# Deploy DVE Agent with Microsoft Intune

This guide covers Windows x64 deployment using Microsoft Intune Win32 app packaging. macOS Intune deployment can reuse `install-dve-agent.sh` via shell script deployment; Jamf is often preferred for Mac fleets.

## Prerequisites

- Intune Administrator or Application Manager role
- Windows 10/11 x64 devices enrolled in Intune
- [Microsoft Win32 Content Prep Tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) installed on a packaging workstation
- DVE backend with `AGENT_VERSION` and `AGENT_DOWNLOAD_BASE_URL` configured
- Outbound HTTPS from clients to DVE API and download host

## Step 1: Download the Windows installer

Fetch the manifest and download the Windows artifact:

```powershell
$BaseUrl = "https://your-dve.example.com"
$manifest = Invoke-RestMethod -Uri "$BaseUrl/api/deployment/agent-manifest"
$downloadUrl = $manifest.manifest.download_urls.windows_x64
Invoke-WebRequest -Uri $downloadUrl -OutFile "dve-agent-windows-x64.exe"
```

Verify checksum using `manifest.checksum_url` before packaging.

## Step 2: Create silent install wrapper

Package the EXE with a detection-friendly install command. Adjust silent flags to match your signed installer:

```powershell
# install.cmd (example)
dve-agent-windows-x64.exe /S /D=C:\Program Files\PhantomKey\DVE Agent
```

Test silently on a VM before Intune upload.

## Step 3: Package as Win32 app

```powershell
IntuneWinAppUtil.exe -c C:\dve-agent-package -s install.cmd -o C:\dve-agent-intune -q
```

Upload the resulting `.intunewin` file in Intune.

## Step 4: Create Intune Win32 app

1. **Apps → Windows → Add → Windows app (Win32)**.
2. **App information:** Name `PhantomKey DVE Agent`, publisher `PhantomKey Technologies`.
3. **Program:**
   - Install command: `install.cmd` or direct EXE silent switches
   - Uninstall command: per your installer documentation
   - Install behavior: **System**
   - Device restart behavior: **No specific action**
4. **Requirements:** Windows 10 1809+ , x64 architecture.
5. **Detection rules:**
   - **Rule type:** File
   - **Path:** `C:\Program Files\PhantomKey\DVE Agent`
   - **File or folder:** `DVE Agent.exe`
   - **Detection method:** File or folder exists
6. **Dependencies:** None unless .NET/runtime prerequisites apply to your build.

Alternative detection — PowerShell script:

```powershell
Test-Path "C:\Program Files\PhantomKey\DVE Agent\DVE Agent.exe"
```

## Step 5: Assign to groups

1. Assign **Required** to all users/devices that need DVE credential access.
2. Pilot with a small Azure AD group before broad rollout.
3. Use `Install-DveAgent.ps1` in a Proactive Remediation for version upgrades.

## Step 6: Configure DVE deployment settings

In DVE admin (IT Admin or Super Admin):

```json
PUT /api/orgs/{org_id}/deployment/config
{
  "deployment_mode": "mdm",
  "mdm_platform": "intune",
  "mdm_notes": "Win32 app ID: <your-intune-app-id>"
}
```

Confirm agent-required policy via `POST /api/orgs/{org_id}/deployment/confirm-agent-policy`.

## Automated upgrade path

Schedule a Proactive Remediation running `Install-DveAgent.ps1` with `DVE_API_BASE_URL` set. The script compares local version to manifest and reinstalls when outdated.

## Troubleshooting

| Issue | Fix |
|-------|-----|
| App stuck "Installing" | Review Intune Management Extension logs (`IntuneManagementExtension.log`) |
| Detection fails | Broaden detection rule; confirm install path matches package |
| Checksum error | Re-download from current manifest |
| Users lack credentials | Verify agent running in system tray; user must unlock with passphrase |

## API reference

- Public manifest: `GET /api/deployment/agent-manifest`

See [overview.md](overview.md).