmentToken, EmailDomain);
• Chrome, Edge and Brave policies: DNS-over-HTTPS off, the built-in DNS client off, QUIC off — so browsers use the system resolver Connect steers;
• a Firefox policy: trust enterprise roots (ImportEnterpriseRoots), DNS-over-HTTPS off;
• not removable by the user.

In JumpCloud: Device Management → Policy Management → +, the Mac tab, MDM Custom Configuration Profile. Under Settings, upload the file, bind it to AgentWatch – macOS on the Device Groups tab, and Save.

The profile must be pushed by the MDM. A profile a user installs by double-clicking it does not make the certificate trusted silently, and Agent Fleet will keep showing that Mac with CA trusted off.

Step 2 — push the installer package

Device Management → Software Management → the Apple tab → + Add New → JumpCloud Private Repo, upload AgentWatch-Connect-<version>-macos-universal.pkg, bind it to AgentWatch – macOS, and Save. JumpCloud requires Apple MDM enrollment for this and requires the package to be signed; the .pkg is signed with Iterate’s Developer ID Installer certificate and notarized by Apple.

The package installs AgentWatch Connect.app into /Applications and, as root and with no prompt, a LaunchDaemon that runs Connect for the whole Mac (“machine mode”) plus a login item that starts the menu-bar app for each user. Nobody opens the app and nobody enters an administrator password.

Two things to know:

• Use the .pkg from Connect 1.0.148 or later. The .dmg is for installing by hand: it still asks for an administrator the first time interception switches on, so it is not an MDM install.
• A per-user Email is optional. The downloaded profile identifies the employee as <macOS short name>@EmailDomain. If short names do not match email addresses at your company, add an Email key with a JumpCloud per-user variable if your configuration supports one; otherwise the affected employees see the one-time sign-in code described below.

How do I deploy to Linux?

JumpCloud manages Linux through its agent and Commands, which run as root. These steps cover Ubuntu and Debian desktops with the .deb; for RHEL-family machines and servers use the one-line installer from Endpoint Enrollment.

The settings file must be in place, owned by root, before the .deb is installed. One Command does both, in that order. Device Management → Commands → +, a Linux command run as root, with the downloaded connect.json attached through the command’s file upload (JumpCloud places it in /tmp/), bound to AgentWatch – Linux:

#!/bin/bash
set -euo pipefail
SERVER="https://agentwatch.acme.com"
V="1.0.148"                                   # from $SERVER/agent/version

# 1. Settings: root-owned and not group/world-writable, or Connect ignores the file.
install -d -m 0755 /etc/agentwatch
install -o root -g root -m 0644 /tmp/connect.json /etc/agentwatch/connect.json

# 2. Installer.
ARCH=$(dpkg --print-architecture)              # amd64 or arm64
curl -fsSL -o /tmp/agentwatch-connect.deb "$SERVER/agent/bundle/agentwatch-connect_${V}_${ARCH}.deb"
DEBIAN_FRONTEND=noninteractive apt-get install -y /tmp/agentwatch-connect.deb

That is all. With the settings present, the package sets Connect up for the whole computer: a root service, started immediately and at every boot; the certificate in the system trust store; and, for each desktop user at sign-in, the certificate in their browsers (Chrome and Firefox on Linux keep trusted certificates per user). It does not matter whether anyone is signed in when the command runs.

chmod 0644 and root ownership are required exactly: a file other users can write is ignored, because otherwise anyone on the machine could redirect intercepted traffic.

What happens after the push?

1. The Connect service enrolls by itself. It retries every minute, so a profile that arrives after the installer, a network that is not up at boot, or an employee who signs in later all work without anyone stepping in.
2. Interception switches on by itself within about a minute of enrollment, and stays on.
3. The tray / menu-bar icon appears and shows Connected. On managed computers it only shows status — it does not open a setup window.

No computer restart is needed. Browsers: anything opened after interception starts is covered; tabs that were already open pick it up within about a minute; Firefox picks it up at its next restart. There is nothing for anyone to click.

What does the employee see?

OS	What happens	Clicks needed
Windows	The tray icon appears and shows Connected	None
macOS	The menu-bar icon appears and shows Connected	None
Linux	The tray icon appears in the top bar and shows Connected	None

The only exception — a one-time sign-in code. If Connect could not derive an email that belongs to a provisioned employee (see How is each computer tied to an employee?), or the organization turned on Require sign-in to approve each computer, Connect shows a short code such as KQ7M-3XTP and opens the sign-in page in the default browser. The employee signs in with your normal sign-in, checks the code and computer name, and clicks Approve — once per computer. The tray’s Open sign-in page reopens it if it was closed.

Can an employee turn it off or remove it?

• Turning interception off: no. On a computer with managed settings, the tray hides the off switch and Connect refuses any request to switch interception off — from the app, a script or another program — with 403 managed by your organization. If something on the computer removes the redirection anyway, it is switched back on at the next check-in.
• Uninstalling: needs administrator rights. Keep employees as standard users and leave the JumpCloud software assignment in place so a removed copy is reinstalled.

To stop interception deliberately, use How do I pause interception?, or remove the settings from the computer.

How do I verify the rollout?

1. On one test computer, check Connect directly.

   # Windows (64-bit PowerShell)
   reg query "HKLM\SOFTWARE\Policies\AgentWatch\Connect"      # ServerURL, EnrollmentToken, EmailDomain as REG_SZ
   Get-Service AgentWatchConnect                               # Status: Running
   & 'C:\Program Files\AgentWatch Connect\agentwatch-connect.exe' status

   # macOS
   sudo profiles list | grep -i agentwatch                                        # the profile is installed
   plutil -p "/Library/Managed Preferences/ai.iterate.agentwatch-connect.plist"   # ServerURL, EnrollmentToken, EmailDomain
   sudo launchctl print system/ai.iterate.agentwatch-connect | grep state         # state = running
   tail -n 20 /Library/Logs/AgentWatch/connect.log
   
   # Linux
   stat -c '%U %a' /etc/agentwatch/connect.json        # root 644
   systemctl is-active agentwatch-connect               # active
   sudo agentwatch-connect status

2. In the console, open Agent Fleet. The computer appears within about a minute, Online, with its employee, platform, Connect version and the proxy, certificate (CA trusted) and redirection columns active.

3. Send a harmless prompt. On the test computer, open a public AI assistant in a new browser tab and send something like What is the capital of France?. Within a few seconds it appears in Usage Insights attributed to that employee.

Then widen the device group in steps.

How do upgrades work?

There are two ways to deliver a new Connect version. Both work; pick one per group of computers.

From AgentWatch (no MDM work). In Agent Fleet → Fleet controls → Connect updates, choose a policy:

Policy	Effect
Automatic — everyone	Every computer takes the new version the server offers
Selected users only	Only the employee emails in the Selected users list receive updates — use it to try a new version on a few people first
Paused — no updates	No computer updates

Check for updates now asks computers to check immediately: Connect 1.0.148 or later checks within about 30 seconds; older versions check once a day. Updates download in the background and install when the computer is idle, so a response in progress is not cut off:

• macOS and Linux swap in the new Connect binary, and roll back automatically if the new version cannot reach the server within 90 seconds.
• Windows (Connect 1.0.148 or later) runs the signed Setup installer silently from the Connect service — no prompt for the employee — and only if the installer is validly signed by the same publisher as the Connect already installed.
• Windows computers on Connect 1.0.147 or earlier make one automatic step to 1.0.148 using the signed Connect binary, and update through the installer from then on.

The policy governs automatic updates. An employee with administrator rights can still run a newer installer by hand.

From JumpCloud (change control). Upload the new installer to the same Software Management app (or update the version in your install command) and let JumpCloud roll it out on your schedule.

Which to choose. Use the JumpCloud route when IT wants every software change to go through its own change process and reporting. Otherwise use the AgentWatch policy — it needs no repackaging, supports a canary group, and rolls back on its own. Do not run both for the same computers without a reason: if you upgrade through JumpCloud, set Connect updates to Paused — no updates for those computers’ users, so the two do not race each other.

How do I pause interception?

Scope	Control	Effect
Everyone	Agent Fleet → Fleet controls → Interception for everyone → Pause for everyone	Interception switches off on every computer in the organization within about 30 seconds. The button becomes Resume interception, which switches it back on just as quickly
One person	the Monitored toggle on that employee’s row in the Agent Fleet table	Exempts that one user; click again to resume
One computer, permanently	remove the settings (unbind the JumpCloud policy, or delete the registry key / connect.json), or uninstall Connect	Connect is no longer managed on that computer

Pausing switches off redirection; it does not uninstall anything, and resuming needs no MDM action. Traffic sent while paused is not captured.

How do I uninstall Connect?

Keep in mind that a Required-style assignment reinstalls Connect: unbind the software / command from the device group first.

Computer	JumpCloud
Windows	Commands → +, a Windows command run as SYSTEM: & "C:\Program Files\AgentWatch Connect\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
macOS	Commands → +, a Mac command run as root: "/Applications/AgentWatch Connect.app/Contents/Resources/uninstall.sh"
Linux (.deb)	Commands → +, a Linux command run as root: DEBIAN_FRONTEND=noninteractive apt-get remove -y agentwatch-connect

To also remove every employee’s personal settings, add --purge on macOS (uninstall.sh --purge), use apt-get purge -y agentwatch-connect on Linux, and on Windows run & "C:\Program Files\AgentWatch Connect\agentwatch-connect.exe" uninstall --purge before unins000.exe.

What stays, on purpose. The uninstall removes everything Connect installed — the service, the hosts-file redirection, the Connect certificate, the browser DNS-over-HTTPS policies, its helpers — and prints what it leaves:

• the settings you pushed (HKLM\SOFTWARE\Policies\AgentWatch\Connect and the legacy ...\Iterate\AgentWatchConnect, the macOS profile and its Managed Preferences, /etc/agentwatch/connect.json). They belong to the MDM: remove the profile / unbind the policy, or the next install enrolls by itself again. The organization certificate in the macOS profile is removed with the profile.
• each employee’s own settings (~/.agentwatch-connect), so a reinstall keeps them. To remove those too, use --purge (Linux apt purge).

Windows computers uninstalled with Connect older than 1.0.150 kept the hosts-file entries and the certificate, which breaks ChatGPT and Claude in the browser. See How do I uninstall Connect? for the one-time cleanup.

Troubleshooting

Symptom	Cause	Fix
Settings download fails; the console says to generate an enrollment token	The organization has no enrollment token yet	Agent Fleet → Agent Connect Settings → Regenerate token, then download again
Computer never appears in Agent Fleet	The settings are missing or unreadable: Linux connect.json absent or not owned by root / writable by others; Windows values written to the 32-bit hive (HKLM\SOFTWARE\WOW6432Node\…, which 32-bit reg.exe writes); or the token is wrong or was regenerated	Windows: reg query "HKLM\SOFTWARE\Policies\AgentWatch\Connect" from 64-bit PowerShell, and import with reg.exe import … /reg:64. Linux: sudo chown root:root /etc/agentwatch/connect.json && sudo chmod 644 /etc/agentwatch/connect.json. Then download fresh settings if the token changed
Windows values present but ignored	Created as DWORD or multi-string, or under HKEY_CURRENT_USER	Import the downloaded .reg, or recreate them as SZ under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\AgentWatch\Connect
Mac shows CA trusted = No in Agent Fleet	The profile is not installed, or was installed by hand (double-clicked)	Push the profile from JumpCloud (MDM Custom Configuration Profile); Connect redirects nothing until macOS trusts the certificate
Mac asks for an administrator password	It was installed from the .dmg, or with a .pkg older than 1.0.148	Push the 1.0.148+ .pkg from Software Management
Employee sees a sign-in code	Connect could not derive an email that is a provisioned employee, or Require sign-in to approve each computer is on	Set Employee email domain before downloading the settings (or add an Email value), or provision the employee in Employee Management; the employee can also just approve once
Approval page: set up for a different organization	The token belongs to another AgentWatch organization	Push settings downloaded from the employee’s own organization
Computer is Online but no prompts reach Usage Insights	The tab was open before interception started (Firefox: not restarted since)	Wait a minute and resend from a new tab; Firefox picks it up at its next restart
Interception is off on every computer	Pause for everyone is active	Agent Fleet → Fleet controls → Resume interception
Interception off for one person only	They are exempt	Click their Monitored toggle in Agent Fleet
A new version never arrives	Connect updates is Paused, or the user is not in Selected users	Change the policy, then Check for updates now
An update installed and then reverted	The new version could not reach the server within 90 seconds and rolled back	Check that the computer can reach your AgentWatch address; Connect waits before trying the same update again
unable to get local issuer certificate and the computer never appears	A TLS-inspecting gateway re-signs the connection to AgentWatch	Connect 1.0.147 or later trusts the operating system’s roots; or exempt the AgentWatch address from TLS inspection
Windows: antivirus quarantined a Connect component	The browser-compatibility helper was flagged	Allow C:\Program Files\AgentWatch Connect\curl-impersonate\curl-impersonate.exe

Logs: Windows C:\ProgramData\AgentWatch\logs\service.log (Setup: C:\Windows\Temp\AgentWatch-Setup.log); macOS /Library/Logs/AgentWatch/connect.log; Linux journalctl -u agentwatch-connect. Every enrollment is recorded in Settings → Audit Logs as agent.device_enrolled.

Sources and references

• What Connect does, identity resolution and the managed settings locations: Endpoint Enrollment and the Endpoint Enrollment Guide.
• The same rollout with Microsoft Intune: Deploying Connect with Microsoft Intune.
• What captured activity looks like: Shadow AI discovery.
• JumpCloud: Create Your Own Windows Policy Using Registry Keys, Manage Software with JumpCloud Private Repository, Create a Mac or iOS MDM Custom Configuration Profile Policy, Get Started: Commands, Install Applications Remotely.
• Windows installer switches: Inno Setup — Setup Command Line Parameters.