Fleet rollout (MDM): overview
For a handful of people, each user can connect their tool by hand. For an organization, you want every machine configured the same way, keys handed out automatically, and the settings locked so nobody can point a tool somewhere else. That is what a device-management (MDM) rollout gives you.
This section has a page per harness. Start here for the shared pattern, then open the page for your tool.
Why MDM matters for governance
Section titled “Why MDM matters for governance”Governance is intention based: TapPass governs what routes through it. An MDM rollout turns that into a guarantee by doing two things at once:
- It hands each user their own TapPass key, so every person is a distinct, governed identity, with no shared secret to copy.
- It locks the configuration read-only, so a user cannot repoint the tool at a provider directly and leave the governed path.
That makes the TapPass request path the only path on a managed device. (To also confine what an unmanaged process can reach, pair this with a sandbox; see What TapPass can and cannot govern.)
Status by harness
Section titled “Status by harness”| Harness | MDM rollout | How |
|---|---|---|
| Claude Desktop | Ready | Bootstrap config URL, pushed as a profile via Intune or Jamf |
| GitHub Copilot | Ready | Enterprise keys server-side, plus managed IDE settings |
| Claude Code | Ready | Managed environment variables |
| Microsoft Copilot | Coming soon | Intune app management; model is not redirectable |
| Cursor and VS Code | Coming soon | Managed editor settings |
Server and low-code tools (Open WebUI, LibreChat, n8n, Flowise, Langflow, Dify, Make, Zapier) are not device-managed through MDM. You roll those out by setting the TapPass base URL and key in the server or deployment config, once, centrally. See each tool’s page under Connect your harness.
The shared pattern
Section titled “The shared pattern”Where MDM applies, the mechanism is the same:
- You host a bootstrap endpoint. An HTTPS URL you operate (or a TapPass-hosted one per organization) that authenticates the signed-in user and returns a small JSON config for them, including their own TapPass key.
- MDM seeds the config. You push a minimal profile to each device that points the tool at that bootstrap URL, or that sets the tool’s managed settings directly.
- The app applies the config and locks it. Values from the profile override local settings and open read-only.
The per-harness pages show exactly which keys each tool reads and how to deliver them through Intune and Jamf.