Microsoft Intune (MDM)

The silent installation and deployment instructions for AppViewX Agent Identity Security Shadow AI Agent Detection on managed Windows endpoints. It describes how to deploy and configure the detection agent at scale using Microsoft Intune Win32 application deployment.

Prerequisites

Ensure the following are available before starting the deployment.
  1. To obtain the required installation .zip files, reach out to the AppViewX team.
  2. A Microsoft Intune administrator account with permissions to create and assign Win32 applications.
  3. Each managed endpoint must have outbound HTTPS access to the Agent Identity Security Platform (https://ais.appvx.com). Ensure that VPN, firewall, proxy, and TLS inspection policies permit this connection.

Installation steps

Deploy the Agent Identity Security Shadow AI Agent Detection on managed Windows endpoints in three steps: generate a bootstrap token, create the Win32 application in Intune, and verify the deployment.

Step 1: Generate a bootstrap token in AppViewX Agent Identity Security

Agent Identity Security Shadow AI Agent Detection requires a bootstrap token to complete its initial enrolment with the Agent Identity Security Platform. During installation, the token authenticates the endpoint and allows the Agent Identity Security Platform to issue an API key per device.
  1. Go to the Settings page in the Agent Identity Security Platform.
  2. Navigate to the API Keys section.
  3. Select Generate Bootstrap Token.
  4. Create a bootstrap token.
  5. Copy and securely store the generated bootstrap token.
    Important: You will need this token when configuring the installation command in Step 2.2. Store it securely do not embed it in shared scripts or source control.

Step 2: Create a Win32 application in Microsoft Intune

Create and configure the Agent Identity Security Shadow AI Agent Detection Win32 application package in Microsoft Intune before assigning it to device groups.
  1. Sign in to your Microsoft Intune account.
  2. In the left navigation panel, select Apps.
  3. Select Windows.
  4. Select + Create.
  5. Under Platform, select Windows.
  6. Under App Type, select Windows app (Win32).
  7. Select Select app package file.
  8. Upload the ais-shadow-ai-agent-detection-install.intunewin package.
  9. Select OK.
  10. Enter the application name, description, publisher, and version.
  11. Select Next and complete the upload process.

Continue with the sub-steps below to complete the application configuration:

Step 2.1: Enter app information

Complete the App Information page to identify the application in Microsoft Intune.
On the App Information page, complete the following fields:
Field Value
Name Enter a descriptive name for the application, for example, Agent Identity Security Shadow AI Agent Detection.
Description Detects and reports shadow AI agent activity on Windows endpoints to the AppViewX Agent Identity Security (Agent Identity Security) platform.
Publisher AppViewX
App Version Enter the version number of the package being deployed, for example, 0.1.0.
Category Select one or more categories that reflect the application type, for example, Computer Management.
Developer Enter the responsible team or administrator name.
Note: The remaining fields Information URL, Privacy URL, Owner, Notes, and Logo may be left blank or completed according to your organisational standards.

Step 2.2: Configure program details

Set the installation and uninstallation commands, return codes, and device restart behavior for the Win32 application.
  1. On the Program page, set Installer type to Command line.
  2. In the Install command field, enter the command that matches your network configuration.

    Standard installation for endpoint machines with standard network access:

    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ais-shadow-ai-agent-detection-install.ps1 -TenantSubdomain "prodtest" -BootstrapToken "<YOUR_BOOTSTRAP_TOKEN>" -AllowDirectFallback

    Example:

    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ais-shadow-ai-agent-detection-install.ps1 -TenantSubdomain "acme" -BootstrapToken "ais_bt_v1_xxxxxxxxxxxxxxxx_xxxxxxxxxxxxx" -AllowDirectFallback

    Proxy-enabled installation for endpoint machines that require an enterprise proxy for network access:

    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ais-shadow-ai-agent-detection-install.ps1 -TenantSubdomain "prodtest" -BootstrapToken "<YOUR_BOOTSTRAP_TOKEN>" -ProxyMode "CustomConfig" -ProxyUrl "http://PROXY_FQDN:PORT" -DisableDirectFallback

    Example:

    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File ais-shadow-ai-agent-detection-install.ps1 -TenantSubdomain "prodtest" -BootstrapToken "ais_bt_v1_xxxxxxxxxxxxxxxx_xxxxxxxxxxxxx" -ProxyMode "CustomConfig" -ProxyUrl "http://proxy.example.com:8080" -DisableDirectFallback

    The following optional parameters control detection behavior:

    Parameter Default Purpose
    -ScanIntervalSeconds <n> 15 Seconds between detection scans. Lower values provide faster detection but increase API calls; higher values reduce load.
    -DnsPollIntervalSeconds <n> 2 Seconds between background DNS-event checks for short-lived custom-agent activity. Lower values catch shorter-lived signals more reliably; higher values reduce overhead.
    -DetectionHistoryWindowSeconds <n> 120 Detection history window in seconds. Each portal history row covers at most this span. Allowed range: 60–3600. Distinct signals are kept; only exact repeats inside the window collapse. In-memory event-log buffers stay capped so a longer window cannot exhaust endpoint memory.
  3. In the Uninstall command field, enter: 
    powershell.exe -NoProfile -ExecutionPolicy Bypass -File ais-shadow-ai-agent-detection-uninstall.ps1
  4. Set the remaining program options as follows:
    Setting Value
    Installation time required (mins) 5
    Allow available uninstall Yes
    Install behavior System
    Device restart behavior No specific action
    Return codes Retain the default Intune return codes: 0 = Success, 1 = Failed, 3010 = Soft reboot, 1641 = Hard reboot, 1618 = Retry.

Step 2.3: Configure requirements

Specify the operating system architecture and minimum version required to install the Agent Identity Security Shadow AI Agent Detection package.
On the Requirements page, configure the following:
Setting Value
Operating system architecture Select Yes Specify the systems the app can be installed on, then select both 32-bit and 64-bit.
Minimum operating system Select the minimum supported Windows version, for example, Windows 10 2004 or later.
Note: Leave Disk space required, Physical memory, Minimum logical processors, and Minimum CPU speed empty unless your deployment has specific hardware requirements. Do not add additional requirement rules unless specified by your deployment team.

Step 2.4: Configure detection rules

Upload a custom detection script so that Intune can determine whether the Agent Identity Security Shadow AI Agent Detection application is installed on each endpoint.
  1. On the Detection rules page, set Rules format to Use a custom detection script.
  2. Under Upload detection script, upload ais-shadow-ai-agent-detection-detect.ps1.
  3. Set the remaining detection options as follows:
    Setting Value
    Run script as 32-bit process on 64-bit clients No
    Enforce script signature check and run script silently No (unless your organisational policy requires script signing).
    Note: The detection script checks for the presence of the installed marker file and registry configuration under HKLM:\SOFTWARE\AppViewX\Agent Identity Security. Intune uses the script exit code to determine whether the application is installed.

Step 2.5: Configure assignments

Assign the Win32 application to the target device group for deployment.
  1. On the Assignments page, under Required, select + Add group.
  2. Add the required device group for deployment.
  3. After confirming the assignments, select Next to continue to the review stage.

Step 2.6: Review and save

Verify all configuration settings before saving the Win32 application in Microsoft Intune.
  1. On the Review + save page, verify the following before saving:
    Setting What to confirm
    Install command The PowerShell command is complete and contains the correct tenant-specific values.
    Uninstall command ais-shadow-ai-agent-detection-uninstall.ps1 is present.
    Requirements The operating system architecture and minimum version are correct.
    Detection script ais-shadow-ai-agent-detection-detect.ps1 is uploaded.
    Install behavior Set to System and no device restart is required.
    Tenant-specific values TenantSubdomain and BootstrapToken have been replaced with the correct production values.
  2. Select Save to create the application.

After the application is created, complete the following steps before broad deployment:

  1. Assign the application to a test device group.
  2. Verify successful installation by checking the Intune device install status.
  3. Verify that the detection status confirms the application is detected as installed.
  4. Validate uninstall by removing the assignment and confirming clean removal.
  5. Confirm agent registration by verifying that the endpoint appears under Agents > Endpoint Agents in the Agent Identity Security Platform after the scheduled task starts.

Step 3: Verify deployment

After deployment, confirm that the agent is installed on the test endpoint, that it has enrolled with the Agent Identity Security Platform, and that shadow AI detection activity is visible.
  1. Verify the installation status in Microsoft Intune.

    In Microsoft Intune, navigate to Apps and select the application to view the device installation status. Confirm that the test device shows Installed.

  2. Verify Shadow AI discovery in the Agent Identity Security Platform.

    In the Agent Identity Security Platform, navigate to Registry > Unmanaged Agents and confirm that the test endpoint hostname appears. This confirms successful enrolment.

  3. Verify detection activity in the Agent Identity Security Platform.

    In the Agent Identity Security Platform, confirm that shadow AI activity detected by the agent is visible within the first scan cycle (typically within 30 seconds of the scheduled task starting). Also confirm that Device install status in Intune shows Installed for the test device.