--- title: "MDM App Deployment" slug: "deploy-with-mdm" updated: 2026-05-11T12:59:14Z published: 2026-05-11T12:59:14Z canonical: "support.perimeter81.com/deploy-with-mdm" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://support.perimeter81.com/llms.txt > Use this file to discover all available pages before exploring further. # MDM App Deployment ## Welcome Welcome aboard the MDM App Deployment section at Check Point SASE's Help Center! This guide offers you a sneak peek into this category and the must-visit resources. The deployment process of Check Point SASE varies depending on your MDM (Mobile Device Management) provider and is done utilizing a public app deployment process. If you are managing the Check Point SASE client deployment using MDM you should disable the Update client functions in the Check Point SASE Web Console to prevent looping client installation issues. ## Must-Visit Resources - Download the Check Point SASE agent - MDM deployment with SWG - Using SCCM? See [SCCM Agent Deployment](/v1/docs/deploy-with-sccm) - deployment guides for common MDM providers - [JAMF Cloud](https://docs.jamf.com/9.9/casper-suite/administrator-guide/Installing_Packages.html) - [VMWare AirWatch](https://docs.vmware.com/en/VMware-AirWatch/9.1/vmware-airwatch-guides-91/GUID-AW91-Config_Public_Apps_WS1.html) - [MobileIron](http://mi.extendedhelp.mobileiron.com/45/all/en/desktop/App_Catalog.htm) - [Microsoft EndPoint Manager (InTune)](https://docs.microsoft.com/en-us/mem/intune/apps/lob-apps-windows) - [Meraki](https://documentation.meraki.com/SM/Apps_and_Software/Deploying_Store_Apps_for_iOS%2F%2FmacOS_and_Android) ## Transparent Internet Access Installation Note - Applies to Check Point SASE Agent version 11.5 and higher. The Transparent Internet Access enforces internet security immediately upon agent installation, without requiring any end-user interaction. The remote installation process bypasses both device and member registration while ensuring that users receive the latest security policies, even if they have not signed in to the agent. You can generate a unique installation key from the platform download page. This key is visible only to Admin users. Once generated, the key validity cannot be modified. ![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-2025-03-27-10-48-54-037.png) Note - Private Access remains restricted until the user **authenticates** and **registers** on the platform. Seamless Internet Access installation requires sending a combination of these command-line parameters during the agent installation process: - REGION - WORKSPACE* - TENANT_TOKEN - EMAIL* *Optional > **Note** - EMAIL is optional for Windows and mandatory for macOS. ## **Common Commands** | Operating System | Windows (.msi installation flags for versions 11.0 and above): | Windows (.msi installation flags for legacy versions (up to 11.0): | macOS | Linux (installation flags): | | --- | --- | --- | --- | --- | | Command for | | Silent Installation | `msiexec /quiet /i Harmony_SASE_x.x.x.xxx.msi` To know the installation status after the silent installation, run: 1. `start /wait msiexec /quiet /i “Harmony_SASE_x.x.x.xxx.msi"` 2. `echo %errorlevel%` | `msiexec /quiet /i Perimeter81_x.x.x.xxx.msi` To know the installation status after the silent installation, run: 1. `start /wait msiexec /quiet /i “Perimeter81_x.x.x.xxx.msi"` 2. `echo %errorlevel%` | - **For version 11.0.10 and above**: `$ sudo installer -pkg Harmony_SASE_x.x.x.xxx.pkg -target /` - **For legacy versions (up to 11.0.10)**: `$ sudo installer -pkg Perimeter81_x.x.x.xxx.pkg -target /` To change the agent permissions after the installation, run: 1. `$ sudo chown -R $(stat -f%Su /dev/console) "/Applications/Perimeter 81.app"` 2. `$ chmod -R u=rwx "/Applications/Perimeter 81.app"` | | | Pre-populating the tenant or workspace name | `msiexec /i "Harmony_SASE_x.x.x.xxx.msi" /quiet WORKSPACE="workspace_name"` | `msiexec /i "Perimeter81_x.x.x.xxx.msi" /quiet WORKSPACE="workspace_name"` | `$ sudo defaults write com.perimeter81d workspace workspace_name` To remove pre-populated workspace/tenant name, run: `$ sudo defaults delete com.perimeter81d workspace` This is supported only with agent version 8.0.4.116 and higher. | To pre-populae the workspace name, run: `/opt/Perimeter81/perimeter81 ctl set-prepopulate-tenant-id workspace_name` Replace "`workspace_name`" with your actual workspace | | Pre-populating the data residency region | `msiexec /i "Harmony_SASE_x.x.x.xxx.msi" /quiet REGION="EU, US, AU, or IN"` For `REGION`: - `"EU"` - Europe - `"US"` - America - `"AU"` - Australia - `"IN"` - India | `msiexec /i "Perimeter81_x.x.x.xxx.msi" /quiet REGION="EU, US, AU, or IN"` For `REGION`: - `"EU"` - Europe - `"US"` - America - `"AU"` - Australia - `"IN"` - India | `$ sudo defaults write com.perimeter81d region "EU, US, AU, or IN"` For `REGION`: - `"EU"` - Europe - `"US"` - America - `"AU"` - Australia - `"IN"` - India | | | Pre-populating the tenant or workspace name and data residency region | `msiexec /i "Harmony_SASE_x.x.x.xxx.msi" /quiet WORKSPACE="workspace_name" REGION="EU, US, AU, or IN"` For `REGION`: - `"EU"` - Europe - `"US"` - America - `"AU"` - Australia - `"IN"` - India | `msiexec /i "Perimeter81_x.x.x.xxx.msi" /quiet WORKSPACE="workspace_name" REGION="EU, US, AU, or IN"` For `REGION`: - `"EU"` - Europe - `"US"` - America - `"AU"` - Australia - `"IN"` - India | To pre-populating the tenant or workspace name, run: `$ sudo defaults write com.perimeter81d workspace workspace_name` To pre-populating the data residency region, run: `$ sudo defaults write com.perimeter81d region "EU, US, AU, or IN"` For `REGION`: - `"EU"` - Europe - `"US"` - America - `"AU"` - Australia - `"IN"` - India | | | Transparent user registration using tenant installation token (**applies for version 11.5 and above**) | `msiexec /quiet /i "Harmony_SASE_XX.XX.XX.XXXX.msi" REGION="EU, US, AU, or IN" TENANT_TOKEN="Installation Token"` > **Note** - If the device username does not match the user email address (verify by running whoami /upn from the command line), the email address must be provided as an explicit parameter: `msiexec /quiet /i "Harmony_SASE_XX.XX.XX.XXXX.msi" REGION="EU, US, AU, or IN" TENANT_TOKEN="Installation Token" EMAIL="user email address" ` | | | | | Transparent user registration, using tenant installation and user installation (applies for version 11.3 and higher) | | | - `$ sudo defaults write com.perimeter81d REGION "EU, US, AU, or IN"` - `$ sudo defaults write com.perimeter81d INSTALLATION_PARAMETERS -dict TENANT_TOKEN "Installation Token" EMAIL -string "User@email.com"` > **Note** - For organizations using Active Directory (AD), you can pre-populate the user email address by adding the following to the command: > > `EMAIL $(stat -f%Su /dev/console)@%CompanyDomain%.com` | | | Uninstallation | `msiexec /x "Harmony_SASE_x.x.x.xxx.msi"` | `msiexec /x "Perimeter81_x.x.x.xxx.msi"` | Run the [uninstall script](https://supportbucketshare.s3.amazonaws.com/Custom+Scripts/MacOS+uninstall/removeMacOSDaemonScript.zip). | | ## **Jumpstart Your Journey** If you're just stepping into the world of Check Point SASE, our [Getting Started Guide](https://support.perimeter81.com/docs/welcome-to-perimeter-81) is the perfect starting point. ## **Support at Your Fingertips** Got questions or need help? Our support team is available round the clock. You can chat with us anytime on our website, or drop us an email at sase-support@checkpoint.com