MDM deployment
Roll the scanner out to every laptop through your device-management tool. Nobody has to sign in.
With MDM deployment, each laptop enrolls on its own. You create one enrollment token in the console, give it to your MDM, and deploy the package to the same laptops. Each laptop uses the token once, then gets its own permanent credential.
Before you begin
- You have the Owner or Admin role in Surface, to create the enrollment token.
- You can add scripts, profiles, or packages to your MDM and assign them to a device group.
- The laptops meet the requirements.
What the MDM delivers
| Setting | Required | What it does |
|---|---|---|
| Enrollment token | Yes | Lets the laptop join your organization |
| User email | No | Shows the person’s email next to the hostname in the console. Never creates an account |
| User full name | No | Shown in the console |
There is no server setting. The installer already points at SuperAlign.
The two ways to deliver the token
Pre-filled install script. On the console’s Downloads page, download install.sh or install.ps1. The token is already inside. Upload it to your MDM’s script library and run it as root (macOS, Linux) or SYSTEM (Windows). Simplest, and enough for most fleets.
Managed configuration. Push the token as a setting your MDM writes to the laptop, and deploy the plain package separately. The setting survives reinstalls. The per-platform pages below show the exact keys.
You can combine both. Ordering does not matter: if the package lands before the token, enrollment retries on the next scan.
Create an enrollment token
In the console, open Downloads, stay on MDM / Enterprise, and click New token. Give it a name and an expiry. See Enrollment tokens.
Configure your platform
Deploy the package
Assign the package or the pre-filled script to the same laptops.
Verify
Laptops appear on Endpoints within one scan interval, with the user email you supplied. On a laptop, sudo surface status shows the organization name.
Also deploy the browser extension
If you plan to record sessions from AI websites, force-install the Surface Chrome extension alongside the scanner. See Browser extension.
Next steps
- Users and roles: laptops get the role of the person they are assigned to
- Update and uninstall: upgrades through the same policy