Enterprise Deployment

Roll Velatir for Desktop out across your fleet with Microsoft Intune, Jamf Pro, or any MDM

Velatir for Desktop is a standard MSI (Windows) and PKG (macOS). One ingest key configures every device: no per-feature flags, no per-customer builds.

Build the installer and profiles

Generate an ingest key on the Setup tab of the Velatir dashboard. The same key works for every device.

On Windows the key is an installer property. On macOS it lives in MDM Deployment: download the ingest-key profile and the two optional quiet-install profiles, then assign them with the package.

Deploy with your MDM

Pick your platform. Each path is: upload the installer, assign the ingest key, assign to devices.

Microsoft Intune (Windows)

1. Apps → All apps → Add → Line-of-business app. Upload the MSI from the builder.
2. Command-line arguments: paste the Intune arguments from the builder.
3. Assign Required. Intune handles elevation.

To rotate the key, update the arguments and redeploy.

Jamf Pro (macOS)

1. Upload the PKG under Packages. Policy: Recurring Check-in, Once per computer.
2. Upload the .mobileconfig from the builder, scoped to the same Macs. Or Application & Custom Settings: domain com.velatir.agent, key ApiKey. This is the macOS equivalent of the MSI’s INGEST_KEY.
3. Upload the background items and notifications profiles from the builder (or create them in Jamf: Team Identifier AA7QLU3S4R, bundle ID com.velatir.desktopapp, alert type Alert). Assign these first so macOS never shows the background-items prompt.

Rotate the key by replacing ApiKey in the profile — no reinstall.

Microsoft Intune (macOS)

Use macOS app (PKG), not Line-of-business app.

1. Apps → All apps → Create → macOS → macOS app (PKG). Upload the PKG from the builder.
2. Detection rules: delete com.velatir.agent.bootstrap. Add one entry: bundle ID com.velatir.desktopapp, Ignore app version: Yes. Confirm one Mac shows Installed before you go wide — the wrong rule reinstalls Velatir at every check-in. See troubleshooting.
3. Requirements: macOS 13.0. Assign Required.
4. Devices → Configuration → Create → Profile type: Templates → Custom. Upload the .mobileconfig from the builder. Repeat for background items and notifications. Assign all three to the same groups as the app, and let them arrive first.

Apple Silicon and Intel are separate packages, assigned to matching device groups. Devices need the Intune management agent (2308.006+) — a profile that applies is not evidence the app can install. Confirm with velatir status or the dashboard Devices view, not Intune alone.

SCCM and other tools

Any tool that runs msiexec (Windows) or installer (macOS) works: use the command from the builder. For a Windows detection rule, check for the VelatirAgent service or the install path C:\Program Files\Velatir\.

Removing Velatir from a fleet

Change the assignment first. While the app is still Required, Intune reinstalls it behind the removal.

Windows. Set the assignment to Uninstall. If devices do not come off, deploy the cleanup script in Uninstall cleanup as an Intune remediation running as SYSTEM.

macOS. The PKG app type has no Uninstall assignment, so remove the assignment, then run the bundled uninstaller as a root script under Devices → Scripts:

sudo velatir-uninstall

If an older version left a system extension on the device, a restart finishes removing it.

Reference

MSI properties (Windows)

Property	Required	Description
INGEST_KEY	Recommended	Stages the ingest key at install time. Hidden from MSI logs. (VELATIR_API_KEY is accepted as a deprecated alias.)
VELATIR_HIDE_TRAY	No	Set to 1 to hide the system-tray icon. Windows only; on macOS use velatir hide. velatir show reverses it at runtime.

Rotate the ingest key

Windows. Redeploy with the new key in the command-line arguments.

macOS. Re-download the ingest key profile from the builder and replace the ApiKey value in your MDM. Devices apply it on the next check-in, with no reinstall.

Quiet-install profiles (macOS)

Optional. Together they stop the “background items added” alert and turn Velatir’s alerts on before anyone sees a prompt. Download them from the builder; assign them to the same Macs as the package, first.

Setting	Value
Team Identifier	AA7QLU3S4R
App bundle ID (notifications)	com.velatir.desktopapp
Alert type	Alert (stays on screen), not Banner
Critical Alerts	Off unless blocked requests must break through Focus

The Managed Login Items payload needs macOS 13+ and an MDM; macOS refuses it in a profile a user installs by hand.

To mute Velatir’s own update and lifecycle toasts, set ShouldMuteSystemNotifications to true in com.velatir.agent. Blocked-request alerts still appear.

Monitor the fleet

Run velatir status --json as a Microsoft Intune Remediation or a Jamf Pro extension attribute. It reports client state, version, and the last trace timestamp.

Pin a version

Velatir auto-updates by default. To coordinate updates with your own change-management process, contact support to enable a per-tenant update channel.

Next steps

Permissions

What the installer asks for on each platform.

Health checks

Monitor agent health across the fleet.

How it works

What the desktop client does on each device.

Troubleshooting

Diagnose failures during scaled rollouts.