Managed rollout: where to start

In a managed rollout, IT sets BeeSensible up centrally and employees have almost nothing to do: the browser extension appears by itself, they sign in with their work account and the desktop app installs silently.

This section takes you through that route step by step. Work through it from top to bottom; each part ends with what you should see.

#The order

The rollout console shows the same steps, in the same order and under the same names. Each part below corresponds to one step there.

1. Identity. Verify the domain and connect the identity provider. Without this, a new employee ends up outside your organisation.
2. Provide work sign-in. The sign-in script that preselects the employee's work account.
3. Desktop app. Optional by default, and something you can add later. It only becomes a prerequisite if BeeSensible has set up on-device detection for you; see Detection on the device.
4. Install the extension automatically. Force-install in Chrome and Edge.
5. Verify, then roll out organisation-wide.

#One choice to make up front

#Who decides which version of the desktop app runs

This is a genuine choice rather than a setting you can toggle, and it determines which installer you deploy.

An organisation that wants self-updating clients deploys the regular installer through Intune. That works because the installation lives in the user's profile. What you give up is the machine-wide installation.

The reverse is also true: a machine-wide installation cannot update itself. Employees cannot write to Program Files, so the app would ask for a permission they cannot grant. Genuine auto-update on a machine-wide installation would need a component with elevated rights, and there isn't one.

The console lets you make that choice and then shows only the package and the Intune values that go with it.

#Detection on the device

By default, detection runs in the cloud. Every organisation starts with that setting, and it is the simplest route for a rollout: identity and the extension are all you need.

Detection can also run on the device itself. BeeSensible configures that for your organisation; it is not an option in the dashboard. Before you ask for it, here is what it involves:

• The desktop app becomes a prerequisite on every workstation and comes before the extension in the rollout. The rollout console then reorders the steps accordingly.
• After installation, the app downloads a large detection package once. Expect a longer wait on first use, and an extra host on the firewall list.
• There are more moving parts on the device, so more to check during a rollout.

Want this for your organisation? Email [email protected]Copy. We set it up and let you know when the console shows the new order.

#What you need

• Devices running Windows 10 (64-bit) or Windows 11, joined to Microsoft Entra ID (Entra joined) and enrolled in Intune. TestedWindows 11, 31 August 2026
• A verified domain and a connected identity provider in BeeSensible; see Identity below.
• A target group: a security group in Entra with the users you are rolling out to. Ideally, start with a small pilot group, then assign the same profiles to the rest of the organisation.

#Network and firewall

If your network filters outbound traffic, several hosts must be reachable before the rollout will work. The current list is in the rollout console under Before you start, with what each host is for. It does not include the endpoints Intune itself needs; Microsoft publishes those.

If you also allowlist applications, note that the desktop app starts a helper process on the device that handles detection. In Task Manager and EDR reports that process appears as python.exe, running from the BeeSensible installation folder:

C:\Program Files\BeeSensible\resources\sidecar\python\python.exe