Skip to content

Configuring Endpoint Agents

You can configure SailPoint Endpoint Agent Security to discover and monitor AI agent software that is installed and running on your organization's managed laptops and desktops. SailPoint's endpoint agent runs as a background service with little interaction. Discovered agents, MCP servers, credentials, and related non-human identities are added to the Agentic Fabric for users to review.

Generating Deployment Artifacts

To deploy the endpoint agent in your MDM provider, you will generate the following artifacts in Agentic Fabric:

Platform Installer Tenant Configuration
macOS (Jamf) .pkg installer package .mobileconfig configuration profile
Windows (Intune) A 64-bit MSI, packaged as an .intunewin file for Intune Set-SeasPolicy-<tenant>.ps1, deployed as a platform script

Note

You can only generate the artifacts for one provider at a time. If your organization manages both macOS and Windows devices, you can generate the artifact for the second provider after Agentic Fabric is activated. In Identity Security Cloud, go to Admin > Global > Agent Settings.

To generate deployment artifacts:

  1. In the Endpoint Agent section, select your organization's MDM provider.

  2. Enter a name for the endpoint agent in the Name field.

  3. Select Generate Deployment Packages to generate an installer package and configuration profile.

  4. Select Download for both files.

  5. Give the files to your MDM administrator.

  6. Provide the deployment guide for your MDM provider to your MDM administrator.

Allowlisting the Endpoint Agent

Some endpoint security software blocks or quarantines unrecognized agents. If your organization uses endpoint detection and response (EDR) software or application control policies, use the values below to allow SailPoint Endpoint Agent Security before you deploy it.

macOS

SailPoint Endpoint Agent Security is signed with SailPoint's Apple Developer ID and notarized by Apple. The agent requires Full Disk Access to inventory AI agent software on the endpoint. The configuration profile you deploy grants this automatically. Use these values to allowlist the agent in your endpoint security software.

Item Value
Apple Developer Team ID PRR7PT27AH
Signing authority Developer ID Certification Authority
Notarized Yes
Bundle identifier com.sailpoint.seas.daemon
Required privacy permission Full disk access
Install path /Applications/Seas.app
LaunchDaemon label com.sailpoint.seas.daemon
com.sailpoint.seas.cloud-agent
com.sailpoint.seas.spire-agent

Windows

SailPoint Endpoint Agent Security is code-signed. Use these values to allowlist the agent in your endpoint security software and to create publisher rules in App Control for Business or AppLocker. Publisher rules are recommended over file hash rules, because the file hash changes with every release while the signing certificate does not.

Item Value
Certificate subject (full distinguished name) CN="SailPoint Technologies Inc"

O="SailPoint Technologies Inc"

L=Austin

S=Texas

C=US
Leaf certificate common name (CN) CN = SailPoint Technologies, Inc
Issuing certificate authority CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

O="DigiCert, Inc."

C=US
Certificate thumbprint (SHA-256) 7CC623B9327E93CE35ED24F0E758CE9160DE634E011E39398DDFC05343B69354
Product name SailPoint Endpoint Agentic Security (version 0.1.1.0)
Install path Program Files:
• %PROGRAMFILES%\SailPoint Technologies\Seas

ProgramData:
• %PROGRAMDATA%\SailPoint Technologies\Seas

Subfolders:
• db, logs, spire (under ProgramData)
• support (under Program Files)
Windows services 1. Seas
• Display name: SailPoint Endpoint Agentic Security (Auto start)

2. SeasCloudAgent
• Display name: SailPoint Endpoint Agentic Security Cloud Agent (Auto start)

3. SeasSpireAgent
• Display name: SailPoint Endpoint Agentic Security Identity Agent (Auto start)

Network (All Platforms)

The agent makes outbound connections only and requires no inbound ports. Allow the following from managed endpoints. These requirements are the same on macOS and Windows.

Purpose Protocol Port Destination
Enrollment HTTPS (TLS 1.2+; Web PKI server cert) 443 SAF-AWS Backend
SPIRE server (workload identity) gRPC over TCP 8081 SAF-AWS Backend
Receiver service gRPC over TLS with mTLS 7300 SAF-AWS Backend

Deploying Endpoint Agent Security

Endpoint Agent Security can be deployed to macOS devices via JamfPro or Windows devices via Intune.

Deploying Endpoint Agent Security to macOS via Jamf Pro

Before you deploy the endpoint agent, ensure you have the following:

  • An Agentic Fabric tenant with SailPoint Endpoint Agent Security enabled.

  • A SAF Admin role that can generate deployment artifacts.

  • MDM administrator access - Jamf Pro for macOS.

  • macOS Tahoe 26 or later

To deploy the endpoint agent to macOS through JamfPro:

  1. Upload and scope the configuration profile:

    • In Jamf Pro, upload the .mobileconfig as a configuration profile. It installs a custom payload on the endpoint carrying the configuration values and the enrollment token.

    • Scope the profile to the target computers or group.

      Important

      The endpoint agent reads its configuration on its first run, so the configuration profile must be present on the device before the package is installed.

  2. Upload the package:

    • Go to Packages > New.

    • Browse and select the SEAS package and save.

      Jamf stores it in its distribution repository so it can be deployed by a policy.

  3. Create the install policy:

    • Go to Policies > New and name the policy.

    • Set the trigger to Recurring Check-in.

    • Set the Execution Frequency:

      • Use Ongoing for a security agent, so it reinstalls automatically if it is ever removed.

      • Use Once per computer for a simple one-time push.

    • Add the SEAS package to the policy payload with the action set to Install.

    • Add an Update Inventory step, so Jamf registers the installed app after the policy runs.

    • Scope the policy to the target computer or group.

    • Add an exclusion for computers that do not have the SEAS configuration profile installed (implemented with a smart group), so the agent never launches without its configuration.

    • Select Save.

Creating a Self-Heal Smart Group

SailPoint recommends making the deploying self-healing as Endpoint Agent Security has no built-in anti-tamper protection. A user with administrator/sudo rights could remove it.

To make the deployment self-healing, create a smart group of computers that do not have Endpoint Agent Security installed and scope an Ongoing install policy to it. On the next inventory after removal, the machine reenters the group, and the agent is reinstalled. As an additional layer, EDR tamper protection can be enforced through the configuration profile to block removal.

Verifying Enrollment in Jamf

  1. In Jamf, confirm the install policy ran on the device and that the SailPoint Endpoint Agent Security app appears in the device's inventory (Applications).

  2. Confirm the agent is running on the endpoint. It runs silently with no UI.

Deploying Endpoint Agent Security to Windows via Intune

Before you deploy the endpoint agent, ensure you have the following:

  • An Agentic Fabric tenant with SailPoint Endpoint Agent Security enabled.

  • A SAF Admin role that can generate deployment artifacts.

  • MDM administrator access - Microsoft Intune, with permission to create apps and platform scripts.

  • Supported OS: Windows 11 only.

  • Devices enrolled in Intune.

Deploying the endpoint agent to Windows requires two Intune assignments targeting the same device group: a Win32 app that installs the agent and a platform script that applies your tenant configuration. Assign both. They can be added in either order.

Adding the Win32 app

  1. In the Microsoft Intune admin center, go to Apps > Windows > Add.

  2. For App type, select Windows app (Win32). Do not deploy the agent as a line-of-business app.

  3. Upload the .intunewin package you downloaded from Agentic Fabric.

  4. On the Program page, confirm that the install command ends with /qn so the installation runs silently. Intune populates the install and uninstall commands from the package.

  5. Set Install behavior to System.

  6. On the Detection rules page, select Manually configure detection rules, then add a rule of type MSI. Intune populates the MSI product code from the package.

  7. Complete the remaining pages and select Create.

Adding the Tenant Policy Script

  1. Go to Devices > Scripts and remediations > Platform scripts > Add > Windows 10 and later.

  2. Upload Set-SeasPolicy-<tenant>.ps1.

  3. Set Run this script using the logged on credentials to No. The script must run as SYSTEM.

  4. Set Run script in 64-bit PowerShell host to Yes.

  5. Complete the remaining pages and select Add.

Assigning the Win32 App and Script to the Same Device Group

  1. Assign the Win32 app to your target device group.

  2. Assign the platform script to the same device group.

The agent installs three Windows services that start automatically. Until the tenant policy is present, the agent collects inventory locally and does not upload it. Uploads begin once the policy is applied.

Important

The tenant policy script contains your organization's install token. Treat it as confidential and scope both assignments to the narrowest device group required.

Verifying Enrollment in Intune

  1. In Intune, confirm the app installation and script runs both report success.

  2. On a pilot device, confirm the tenant policy is present:

    • reg query "HKLM\SOFTWARE\Policies\SailPoint\Seas" /reg:64

  3. Confirm the Seas, SeasCloudAgent, and SeasSpireAgent services are running.

    • Agent logs are located in %ProgramData%\SailPoint Technologies\Seas\logs\.

    • Installation logs are located in C:\Windows\Temp\seas.

Troubleshooting the Endpoint Agent

  • The agent did not install: Confirm the device is in the policy scope and not caught by an exclusion. Force a check-in and flush policy logs.

  • The agent is installed but not reporting: Confirm the configuration profile is present on the device and that the enrollment token has not expired.

  • The agent keeps getting removed: This is expected if the user has admin/sudo rights. Rely on the self-heal smart group and EDR tamper protection.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.