3. Enroll apps

Owner: IT Prerequisite: Step 2 (policy management) is complete on the pilot devices. If the MSI deploys before the config script, the agent installs but starts with missing configuration, logs an error, and retries. It recovers once the script writes config.json, but a clean rollout pushes configuration first.

You’ll receive one package per architecture from the Arbium team:

• Roots.msi — x64 build
• Roots.msi — arm64 build

Deployed as Line-of-Business (LOB) MSI in Intune — not a Win32 .intunewin wrapper. LOB MSI uses the MDM agent (OMA-DM) instead of the Intune Management Extension, avoiding known session-impersonation failures on pure Entra-joined devices accessed via RDP.

The agent reads its configuration from the script-written %ProgramData%\Roots\config.json from Step 2; there is no per-device wiring.

Upload to Intune

Apps > Windows > Add > Line-of-business app. Upload Roots.msi. If you have separate x64 and arm64 fleets, create one LOB app entry per architecture and target each with Intune’s architecture requirement filter.

Intune auto-reads the MSI’s:

• Version
• Product code
• Install/uninstall commands
• Detection rule

No manual configuration needed for any of those. Set:

• Name: Roots (or Roots (Windows) to disambiguate from a Mac entry)
• Publisher: Arbium
• Assignment: Required, scoped to the pilot device group

What gets installed on the device

• Binary at C:\Program Files\Roots\Roots.exe.
• A per-user scheduled task that starts the agent at user logon. The MSI registers an Active Setup stub, so each user gets their per-user task installed automatically on first interactive logon after the package lands — no per-user touch from IT.
• Runtime telemetry via Sentry (when SentryDsn is configured) — no local file logs.
• Config read from %ProgramData%\Roots\config.json (and/or ROOTS_-prefixed env vars if you went that route in Step 2).

Definition of done

• LOB app(s) assigned to the pilot device group.
• No deployment errors in the Intune Apps blade.

Install confirmation happens in Step 4 once a test user is picked.

Next

4. Smoke test.