Skip to main content

Deploy AI DLP via Microsoft Intune

This guide shows you how to deploy AI DLP to your managed Windows devices from Microsoft Intune. You upload a package Anzenna provides as a Win32 app, supply two values in the install command, and assign it to a device group. Deploying AI DLP installs the Anzenna Update agent, which installs AI DLP and keeps it current automatically.

Prerequisites​

  • Intune admin access with permission to add and assign apps

  • Target devices enrolled in Intune, in a device group

  • Windows 11 24H2 or later, on x64 hardware

  • Target devices reported to Anzenna by a connected MDM or EDR integration (see

    Devices must already be known to Anzenna

    )

  • Your Anzenna domain and its Client Token (see

    AI DLP Overview

    )

  • The .intunewin package, provided by Anzenna support

Required Step

Before beginning deployment, contact Anzenna support to obtain the update-windows-amd64.intunewin package. The package is identical for every customer — your per-tenant values go in your own Intune console, not in the package.

x64 only

The agent is currently built for x64 Windows only. If your fleet includes ARM64 Windows devices, restrict the app's architecture requirement to x64 as described in step 4, so Intune does not target devices that cannot run it.

Devices below the minimum operating system you set are skipped rather than failed — Intune reports no error, the app simply never arrives on them. If your fleet's floor is lower than Windows 11 24H2, contact Anzenna support before deploying.

Overview​

Intune delivers AI DLP as a Win32 app. Intune's Win32 model cannot ingest a bare .exe, which is why Anzenna supplies a .intunewin package. Intune stores the app's install command separately from the package, so your domain and token live in your console.

  • One package serves every customer; the per-tenant values are in the install command

  • Installs in System context, assigned to a device group

  • No reboot is required

  • You do not need to re-deploy for new versions — the agent updates itself

Step-by-Step Instructions​

1. Create the Win32 app​

  1. Sign in to the Microsoft Intune admin center and go to Apps > Windows

  2. Click Add

  3. For App type, select Windows app (Win32), then click Select

  4. Click Select app package file, upload the update-windows-amd64.intunewin file from Anzenna, and click OK

2. App information​

  1. Name: Anzenna AI DLP, or whatever matches your fleet's naming convention

  2. Description: free text, for example "Anzenna AI DLP endpoint agent"

  3. Publisher: Anzenna

  4. Leave App version, Category, and the remaining fields at their defaults, then click Next

3. Program​

This is where your per-tenant values go. Substitute your own domain and Client Token (find it in the portal) into the install command:

update-windows-amd64.exe --install --domain <DOMAIN> --client-token <TOKEN>

Replace <DOMAIN> and <TOKEN> with your own values, and leave the rest of the command as written.

Uninstall command:
update-windows-amd64.exe --uninstall

  1. Paste the install command, with your values substituted, into Install command

  2. Paste the uninstall command into Uninstall command

  3. Set Allow available uninstall to No

  4. Set Install behavior to System

  5. Set Device restart behavior to No specific action

Install behavior must be System

The install writes under %ProgramFiles% and registers a machine-scoped scheduled task, both of which need elevation. A User-context assignment will fail.

Why Allow available uninstall is No

Leaving this on would let a user remove AI DLP themselves from the Company Portal. Uninstalling should be an administrator's action in Intune, not something an end user can do on their own machine.

Leave Return codes at their defaults. The installer exits 0 when it succeeds and 1 on any error, both of which Intune's defaults already handle. The reboot and retry codes in that table come from Intune and are never returned by this installer, so there is nothing to add or remove.

A successful install is not yet a confirmed enrollment

Exit 0 means the installer placed the agent, wrote its config and registered the scheduled task. Enrolling AI DLP itself happens on the agent's first scheduled run, usually seconds later, and Intune never sees its result. To confirm enrollment, read the device log — see Verify on the device.

  1. Click Next

4. Requirements​

  1. Operating system architecture: select x64

  2. Minimum operating system: Windows 11 24H2

  3. Leave the remaining fields empty and click Next

5. Detection rules​

  1. Set Rules format to Manually configure detection rules, then click Add

  2. Configure a single File rule:

FieldValue
Rule typeFile
PathC:\Program Files\Anzenna\Update
File or folderanzenna-update.exe
Detection methodFile or folder exists
Associated with a 32-bit app on 64-bit clientsNo

  1. Click OK, then Next

  2. Skip Dependencies and Supersedence — AI DLP needs neither

6. Assign and deploy​

  1. On the Assignments tab, under Required, click Add group

  2. Select a device group, and start with a small test group. Targeting devices is what you want here: AI DLP protects a machine rather than following a person, so every account on an enrolled device should be covered whether or not that user is in a group.

  3. Set End user notifications to Hide all toast notifications. The install needs nothing from the user and no reboot, so there is nothing for a notification to prompt.

  4. Click Next, review the summary, and click Create

Why a device group rather than a user group

Intune accepts either for a System-context app, so this is a targeting choice rather than a requirement. A device group covers the machine itself — every account that signs in to it — which matches what AI DLP is for. A user group would install only where those particular users sign in, leaving shared and unassigned machines uncovered.

Forcing an immediate sync

Devices pick the app up on their next Intune sync. To trigger one from the device: Settings > Accounts > Access work or school, select the account, click Info, then Sync.

Verifying Deployment​

Check install status in Intune​

  1. Open the app and select Device install status

  2. A successful device shows Installed

Intune's verdict is not proof that AI DLP enrolled

Intune reports success as soon as the install command exits, which can be a second or two before AI DLP finishes enrolling. A device where enrollment failed can still show green in the console. To confirm enrollment, read the log on the device.

Verify on the device​

The agent's own log is the authoritative record. It is readable without elevation:

type "%ProgramFiles%\Anzenna\Update\logs\update.log"

A quick structural check, from an elevated prompt:

dir "%ProgramFiles%\Anzenna\Update"
schtasks /Query /TN "Anzenna\Update"

The first should list the agent binary plus cache, config, logs, and store directories. The second should find the scheduled task.

See

AI DLP Overview

for how to read the log's install and update lines.

Uninstalling​

Removing the assignment does not uninstall anything. To remove AI DLP, change the app's assignment for the target group from Required to Uninstall. Intune then runs the uninstall command you configured in step 3.

The uninstall removes the agent, its scheduled task, and its configuration, and is idempotent — running it on a device that never had AI DLP is a clean no-op.

Troubleshooting​

The app never installs on a targeted device​

  • Confirm the assignment targets a device group, not a user group

  • Confirm the device meets the architecture requirement — an ARM64 device excluded by the x64 requirement will not be targeted

  • Force a sync from the device, then re-check Device install status

The install reports a failure that a retry never clears​

The installer exits 1 and prints the reason to its error output. Both causes below happen before the log file is opened, so update.log will not contain them — and it may not exist at all. The reliable way to see the message is to run the same install command by hand on the device from an elevated SYSTEM prompt and read what it prints.

  • A message about running elevated means the app is assigned in User context rather than System — see step 3

  • A message about a required value means the install command is missing --domain or --client-token

  • A retry cannot clear either of these; both need the app's configuration corrected

The portal refused the enrollment​

The log shows exit 40:

The install succeeded but no findings appear​

  • Check that Anzenna knows the device. If no connected MDM or EDR integration reports its serial number, AI DLP installs but does not register — see

    Devices must already be known to Anzenna

    . Connect the integration; the device registers on its own once it is reported.

  • For Claude Code, check the version meets the

    minimum requirement

    . Older versions produce no findings and no error.

"install requires --domain and --client-token"​

  • One of the values is missing from the install command

  • Both are required; a partial install is refused rather than left half-configured

  • Check for a stray line break where you pasted the command

Installed, but still on an old version hours later​

  • The agent's first update run is triggered at install time but is best-effort on Windows. If it does not fire, the device updates at its next daily run.

  • To update sooner, run the Anzenna\Update task manually from Task Scheduler

Need help? Contact

Anzenna Support

for assistance.