{isWindows ? Microsoft Intune command-line arguments
For an Intune Line-of-business app, upload {file} and paste these into Command-line arguments.
{intuneArgs} :
The supported fleet path. Download these profiles and assign them with the package.
{fleetKeySection}
{quietProfilesSection}
Only if you are not using MDM. After installing, set the key with:
{setKeyCommand}
}
;
};
Velatir for Desktop is a standard MSI (Windows) and PKG (macOS). One ingest key configures every device: no per-feature flags, no per-customer builds.
## Build the installer and profiles
Generate an ingest key on the **Setup** tab of the [Velatir dashboard](https://app.velatir.com). The same key works for every device.
On Windows the key is an installer property. On macOS it lives in **MDM Deployment**: download the ingest-key profile and the two optional quiet-install profiles, then assign them with the package.
## Deploy with your MDM
Pick your platform. Each path is: upload the installer, assign the ingest key, assign to devices.
1. **Apps → All apps → Add → Line-of-business app.** Upload the MSI from the builder.
2. **Command-line arguments:** paste the Intune arguments from the builder.
3. Assign **Required**. Intune handles elevation.
To rotate the key, update the arguments and redeploy.
1. Upload the PKG under **Packages**. Policy: **Recurring Check-in**, **Once per computer**.
2. Upload the `.mobileconfig` from the builder, scoped to the same Macs. Or **Application & Custom Settings**: domain `com.velatir.agent`, key `ApiKey`. This is the macOS equivalent of the MSI's `INGEST_KEY`.
3. Upload the **background items** and **notifications** profiles from the builder (or create them in Jamf: Team Identifier `AA7QLU3S4R`, bundle ID `com.velatir.desktopapp`, alert type **Alert**). Assign these first so macOS never shows the background-items prompt.
Rotate the key by replacing `ApiKey` in the profile — no reinstall.
Use **macOS app (PKG)**, not **Line-of-business app**.
1. **Apps → All apps → Create → macOS → macOS app (PKG).** Upload the PKG from the builder.
2. **Detection rules:** delete `com.velatir.agent.bootstrap`. Add one entry: bundle ID `com.velatir.desktopapp`, **Ignore app version: Yes**. Confirm one Mac shows **Installed** before you go wide — the wrong rule reinstalls Velatir at every check-in. See [troubleshooting](/desktop-app/troubleshooting#fleet-and-mdm).
3. **Requirements:** macOS 13.0. Assign **Required**.
4. **Devices → Configuration → Create → Profile type: Templates → Custom.** Upload the `.mobileconfig` from the builder. Repeat for **background items** and **notifications**. Assign all three to the same groups as the app, and let them arrive first.
Apple Silicon and Intel are separate packages, assigned to matching device groups. Devices need the Intune management agent (2308.006+) — a profile that applies is not evidence the app can install. Confirm with `velatir status` or the dashboard **Devices** view, not Intune alone.
Any tool that runs `msiexec` (Windows) or `installer` (macOS) works: use the command from the builder. For a Windows detection rule, check for the `VelatirAgent` service or the install path `C:\Program Files\Velatir\`.
## Removing Velatir from a fleet
Change the assignment first. While the app is still **Required**, Intune reinstalls it behind the removal.
**Windows.** Set the assignment to **Uninstall**. If devices do not come off, deploy the cleanup script in [Uninstall cleanup](/desktop-app/uninstall-cleanup) as an Intune remediation running as SYSTEM.
**macOS.** The PKG app type has no **Uninstall** assignment, so remove the assignment, then run the bundled uninstaller as a root script under **Devices → Scripts**:
```bash theme={null}
sudo velatir-uninstall
```
If an older version left a system extension on the device, a restart finishes removing it.
## Reference
| Property | Required | Description |
| ------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------- |
| `INGEST_KEY` | Recommended | Stages the ingest key at install time. Hidden from MSI logs. (`VELATIR_API_KEY` is accepted as a deprecated alias.) |
| `VELATIR_HIDE_TRAY` | No | Set to `1` to hide the system-tray icon. Windows only; on macOS use `velatir hide`. `velatir show` reverses it at runtime. |
**Windows.** Redeploy with the new key in the command-line arguments.
**macOS.** Re-download the ingest key profile from the builder and replace the `ApiKey` value in your MDM. Devices apply it on the next check-in, with no reinstall.
Optional. Together they stop the "background items added" alert and turn Velatir's alerts on before anyone sees a prompt. Download them from the builder; assign them to the same Macs as the package, first.
| Setting | Value |
| ----------------------------- | ---------------------------------------------------- |
| Team Identifier | `AA7QLU3S4R` |
| App bundle ID (notifications) | `com.velatir.desktopapp` |
| Alert type | **Alert** (stays on screen), not Banner |
| Critical Alerts | Off unless blocked requests must break through Focus |
The Managed Login Items payload needs macOS 13+ and an MDM; macOS refuses it in a profile a user installs by hand.
To mute Velatir's own update and lifecycle toasts, set `ShouldMuteSystemNotifications` to `true` in `com.velatir.agent`. Blocked-request alerts still appear.
Run `velatir status --json` as a Microsoft Intune Remediation or a Jamf Pro extension attribute. It reports client state, version, and the last trace timestamp.
Velatir auto-updates by default. To coordinate updates with your own change-management process, contact support to enable a per-tenant update channel.
## Next steps
What the installer asks for on each platform.
Monitor agent health across the fleet.
What the desktop client does on each device.
Diagnose failures during scaled rollouts.