Skip to main content

AI DLP Overview

AI DLP monitors the AI tools running on your employees' machines and flags risky behavior — reads of sensitive files, credential-extraction commands, and sensitive data sent to AI services. It covers AI coding agents such as Claude Code, desktop AI applications including Claude Desktop and ChatGPT, and browser-based AI services. Findings appear in the Anzenna portal alongside your other detections.

Desktop AI apps need a trust certificate on macOS

AI DLP monitors desktop AI apps through a local proxy, which takes traffic only once the Mac trusts its AI DLP certificate. Today Anzenna supports delivering that certificate only through Jamf Pro — see Deliver the Trust Certificate. On Macs deployed another way, AI DLP still monitors Claude Code, but not desktop AI apps.

Deploying AI DLP through your MDM installs the Anzenna Update agent, which installs AI DLP and then keeps both itself and AI DLP current on a daily schedule. Your MDM is the bootstrap; it is not the update mechanism.

To try AI DLP on a single Mac first, you can

install it with Homebrew

. That installs the same agent, but without Anzenna Update, so it does not update itself.

What you need before you start​

  • For an MDM deployment, admin access to Jamf Pro, Iru, or Microsoft Intune. A Homebrew install needs administrator rights on the Mac instead.

  • Your Anzenna domain

  • Your domain's Client Token, from the Anzenna portal

  • For an MDM deployment, the install script or package, provided by Anzenna

  • Each device already known to Anzenna through a connected MDM or EDR integration — see below

  • AI DLP included in your Anzenna plan. If you are not sure, contact your account manager.

Required Step

Before beginning an MDM deployment, contact Anzenna support to obtain the install script (macOS) or .intunewin package (Windows). Deployment cannot proceed without it.

Devices must already be known to Anzenna​

AI DLP enrolls a device only if Anzenna already has that device on record. Anzenna learns about devices from the MDM and EDR integrations you connect under Settings > Integrations, matching them by serial number.

Deploying AI DLP through an MDM does not by itself tell Anzenna about the device: some connected MDM or EDR integration has to report it. That need not be the MDM you deploy with; a connected EDR that reports the device is enough. A device Anzenna does not know about still installs AI DLP, but it does not register and no findings appear for it. Once a connected integration reports the device, AI DLP retries the registration itself; you do not need to reinstall.

Claude Code version requirement​

AI DLP monitors Claude Code through Claude Code's own hooks, which requires Claude Code 2.1.139 or later. Earlier versions keep working normally, but AI DLP sees nothing from them: no findings and no error.

Claude Code updates itself by default, so most machines meet this without any action. Check your fleet if you control Claude Code versions yourself — for example by disabling auto-updates, deploying a fixed build through your MDM, or pinning a package-manager version. To check a single machine, run claude --version.

Choose your deployment guide​

The two values you will supply​

Every path asks for the same two values. Only where you type them differs — a Jamf policy parameter, an Intune install command, two lines at the top of the Iru script, or the installer command on a Homebrew install.

ValueWhat it isWhere to get it
DomainYour Anzenna domainYou already have this
Client TokenYour domain's enrollment credential

Anzenna portal, labelled Client Token

Finding your Client Token​

The Client Token lives in the Anzenna portal, on the Anzenna AI DLP integration card.

  1. Open

    app.anzenna.ai/u/integrations

    — or, in the portal, go to Settings > Integrations

  2. Find the Anzenna AI DLP card and click Show client token

  1. Copy the value under Client Token

This is the same token for every device you deploy to, so you only need to fetch it once.

If you do not have access to the Anzenna portal, ask whoever administers your Anzenna account for the token, or

contact Anzenna support

. Deploying AI DLP needs both portal access (for the token) and MDM admin access, and these are often two different people.

About the Client Token​

The Client Token is a domain-shared credential, not a per-device key. If you have already deployed the Anzenna browser extension, it is the same token. Anyone with access to your MDM console can read it, so treat console access accordingly.

On the endpoint, the token is written only to the agent's own configuration file, readable by root (macOS) or SYSTEM (Windows) alone. It is not stored anywhere else on the machine.

How updates work​

Once installed through your MDM, the agent updates itself. This has a few consequences worth knowing up front:

  • You do not need to re-deploy when Anzenna ships a new version. Machines update themselves daily. Re-packaging is only for new installs.

  • An older package in your console is not a problem. It installs an older agent, which brings itself current on its first scheduled run.

  • The first update usually runs within seconds of install, but it is a separate background process. If it does not run immediately, the machine picks it up at the next daily run.

A Homebrew install does not update itself. See

Updating a Homebrew install

.

What gets installed​

This section and the next describe an MDM deployment. A Homebrew install has no Anzenna Update agent, scheduled job, or update.log; check it with the

health check

instead.

macOSWindows
Install location/Library/Application Support/Anzenna/Update/%ProgramFiles%\Anzenna\Update\
Scheduled job

LaunchDaemon ai.anzenna.update, daily as root

Task Scheduler task Anzenna\Update, daily as SYSTEM

Log file.../Anzenna/Update/logs/update.log...\Anzenna\Update\logs\update.log
Reboot requiredNoNo

Nothing is left outside the install tree. The installer downloads to a temporary directory that is removed when it finishes.

macOS: expect a background-task notification

On a first install, macOS announces that "Software from Anzenna Inc. can run in the background" and points at System Settings > General > Login Items & Extensions. This is normal — it is the scheduled job registering. A different developer name there is worth reporting to Anzenna.

Reading the log​

The log is deliberately readable without elevation, so you do not need to be an administrator to check an install. A successful install ends with four lines. The scheduler it names differs by platform — a LaunchDaemon on macOS, a scheduled task on Windows.

On macOS:
install: placed binary  dest="/Library/Application Support/Anzenna/Update/anzenna-update"
install: provisioned config  environment=prod
install: registered scheduler  label=ai.anzenna.update  interval=24h0m0s
install: complete
On Windows:
install: placed binary  dest="C:\Program Files\Anzenna\Update\anzenna-update.exe"
install: provisioned config  environment=prod
install: registered scheduler  label=Anzenna\Update  interval=24h0m0s
install: complete

install: complete means the deployment worked. The lines about AI DLP itself arrive separately, from the scheduled run — their absence immediately after an install is normal, not a failure.

When AI DLP is installed or checked, three phrases mean three different things:

Log lineWhat happened
up to dateAlready current. Nothing downloaded, nothing run.
installed … (exit 0)

Downloaded, verified, installed, and enrolled successfully. This is a first enrollment.

already registered … (exit 2)

Ran, found the machine already enrolled, and did nothing. A success — but not evidence that this run enrolled anything.

Removing AI DLP​

Each guide includes an uninstall section. On every platform, uninstalling is an explicit action — removing the install item from a policy, Blueprint, or assignment leaves AI DLP installed and running. How you trigger the uninstall differs:

  • Jamf Pro and Iru — a second policy or Library Item, running the uninstall script Anzenna provides

  • Microsoft Intune — no second package. The Win32 app carries its own uninstall command, so you change the assignment from Required to Uninstall

  • Homebrew — run the uninstaller on the Mac, then remove the package. See

    Uninstalling a Homebrew install

In all three MDM cases the uninstall removes AI DLP, the Anzenna Update agent, the scheduled job, and the configuration, and is idempotent — running it on a machine that never had AI DLP is a clean no-op.

Need help? Contact

Anzenna Support

for assistance.