Skip to main content
Forge for devices extends AI governance to managed Windows and macOS devices. Its installed component, the Device Agent, automatically routes supported desktop, browser, developer API, and MCP traffic through your organization’s Forge Gateways. It also reports device health and discovers local AI products and configuration. Use agentless network routing when traffic already passes through a connected firewall, SASE platform, or secure web gateway. Deploy Forge for devices for off-network coverage, local applications, and device-level attribution. The two approaches can be used together.

​
Choose a deployment method

In Forge, open Settings → Integrations → Forge Device Agent, select a platform, and choose direct download or managed deployment. Deployment material is created for your organization and should only be shared with administrators responsible for the rollout.

​
Windows setup

For a direct installation, download the Windows setup bundle from Forge and run it as an administrator on the target device. The device appears in Fleet after it enrolls and sends its first signal. For Intune:
  1. Connect Microsoft Entra and confirm the requested Microsoft Graph access.
  2. In Forge, generate the Windows deployment for your organization.
  3. Choose Guided upload to create the Win32 app using the settings Forge provides, or choose Automated to let Forge create it after your review.
  4. Assign the app as Required to a pilot Entra device group.
  5. Return to Forge and refresh the deployment to confirm the assignment and installed devices.
Forge supplies the package, install and uninstall commands, requirements, and detection rule as one release. Keep those generated values together rather than mixing files or settings from different releases.

​
macOS setup

The macOS download contains one signed unified installation package and the setup material needed for the selected deployment method. For a direct installation, extract the ZIP on the target Mac and open Install Forge Device Agent.command. Approve the signed installer and Forge Network Extension when macOS asks. The generated package enrolls one device in the organization for which it was created. For Jamf:
  1. In Forge, choose Jamf and download the generated Jamf deployment bundle.
  2. Upload the unified signed package as a Jamf computer package.
  3. Upload the included .mobileconfig as a computer configuration profile and scope it to the pilot Macs before the package policy.
  4. Add the included Before and After scripts to Jamf. For first enrollment, place the bundle’s bootstrap token in parameter 4 of the Before script. The policy template already contains the Forge URL in parameter 5.
  5. Recreate the included policy template, scope it to the same pilot Macs, add the included Extension Attribute, and run the policy.
  6. Confirm the profile, package receipts, System Extension, authenticated heartbeat, inventory, and Extension Attribute readback before expanding the scope.
Existing enrolled Macs preserve their device identity during an upgrade and do not require the bootstrap parameters again. Delete the downloaded bundle after deployment succeeds because its bootstrap token is sensitive. The Jamf Pro integration is a separate, read-only connection for computer and owner inventory. It is not required to deploy Device Agent through Jamf.

​
Turn on device routing

After devices enroll, open Fleet, select the exact devices you want to manage, and enable Device routing. Forge checks device health and the routing path before showing the devices as Active. Once active, supported AI traffic is routed automatically. Users keep using their existing applications and provider interfaces; no application-by- application proxy configuration is required.

​
Updates and removal

Deploy the complete release generated by Forge whenever you update Device Agent. On Windows, publish the new signed Intune app using supersedence or a new required assignment. On macOS, deploy the new unified package together with its matching profile and scripts. Forge preserves enrollment during a normal update and reports the version currently running on each device. To remove Device Agent, start the removal from Fleet or your management workflow and wait for the device to restore its previous network settings. On macOS, remove the MDM-owned configuration profile before uninstalling the packages.

​
Troubleshooting

For a final check, open the device in Fleet and confirm its organization, version, recent heartbeat, and routing health. Then make a supported test request and verify that it appears under the appropriate LLM or MCP Gateway session.