Skip to content
ArbiumArbium Docs

Windows rollout

Owner: IT Audience: an IT admin deploying the Roots Windows agent to a managed fleet via Microsoft Intune for the first time.

The Roots Windows agent is a .msi package, deployed as a Line-of-Business (LOB) app in Intune. It authenticates to ChainDB with a Microsoft Entra ID JWT, acquired silently through MSAL + the WAM broker against the device’s Primary Refresh Token — no interactive sign-in, no client secret on the device.

The five steps

Section titled “The five steps”
  1. Entra app registration — create the app reg, add the WAM redirect URI, enable public client flows, flip the manifest to v2 tokens, grant admin consent. Hand the tenant + client IDs to Cloud Ops.
  2. Policy management — create the pilot device group; upload the Set-RootsConfig.ps1 platform script that writes %ProgramData%\Roots\config.json on each device.
  3. Enroll apps — upload Roots.msi as an Intune LOB app, scope to the pilot group.
  4. Smoke test — install on one device, confirm the agent acquires a token and uploads captures.
  5. Shipping updates — the steady-state flow for shipping a new agent version.

Steps 2 and 3 should run in the same session. The config script (Step 2) must reach the device before the MSI (Step 3) — if the MSI lands first, the agent installs and starts with no config, logs an error, and retries until the script writes config.json. Recoverable, but cleaner the other way.

Start with 1. Entra app registration.