Skip to main content

Microsoft Intune rollout

Roll out pavri-endpointd to a Windows fleet via Microsoft Intune using a Win32 LOB app manifest + PowerShell install/uninstall scripts + a separate Configuration Profile to pre-seed registry keys. This Intune Win32 path is the MVP Windows installer deliverable; Pavri does not require a full MSI for MVP.

1. Prerequisites​

  • Pavri tenant + admin role.
  • Microsoft Intune admin access (Endpoint Manager); permission to create Win32 apps and Device Configuration profiles.
  • Signed pavri-endpointd.exe and endpointctl.exe wrapped together as an .intunewin package (Authenticode + Microsoft Store or enterprise signing). Build the staged directory with services/endpointd/packaging/windows/build-binaries.ps1. The .intunewin package must include both pavri-endpointd.exe and endpointctl.exe — the install script uses endpointctl.exe to register native-messaging manifests and stages both executables under C:\Program Files\Pavri\pavri-endpointd. Signing is gated on CAP-3.7 item 1 (Windows-Intel) — see the CAP-3.7 row in docs/05-PHASED-ROADMAP.md (internal).

2. Token mint​

In the Pavri dashboard, navigate to Settings → Endpoints → Add Endpoint → Mint enrollment token. Tokens are single-use per endpoint, 24-hour TTL. Mint one token per Intune Assignment Group scope — re-use across endpoints within the group is supported because the gateway tracks per-endpoint enrollment state.

3. Substitution markers​

Before deploying the Intune Configuration Profile, populate the following registry values under HKEY_LOCAL_MACHINE\SOFTWARE\Pavri:

Registry valueContentReplace with
GatewayUrlREG_SZYour tenant's gateway URL (e.g. https://gateway.your-org.pavri.ai)
EnrollmentTokenREG_SZThe token you minted in step 2
OrgIdREG_SZYour pavri org_id (visible at /admin/tenant in the dashboard)
BrowserExtensionIdREG_SZOptional Chrome/Edge extension ID for native-messaging allowed_origins; Firefox native messaging uses the fixed Pavri add-on ID
PrivacyStrictREG_SZOptional; recommended true for works-council/privacy-sensitive fleets
TransparencyPortREG_SZOptional; defaults to 7878

The infra/mdm/intune/pavri-endpointd.intunewin.json manifest uses ${ENROLLMENT_TOKEN} and ${ORG_ID} as documentary substitution markers. Replace these markers in any derivative manifests or CI pipelines before import. The manifest's _substitution_markers field lists every literal ${...} token so the CI live-token leak guard can locate them even though the actual delivery mechanism is the Windows registry rather than environment variables.

For the full list of supported environment variables and command-line flags, see Sensor deployment reference.

At install time, install.ps1 maps the registry values into machine-level environment variables and the service-specific HKLM\SYSTEM\CurrentControlSet\Services\PavriEndpointd\Environment REG_MULTI_SZ block for the LocalSystem service:

Registry valueService environment
GatewayUrlPAVRI_GATEWAY_URL
EnrollmentTokenPAVRI_ENROLLMENT_TOKEN
OrgIdPAVRI_ORG_ID

pavri-endpointd uses the gateway URL and enrollment token to enroll with the real Pavri gateway, then persists the returned endpoint identity and mTLS material under C:\ProgramData\Pavri\Endpoint. The service-specific block is written before Start-Service, so the first SCM-launched process sees the same configuration as later boots.

4. Package signing​

The Win32 app .intunewin wraps your pavri-endpointd.exe. The executable must be Authenticode-signed with a certificate trusted by the target fleet (either a Microsoft EV cert or your enterprise PKI). Until CAP-3.7 item 1 ships the Windows-Intel signed build, the sensor can be deployed for evaluation using an enterprise CA — see the Windows developer loop for how to configure the dev CA.

5. Staged rollout​

  1. Create an Intune Assignment Group pavri-pilot (dynamic, 5% of enrolled devices; use deviceCategory or a custom attribute filter).
  2. Assign the Configuration Profile (registry keys) to pavri-pilot with Required intent; ensure it completes before the Win32 app assignment.
  3. Assign the Win32 LOB app to pavri-pilot with Required intent.
  4. Set the tenant default protection-profile to observe mode at /admin/protection-profiles.
  5. After 1 week of clean telemetry: expand the assignment group to 25% of fleet, switch tenant default to soft_enforce.
  6. After 1 further week: expand to 100% and switch to enforce.

6. Rollback​

  • Per-endpoint emergency: at /admin/endpoints/{endpoint_id} → Set protection mode → observe — takes effect immediately, no Intune touch required.
  • Fleet-wide emergency: at /admin/protection-profiles → set tenant default to observe.
  • Full uninstall via Intune: change the Win32 app assignment to Uninstall intent. Intune will invoke uninstall.ps1, which stops the service, removes NM manifests, and deletes the install directory while preserving endpoint identity state. A later reinstall refreshes the same inventory record. Use uninstall.ps1 -Purge only when the endpoint and all of its local state must be removed; the next enrollment will create a new record.
  • Identity-only reset: run endpointctl.exe reset-identity from the installed directory. It stops PavriEndpointd, removes only enrollment state and the persisted identity, and leaves the installation and logs in place. Deploy a new enrollment token before starting or redeploying the service.

7. Post-install verification​

On any enrolled endpoint (PowerShell as Administrator):

# Verify the service is registered and running.
sc.exe query PavriEndpointd

# Verify native-messaging manifests. Firefox does not require BrowserExtensionId;
# Chrome/Edge manifests are present only when BrowserExtensionId is deployed.
& "C:\Program Files\Pavri\pavri-endpointd\endpointctl.exe" status-nm-manifests --browser=all --scope=system

Confirm the endpoint shows up at /admin/endpoints in the dashboard within 60 seconds of the heartbeat interval.

The Windows package/install smoke in CI is static unless release credentials are available: it builds both architectures on windows-2022, validates PowerShell syntax, validates the Intune staging directory, and checks the service/install contract. Uploading the .intunewin into an external Intune tenant remains a release evidence step when tenant credentials are available.

Files in this rollout​

  • infra/mdm/intune/pavri-endpointd.intunewin.json — Win32 LOB app manifest.
  • infra/mdm/intune/install.ps1 — install script (reads registry, installs service, installs Firefox NM manifests, and installs Chrome/Edge NM manifests when BrowserExtensionId is configured).
  • infra/mdm/intune/uninstall.ps1 — uninstall script (stops service, removes NM manifests, deletes install directory).
  • infra/mdm/intune/README.md — short on-disk reference for Intune operators.

MVP limitations​

Windows live egress-proxy trust is still deferred to the roadmap, so APR and deep managed-egress visibility on Windows inherit that limitation. ETW process, network, and file observers are observation/evidence paths; arbitrary inline file/network blocking requires a supported Windows chokepoint such as WFP or a minifilter driver and is tracked separately.