---
title: MDM deployment
sidebar:
  label: Overview
description: Roll the scanner out to every laptop through your device-management tool. Nobody has to sign in.
---

With MDM deployment, each laptop enrolls on its own. You create one **enrollment token** in the console, give it to your MDM, and deploy the package to the same laptops. Each laptop uses the token once, then gets its own permanent credential.

```mermaid
flowchart LR
  A[Create enrollment token<br/>in the console] --> M[Add it to your MDM]
  M --> L1[Laptop 1 enrolls]
  M --> L2[Laptop 2 enrolls]
  M --> L3[Laptop 3 enrolls]
```

## Before you begin

- You have the **Owner** or **Admin** role in Surface, to create the enrollment token.
- You can add scripts, profiles, or packages to your MDM and assign them to a device group.
- The laptops meet the [requirements](/surface/deploy/requirements).

## What the MDM delivers

| Setting | Required | What it does |
| --- | --- | --- |
| Enrollment token | Yes | Lets the laptop join your organization |
| User email | No | Shows the person's email next to the hostname in the console. Never creates an account |
| User full name | No | Shown in the console |

There is no server setting. The installer already points at SuperAlign.

## The two ways to deliver the token

**Pre-filled install script.** On the console's **Downloads** page, download `install.sh` or `install.ps1`. The token is already inside. Upload it to your MDM's script library and run it as root (macOS, Linux) or SYSTEM (Windows). Simplest, and enough for most fleets.

**Managed configuration.** Push the token as a setting your MDM writes to the laptop, and deploy the plain package separately. The setting survives reinstalls. The per-platform pages below show the exact keys.

You can combine both. Ordering does not matter: if the package lands before the token, enrollment retries on the next scan.

1. **Create an enrollment token**

    In the console, open **Downloads**, stay on **MDM / Enterprise**, and click **New token**. Give it a name and an expiry. See [Enrollment tokens](/surface/admin/enrollment-tokens).

2. **Configure your platform**

    <CardGroup cols={3}>
      <Card title="macOS" href="/surface/deploy/mdm/macos" icon="apple">
        Jamf, Kandji, Mosyle, Intune. Configuration profile keys.
      </Card>
      <Card title="Windows" href="/surface/deploy/mdm/windows" icon="monitor">
        Intune and Group Policy. Registry keys.
      </Card>
      <Card title="Linux" href="/surface/deploy/mdm/linux" icon="terminal">
        A managed file. Debian and RPM packages.
      </Card>
    </CardGroup>

3. **Deploy the package**

    Assign the package or the pre-filled script to the same laptops.

4. **Verify**

    Laptops appear on **Endpoints** within one scan interval, with the user email you supplied. On a laptop, `sudo surface status` shows the organization name.

## Also deploy the browser extension

If you plan to record sessions from AI websites, force-install the Surface Chrome extension alongside the scanner. See [Browser extension](/surface/deploy/mdm/browser-extension).

## Next steps

- [Users and roles](/surface/admin/users-and-roles): laptops get the role of the person they are assigned to
- [Update and uninstall](/surface/scanner/update-and-uninstall): upgrades through the same policy