Deploying with MDM
For fleets, the Endpoint Suite reads a managed configuration file that your device management tool can place on each machine. It pins behaviour so that individual users cannot undo your rollout.
Where the file goes
- macOS: under
/Library, in the location your MDM normally uses for managed app configuration. - Windows:
C:\ProgramData\Sentilai\managed-config.json.
What you can pin
- Environment — which Sentilai environment this fleet belongs to.
- Start at login — force the app to launch with the session.
- Automatic governing — force new tools and MCP servers to be governed as they appear.
- Restrictions, three separate switches:
allow_signout— whether the user may sign out.allow_disconnect— whether the user may disconnect a governed tool.allow_ungovern_mcp— whether the user may stop governing local MCP servers.
How restrictions behave
Each is enforced in two places: the underlying command refuses, and the button disappears from the interface with an explanation that the setting is managed by your organization. Enforcing only in the UI would be theatre; enforcing only in the command layer would leave buttons that fail confusingly.
A sensible rollout
- Pilot on a handful of machines with nothing pinned, so people can undo things and tell you what broke.
- Then pin start at login and automatic governing — the two that make governance stick without taking anything away.
- Only pin the restrictions once your policy is stable. A developer who cannot disconnect a tool that is genuinely misbehaving will open a ticket with you instead, so make sure you want that traffic.