Deploying with MDM

Roll out the Harriet background agent across a fleet with the MDM you already run — Jamf, Kandji, or Munki on macOS, or a scheduled task on Windows. No second daemon is needed: the agent script is self-contained and exits after one run.

How MDM deployment works

MDM deployment uses the same background agent as the interactive install, driven headlessly. Your MDM runs the agent script on a schedule; on each run it authenticates, fetches desired state, applies configuration, and checks in, exactly as described in How sync works. The first run exchanges an enrollment token for the device's permanent credentials; after that the token is ignored.

Get the agent script and an enrollment token from Devices → Connect desktop app in the console (the install package includes both), or from the Manage → Help tab, which mirrors the install commands and MDM notes. Enrollment tokens are single-use and expire after 24 hours, and the install package should be treated like a password.

Environment variables

Headless installs are configured entirely through environment variables:

HARRIET_SERVER=https://harriethq.com     # Required
HARRIET_ENROLLMENT_TOKEN=<token>         # Required for first run; ignored once enrolled
HARRIET_NO_USER_AUTH=1                   # Skip interactive user-auth prompt
HARRIET_CONFIG_DIR=/etc/harriet-prov     # Override config dir (e.g. system-wide location)
HARRIET_COWORK=openwork                  # Optional: provision Harriet Desktop instead of (or alongside) Claude

HARRIET_NO_USER_AUTH=1 matters for MDM: it skips the interactive linking prompt so the script never blocks waiting for a person. Linking happens separately (see below).

macOS: Jamf, Kandji, Munki

Jamf Pro

1. Upload the agent script as a Jamf script (Category: IT Configuration).
2. Set HARRIET_NO_USER_AUTH=1 as a script parameter or environment variable.
3. Create a policy triggered by Recurring Check-In (for example, every 15 minutes).
4. Scope it to your macOS devices.

Kandji

1. Add a Custom Script library item with the agent script content.
2. Set execution frequency to "Run on a schedule" (for example, every 15 minutes).
3. Set HARRIET_NO_USER_AUTH=1 in the environment.

Munki

1. Create a nopkg that deploys the agent script to /usr/local/bin/harriet-agent.sh.
2. Ship a LaunchDaemon (or the provided LaunchAgent plist) that runs it at StartInterval 900.
3. Pass the env vars via the plist EnvironmentVariables key.

Windows

On Windows the installer registers a scheduled task named HarrietProvisionerAgent that runs the agent every 5 minutes. The install one-liner (PowerShell, irm … | iex form) comes from the console's install package or the Help tab; it saves the agent under the user's .harriet directory, registers the task, and runs once. The agent requires Python 3 on PATH. For fully scripted rollouts, the same PowerShell agent can be run on a schedule of your own with the environment variables above.

Linking people to MDM-installed devices

Because HARRIET_NO_USER_AUTH=1 skips the interactive prompt, MDM-deployed devices start out unlinked and appear in the needs-attention banner. To link them, a person visits the device link page while signed in to Harriet and enters the code shown by running the agent manually once on that machine. Alternatively, IT can link devices from the admin console. The mechanics of the code flow are in Linking with a code.