Endpoint Agent - Intune Deployment

Deploy the FireTail Endpoint Agent to your Windows fleet with Microsoft Intune. The MSI installs the agent as a Windows service running as LocalSystem and, by default, installs the FireTail root CA into the machine trust store. Both operations require the installer to run in the device (SYSTEM) context, which Intune does automatically when the assignment target is a device group.

You will need:

The FireTail Endpoint Agent MSI: FireTail_Agent_x86_64.msi
A FireTail project token. How to generate a project token.
An Intune administrator account with permission to create apps and configuration profiles.

MSI properties

The MSI accepts the following properties. Pass them on the msiexec command line for a silent install.

Property	Required	Default	Description
`TOKEN`	Yes	-	FireTail project token. The token prefix (`FTPSB`, `FTPST`, `FTPPREU`, `FTPPRUS`) selects the SaaS environment.
`PROXY_PORT`	No	`8081`	Local port the agent uses to proxy traffic.
`API_PORT`	No	`8085`	Local port for the agent's management API.
`INSTALL_CERT_FLAG`	No	`-install_cert`	Set to empty (`INSTALL_CERT_FLAG=""`) to skip installing the FireTail root CA. Only do this if the CA is already provisioned via a separate policy - the installer will fail if a trusted FireTail CA cannot be verified after install.
`OVERWRITE_CERTS_FLAG`	No	`-overwrite-certs`	Set to empty (`OVERWRITE_CERTS_FLAG=""`) to preserve any existing FireTail CA in the trust store instead of replacing it.
`INTERCEPT_MODE`	No	`proxy`	Traffic interception mode. `proxy` uses the Windows system proxy; `transparent` (beta) captures traffic at the network interface, which also covers WSL and command-line tools.

Devices deployed with INTERCEPT_MODE=transparent need the FireTail CA trusted inside WSL and by any Node.js tooling before those clients can connect. See Trusting the FireTail CA in WSL and developer tools, and distribute the certificate and environment variables with an Intune configuration profile.

Recommended: Deploy as a Line-of-business app

The MSI is a standard Windows Installer package, so the simplest path is to upload it directly as a Line-of-business (LOB) app in Intune.

In the Microsoft Intune admin center, go to Apps -> Windows -> Create.
For App type, select Line-of-business app, then click Select.
App package file: upload FireTail_Agent_x86_64.msi.
App information: fill in Publisher (FireTail) and any other required fields.
Command-line arguments: enter the following, substituting your token. Do not include msiexec /i FireTailAgent.msi here - Intune adds that automatically.
```
TOKEN=
```
Assignments: assign to a device group as a Required install. Assigning to a user group runs the installer in the user context, which does not have permission to write to the LocalMachine trust store or create a system service - the install will fail.
Click Next -> Create.

Intune will deliver and install the MSI silently on the next device check-in.

Alternative: Deploy as a Win32 app

Deploy as a Win32 app if you need more control over detection rules, requirements, or return codes.

Package the MSI as an `.intunewin` file

Download the Microsoft Win32 Content Prep Tool.
Place FireTail_Agent_x86_64.msi in a source folder, e.g. C:\firetail-source\.

Run:

.\IntuneWinAppUtil.exe -c C:\firetail-source -s FireTail_Agent_x86_64.msi -o C:\firetail-output

This produces FireTail_Agent_x86_64.intunewin.

Create the Win32 app in Intune

In the Intune admin center, go to Apps -> Windows -> Create and select Windows app (Win32).
App package file: upload FireTail_Agent_x86_64.intunewin.

Program:

Install command:

msiexec /i "FireTail_Agent_x86_64.msi" TOKEN= /qn /L*v "%ProgramData%\FireTail\install.log"

Uninstall command:

msiexec /x "{c5f1f3c1-2b27-4f8e-8b2a-0c7a8cb6e1f7}" /qn

Install behavior: System.
Device restart behavior: No specific action.

Requirements:
- Operating system architecture: x64.
- Minimum operating system: Windows 10 1809 or later.
Detection rules: select Manually configure detection rules, then add an MSI rule:
- MSI product code: {c5f1f3c1-2b27-4f8e-8b2a-0c7a8cb6e1f7}
- MSI product version check: No.
Assignments: assign to a device group as a Required install.
Click Next -> Create.

Verifying the deployment

On a target device:

Confirm the service is running:
```
Get-Service FireTailAgent
```
Status should be Running, StartType Automatic.

Confirm the FireTail root CA is present in the machine trust store and matches the CA on disk:

Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -like "*FireTail*" } | Select-Object Thumbprint, Subject, NotAfter
(Get-PfxCertificate -FilePath C:\ProgramData\FireTail\ca-cert.pem).Thumbprint

The thumbprints should match.

Or let the installer verify the trust chain for you:

& "C:\Program Files\FireTail\firetail-installer.exe" -verify_cert

Check the install log at %ProgramData%\FireTail\install.log if the deployment reports failure.
Interact with an AI provider on the device and confirm events appear in the FireTail platform.

Troubleshooting

The install reports success but HTTPS breaks on the device. The service is intercepting traffic with a CA the machine does not trust. Some MDM/RMM contexts silently fail the trust store write. Re-deploy with INSTALL_CERT_FLAG=-install_cert OVERWRITE_CERTS_FLAG=-overwrite-certs (the defaults) and confirm the assignment targets a device group, not a user group. See Endpoint Agent - Certificate handling for background.

Intune reports error 0x80070652. Another MSI install is in progress. Wait for it to finish and retry.

Intune reports error 1603. A fatal error during install. Retrieve %ProgramData%\FireTail\install.log from the device (or the IntuneManagementExtension.log under C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\) and inspect the tail for the failing custom action.