Managed rollout: where to start

In a managed rollout, IT sets BeeSensible up centrally and the employee has almost nothing to do: the browser extension appears on its own, signing in uses the work account, and the desktop app installs silently.

This category describes that route step by step. Work through it from top to bottom; every part ends with what you expect to see.

#The order

The same steps, in the same order and with the same names, appear in the rollout console. Each part below belongs to one step there.

1. Identity. Verify the domain and connect the identity provider. Without this, a new employee lands outside your organisation.
2. Provide the work sign-in. The sign-in script that pre-selects the employee's work account.
3. The desktop app. By default an extra you can also do later. It only becomes a prerequisite when BeeSensible has set up on-device detection for you; see Detection on the device.
4. Install the extension automatically. Force-install in Chrome and Edge.
5. Verify, then roll out organisation-wide.

#One choice you make up front

#Who decides which version of the desktop app runs

This is a real choice rather than a switch, and it determines which installer you deploy.

An organisation that wants self-updating clients deploys the regular installer through Intune. That works, because the installation sits in the user's profile. What you give up is the machine-wide installation.

The reverse also holds: a machine-wide installation cannot update itself. An employee may not write to Program Files, so the app would ask for a permission they cannot grant. Real auto-update on a machine-wide installation requires a component with elevated rights, and that does not exist today.

The console lets you make that choice and then shows only the package and the Intune values that belong to it.

#Detection on the device

By default, detection happens in the cloud. That is the setting every organisation starts with, and for a rollout the lightest route: identity and the extension are all you need.

If you want detection to happen on the device itself, that is possible. It is a setting BeeSensible configures for your organisation, not a choice in the dashboard. Know what it means beforehand:

• The desktop app becomes a prerequisite on every workstation, and comes before the extension in the rollout. The rollout console then puts the steps in that order by itself.
• After installation, the app fetches a large detection package once. Expect extra waiting time on first use and the extra host in the firewall list.
• There are more moving parts on the device, so more to check during a rollout.

Want this for your organisation? Email [email protected]Copy. We set it up and let you know when the console shows the adjusted order.

#What you need

• Devices running Windows 10 (64-bit) or Windows 11, joined to Microsoft Entra ID (Entra joined) and enrolled in Intune. TestedWindows 11, 31 August 2026
• A verified domain and a connected identity provider in BeeSensible; see Identity below.
• A target group: a security group in Entra with the users you are rolling out to. Preferably start with a small pilot group, then assign the same profiles to the rest of the organisation.

#Network and firewall

If your network filters outbound traffic, a number of hosts have to be reachable before the rollout works. The current list is on the deployment console, under Before you begin, with what each host is needed for. The endpoints Intune itself needs are not on it; Microsoft publishes those.

If you also allowlist applications: the desktop app starts a helper process on the device that does the detection. In Task Manager and in EDR reports that process is called python.exe, and it runs from the BeeSensible installation folder:

C:\Program Files\BeeSensible\resources\sidecar\python\python.exe