Intune or JumpCloud
Deploy Lodestar with an MDM, so Macs enrol and approve the network monitor silently.
Macs
On a Mac, the MDM deploys two things: the client's MDM profile and the Lodestar installer. The profile carries the enrolment token, so no script is needed.
The profile also pre-approves Lodestar's network monitor, its content filter and its background items. Users see no prompts.
Get the MDM profile
Open the client, then the Enrolment tab.
Select Download MDM profile. Only admins can.
Each download contains a new token of its own, labelled MDM profile and the date. It never expires. Revoke it on the client's token list when you stop using that profile.
Assign the profile and the installer to the same group. The order does not matter: if the app arrives first, it waits for the profile.
Intune
Profile: go to Devices > macOS > Configuration > Create > Templates > Custom. Name it "Lodestar", set the deployment channel to Device channel, and upload the .mobileconfig file. Assign it to the client's Mac group.
App: go to Apps > macOS > Add > macOS app (PKG) and upload Lodestar-<version>.pkg. Set the minimum OS to macOS 15. Use the bundle ID ie.panoptic.lodestar as the detection rule. Assign it as Required to the same group.
JumpCloud
Profile: go to Device Management > MDM, add a Custom Configuration Profile, upload the .mobileconfig file, and bind it to the client's device group.
App: go to Software Management > Apple, add a custom package with Lodestar-<version>.pkg, and bind it to the same group.
Windows (Intune)
Add Lodestar-Agent-<version>.msi as a line-of-business app.
Set the command-line arguments to the values the console shows:
SERVER=https://console.lodestarapp.ai TOKEN=<token>Assign it to the client's devices.
SERVER must start with https://. The agent refuses any other address, so the token never travels unencrypted.
The agent reads the values, enrols, and deletes the token from the device. Its own device secret is readable only by administrators.
Keep Lodestar up to date
With agent updates on, Lodestar updates itself on devices your MDM deployed. On Macs, the MDM profile keeps the network monitor approved for each new version, so users see no prompts.
Once Lodestar has updated itself to a newer version, your MDM may report its install as failed. Intune can.
To update through your MDM instead:
Switch off agent updates.
Download the new installer from the Install Lodestar card on any client's Enrolment tab.
Upload it to the same app in your MDM. In Intune on a Mac, also raise the app's version.
To stop deploying Lodestar to a device, remove the assignment in your MDM before you uninstall. Otherwise the MDM installs it again.