IT & MSP admin guide

This is the overview for administrators. Managed use — anything where the organisation pushes something to devices — is the paid tier; individual users configuring their own machine remain free.

1. Configure

Sign in to the organisation portal and use the config builder to define theWork profile: wallpaper and theme, pinned apps, browser profile, notification rules, network settings, folder locations, and a branded desktop app-launcher. The portal produces a cryptographically signedconfiguration; agents verify the signature before applying it, and fall back to the last-known-good config if a fetch fails.

2. Deploy

Agents pull config on startup and periodically thereafter. To install at scale without touching each machine:

• Intune — an .intunewin Win32 package.
• GPO / SCCM — a per-machine .msi to Program Files.
• NSIS / scripted — silent per-machine or per-user installers.
• Zero-touch — a provisioning file binds a device to your org on first run.

See deployment for business for the current packages. (Windows installers ship alongside the public Windows build.)

3. License & seats

A seat is an activated device; you buy the seats you provision. Licensing is enforced by an entitlement service and is independent of billing. MSPs manage one pooled licence across client organisations, with a per-client breakdown and live seat/activity view in the portal.

4. Assurance (optional, org-gated)

If your organisation needs BYOD oversight evidence for an audit, enable the Assurance layer. It adds three read-only capabilities:

• Posture signals — device-health booleans (AV on, firewall on, disk encryption on, patch currency, screen auto-lock).
• Attestations — timestamped user acknowledgements of your policies.
• Awareness comms — admin → user messages with read receipts.

These flow into an evidence dashboard and an exportable audit pack thatsupports ISO 27001 BYOD/remote-working controls. Assuranceevidences a managed process; it never enforces, blocks, or wipes, and must not be described as making a device "compliant" or "secure".

5. Offboarding

Removal is managed centrally, and a clean-offboarding record can be produced to evidence return/retirement of a BYOD device.

Questions or a pilot: talk to us about business, or[email protected].