---
title: Deploy the scanner
sidebar:
  label: Overview
description: Choose how to get the Surface scanner onto your laptops, from a single test machine to a managed fleet.
---

The scanner is a small program that runs in the background on each laptop. Getting it onto laptops has three parts: install the package, enroll the laptop with your organization, and check that it reports.

## Choose a method

<CardGroup cols={3}>
  <Card title="MDM deployment" href="/surface/deploy/mdm/overview" icon="building">
    Jamf, Intune, Kandji, Mosyle, or Group Policy. Laptops enroll on their own. Recommended for fleets.
  </Card>
  <Card title="Install script" href="/surface/deploy/install-script" icon="terminal">
    One command per laptop. Good for pilots and small teams.
  </Card>
  <Card title="Manual install" href="/surface/deploy/manual-install" icon="package">
    Download the .pkg, .msi, .deb, or .rpm and install it yourself.
  </Card>
</CardGroup>

All three install the same package. They differ only in how the laptop gets its credentials.

```mermaid
flowchart TB
  I[Install the package] --> Q{How does the laptop join?}
  Q -->|Enrollment token from MDM| T[Joins on its own]
  Q -->|No token| B[A person signs in once]
  T --> R[Laptop appears on Endpoints]
  B --> R
```

## Before you begin

Read [Requirements](/surface/deploy/requirements) for supported operating systems and the network access the scanner needs. It is short.

## After installation

- The laptop appears on **Endpoints** within a few minutes.
- Its AI tools appear in **Inventory** after the first scan.
- **Insights** updates once risk has been evaluated.

On the laptop itself, `sudo surface status` shows the version, whether the service is running, and the organization it joined.