> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Device Agent

> Set up governed AI routing and endpoint inventory on Windows and macOS.

Forge for devices extends AI governance to managed Windows and macOS devices.
Its installed component, the Device Agent, automatically routes supported
desktop, browser, developer API, and MCP traffic through your organization's
Forge Gateways. It also reports device health and discovers local AI products
and configuration.

Use [agentless network routing](/resources/architecture#agentless-network-routing)
when traffic already passes through a connected firewall, SASE platform, or
secure web gateway. Deploy Forge for devices for off-network coverage, local
applications, and device-level attribution. The two approaches can be used
together.

## Choose a deployment method

| Platform | Deployment method          | When to use it                               |
| -------- | -------------------------- | -------------------------------------------- |
| Windows  | Direct setup bundle        | Individual devices and small pilots          |
| Windows  | Microsoft Intune Win32 app | Managed rollout to Entra device groups       |
| macOS    | Signed release package     | Individual devices and small pilots          |
| macOS    | Jamf or another MDM        | Managed rollout with a configuration profile |

In Forge, open **Settings → Integrations → Forge Device Agent**, select a
platform, and choose direct download or managed deployment. Deployment material
is created for your organization and should only be shared with administrators
responsible for the rollout.

## Windows setup

For a direct installation, download the Windows setup bundle from Forge and run
it as an administrator on the target device. The device appears in Fleet after
it enrolls and sends its first signal.

For Intune:

1. Connect Microsoft Entra and confirm the requested Microsoft Graph access.
2. In Forge, generate the Windows deployment for your organization.
3. Choose **Guided upload** to create the Win32 app using the settings Forge
   provides, or choose **Automated** to let Forge create it after your review.
4. Assign the app as **Required** to a pilot Entra device group.
5. Return to Forge and refresh the deployment to confirm the assignment and
   installed devices.

Forge supplies the package, install and uninstall commands, requirements, and
detection rule as one release. Keep those generated values together rather
than mixing files or settings from different releases.

## macOS setup

The macOS download contains one signed unified installation package and the
setup material needed for the selected deployment method.

For a direct installation, extract the ZIP on the target Mac and open
`Install Forge Device Agent.command`. Approve the signed installer and Forge
Network Extension when macOS asks. The generated package enrolls one device in
the organization for which it was created.

For Jamf:

1. In Forge, choose **Jamf** and download the generated Jamf deployment bundle.
2. Upload the unified signed package as a Jamf computer package.
3. Upload the included `.mobileconfig` as a computer configuration profile and
   scope it to the pilot Macs before the package policy.
4. Add the included Before and After scripts to Jamf. For first enrollment,
   place the bundle's bootstrap token in parameter 4 of the Before script. The
   policy template already contains the Forge URL in parameter 5.
5. Recreate the included policy template, scope it to the same pilot Macs, add
   the included Extension Attribute, and run the policy.
6. Confirm the profile, package receipts, System Extension, authenticated
   heartbeat, inventory, and Extension Attribute readback before expanding the
   scope.

Existing enrolled Macs preserve their device identity during an upgrade and do
not require the bootstrap parameters again. Delete the downloaded bundle after
deployment succeeds because its bootstrap token is sensitive.

The [Jamf Pro integration](/integrations/jamf-pro) is a separate, read-only
connection for computer and owner inventory. It is not required to deploy
Device Agent through Jamf.

## Turn on device routing

After devices enroll, open **Fleet**, select the exact devices you want to
manage, and enable **Device routing**. Forge checks device health and the
routing path before showing the devices as **Active**.

| State                        | What it means                                                            |
| ---------------------------- | ------------------------------------------------------------------------ |
| **Waiting for assignment**   | The deployment has not reached the selected device yet                   |
| **Installing**               | The management platform is delivering or verifying the release           |
| **Waiting for first signal** | Installation was detected, but the device has not enrolled or checked in |
| **Active**                   | The device is healthy and governed routing is ready                      |
| **Update available**         | A newer approved release can be deployed                                 |
| **Needs attention**          | Forge found a setup or health issue that requires action                 |
| **Removal pending**          | Forge is restoring the device's previous networking state                |

Once active, supported AI traffic is routed automatically. Users keep using
their existing applications and provider interfaces; no application-by-
application proxy configuration is required.

## Updates and removal

Deploy the complete release generated by Forge whenever you update Device
Agent. On Windows, publish the new signed Intune app using supersedence or a new
required assignment. On macOS, deploy the new unified package together with
its matching profile and scripts. Forge preserves enrollment during a normal
update and reports the version currently running on each device.

To remove Device Agent, start the removal from Fleet or your management
workflow and wait for the device to restore its previous network settings. On
macOS, remove the MDM-owned configuration profile before uninstalling the
packages.

## Troubleshooting

| What you see                                  | What to check                                                                                                        |
| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Waiting for assignment**                    | Confirm the device belongs to the Intune or Jamf group targeted by the deployment                                    |
| **Waiting for first signal**                  | Confirm the service is running and the device can reach Forge over outbound HTTPS                                    |
| **Needs attention** after an update           | Confirm the package, profile, and generated settings all belong to the same Forge release, then choose **Try again** |
| Device is healthy but traffic does not appear | Confirm Device routing is active for that device and that the test uses a supported AI destination                   |
| The wrong person or device appears            | Refresh the connected Entra, Intune, Jamf, or endpoint inventory source                                              |

For a final check, open the device in **Fleet** and confirm its organization,
version, recent heartbeat, and routing health. Then make a supported test
request and verify that it appears under the appropriate LLM or MCP Gateway
session.