Windows MDM Deployment

Windows MDM Deployment

This guide explains how to deploy Lumia across Windows machines using your MDM solution to enable inspection and governance of AI traffic on the endpoint.
Deploying the Lumia MSI file via an MDM solution (such as Microsoft Intune) allows you to install the configuration across all organizational endpoints silently in the background.
Before running the installation, consider the following:

Permissions

Administrator privileges are required to perform the installation. When configuring your MDM, ensure the app is set to install in the System context (Device level). This ensures Lumia is installed for all users on the machine, including non-admins.

Setting the Endpoint’s Email / Identity

Lumia registers each endpoint to identify which user is associated with it. This identity is used for reporting and to enable direct communication in case of policy violations (e.g., via email or Slack).
  • Automatic Setting: By default, the installer registers the endpoint using the User’s Principal Name (UPN). If the UPN cannot be retrieved, it falls back to the Username@HostName convention.
    Note: If the UPN does not match the user's actual email address, direct notifications will not work.
  • Custom Setting (Recommended): To ensure accurate user identification, use your MDM’s dynamic variables to pass the user's email address:
    Add the following argument to your installation command:
    • 	msiexec /i "path\to\Lumia.msi" email="{{user_email_variable}}"
    Note: Replace "path\to\Lumia.msi" with the actual file path on the machine, and {{user_email_variable}} with the appropriate variable for your specific MDM (e.g., {{user.email}}).

Installation Steps

  1. Add the Lumia.msi file to your MDM as a new Windows App.
  2. Set the installation to run in the System context. If you chose the custom identity setting, use the command with the email argument as shown above.
  3. Deploy the app to your selected groups or devices.
  4. Restart any AI-related applications that were open during the installation (e.g., Web Browsers, Desktop AI apps like ChatGPT or Cursor, or CLI tools). This ensures the new network configuration (PAC) is active, as some applications load proxy definitions only on startup.
  5. Return to our Getting Started guide and proceed to Step 1.2: Verify Integration. Follow the instructions there to confirm that the endpoint is successfully forwarding AI interactions and that logs are appearing in your Lumia Portal.
💡

Uninstallation

To stop Lumia from monitoring the endpoint, use your MDM to issue an uninstall command or change the app assignment to Uninstall.
Â