Deploying with MDM

For fleets, the Endpoint Suite reads a managed configuration file that your device management tool can place on each machine. It pins behaviour so that individual users cannot undo your rollout.

Where the file goes

• macOS: under /Library, in the location your MDM normally uses for managed app configuration.
• Windows: C:\ProgramData\Sentilai\managed-config.json.

What you can pin

• Environment — which Sentilai environment this fleet belongs to.
• Start at login — force the app to launch with the session.
• Automatic governing — force new tools and MCP servers to be governed as they appear.
• Restrictions, three separate switches:
  • allow_signout — whether the user may sign out.
  • allow_disconnect — whether the user may disconnect a governed tool.
  • allow_ungovern_mcp — whether the user may stop governing local MCP servers.

How restrictions behave

Each is enforced in two places: the underlying command refuses, and the button disappears from the interface with an explanation that the setting is managed by your organization. Enforcing only in the UI would be theatre; enforcing only in the command layer would leave buttons that fail confusingly.

A sensible rollout

1. Pilot on a handful of machines with nothing pinned, so people can undo things and tell you what broke.
2. Then pin start at login and automatic governing — the two that make governance stick without taking anything away.
3. Only pin the restrictions once your policy is stable. A developer who cannot disconnect a tool that is genuinely misbehaving will open a ticket with you instead, so make sure you want that traffic.