How do I deploy a Device Agent in an on-prem environment?

This article describes how to deploy a Device Agent when using an on-premise environment, including how to connect devices that do not have direct connectivity to the internet.

Before you begin

• Your on-premise environment is set up and running.
• At least one Scanner Appliance is available if devices need to connect via proxy.
• Firewalls and routers need to be configured, so that machines running Device Agent can connect to the on-premise core machine on port 8085.
• A certificate issued by a trusted Certificate Authority (CA) must be installed on the on-premise core machine so that machines running Device Agent can connect to it.
• If the on-premise core machine uses a self-signed certificate instead, that is, a TLS/SSL certificate signed with its own private key rather than by a trusted third-party CA, that certificate must also be installed on the Device Agent host.
  
  

Deploy a Device Agent

1. Log in to Security Center.
2. Click Assets > Devices in the main menu.
3. Click +New Devices.
4. Create a token:
   • Name: a descriptive name for the token.
   • Valid from: the date the token becomes active.
   • Duration: how long the token stays valid. Keep this as short as possible for security reasons.
5. Select a deployment method:
   • Manual installation: download the Microsoft Windows MSI package and select your token during installation.
   • Mass deployment: deploy using Microsoft Intune, Microsoft Endpoint Configuration Manager, or Group Policy.
6. If the device does not have direct connectivity to the internet, configure the proxy settings during installation and select your Scanner Appliance as the proxy target.
7. Done!