Agent installation in Endpoint Central is getting an upgrade. Agent Installation Protection is an enhancement to agent onboarding that confirms every agent installation is authorized before the computer joins your environment.
We’re sharing this early so you know what to expect and can plan at your own pace. This post covers what the feature does, how it fits with your current setup, and what changes for existing users.
The Endpoint Central agent is a trusted component on every managed computer. Once it registers with your server, it performs routine operations such as configuration, patch management and software deployment, along with critical operations such as remote control and script deployments, all with system-level privileges. Your server, in turn, treats that computer as part of your managed environment.
This trust is what makes the agent installer a sensitive file. Installers are routinely copied to shared drives, attached to emails or handed to partners, and a copy can easily travel beyond the people it was meant for. If anyone holding an installer can register a computer, an unauthorized device could appear as a trusted endpoint, receive your policies and open a communication channel to the Central server. Controlling who can complete an installation is as important as controlling who can sign in to the console.
Computers for Approval, released in build 11.3.2414.01 (April 2024), adds an administrator approval step on your Central server. New agents are held in an approval list and cannot perform any critical operations, including remote control, until an administrator approves them. A rejected computer never becomes part of your environment. This gives administrators visibility of every new endpoint and the final say over what joins the network.
However, this review happens only after the agent is installed and has already contacted your server. And because approval is a manual step, a computer can occasionally be approved by mistake through simple human error.
Agent Installation Protection enforces install-time authentication: while the agent is being installed, it must be verified with a one-time password or deployment token issued by the Central server. The computer is not onboarded until verification succeeds, and an invalid or expired credential stops the installation.
Manual installation: For a manual install on one computer, the Central server generates a time-bound 6-digit one-time password (OTP). The administrator running the installation enters this OTP, and the agent installs only if it is valid.
Bulk agent installation: Installations that use the downloaded agent installer, whether through GPO, SCCM, MDT or in Azure and AWS environments, will require a time-bound deployment token generated from the Central server. Silent deployments still complete without end-user intervention.
For existing users: Once this release is available, you will need to move to OTP- or token-based installation. We will keep the earlier flow working for a short while so you have time to switch, and Computers for Approval will continue to work as before. After that, the new flow will be enforced, so it is best to download the new installer and update your deployments early. Agents that are already installed are not affected.
Release availability: Stay tuned! More details are on the way, and we’ll announce the release in a dedicated forum post and in the release notes.