Deploying the SASE Agent with Microsoft Intune (Windows)

This topic provides step-by-step instructions for deploying the Check Point SASE  on Windows endpoints managed by Microsoft Intune. It covers packaging the SASE MSI as a Win32 app and configuring silent installation with workspace, region, and tenant token parameters for zero-touch provisioning.

Check Point SASE is a cloud-native Secure Access Service Edge platform within the Hybrid Mesh Network Security pillar, providing secure internet access via an integrated Secure Web Gateway (SWG), Zero Trust Network Access (ZTNA) to private resources, and application-level access controls. The  installed on endpoints enforces these policies locally and tunnels traffic through the Check Point global PoP infrastructure.

Deploying through Microsoft Intune enables organizations to push the agent silently to managed Windows devices, eliminating manual enrollment steps and ensuring security posture from first login.

Prerequisites

• Active Microsoft 365 subscription with Intune. Global Administrator or Intune Administrator role required.

• Windows 10 version 1607 or later, or Windows 11. Enterprise, Pro, or Education editions.

• Target devices must be enrolled in Intune (Entra ID joined or Hybrid Entra ID joined).

• Active Check Point SASE subscription with administrator access to the Check Point Infinity Portal.

• version 11.5 or later recommended for Transparent Internet Access support.

• Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) downloaded from GitHub.

• Endpoints must reach *.perimeter81.com and *.checkpoint.com. For the complete list of required URLs, ports, and protocol details, see sk182251.

Download the SASE Agent and Generate Tenant Token

Download the Windows MSI Installer

1. Log in to the Check Point Infinity Portal and navigate to the Check Point SASE .

2. Go to Devices > Downloads and select the Agents tab.

3. Download the Windows agent installer. The file is named Harmony_SASE_x.x.x.xxx.msi (where x.x.x.xxx is the version number).

4. Note the version number and save the MSI to a working directory on your admin workstation.

For more information, see Downloads.

Generate the Tenant Token (for Transparent Internet Access)

1. On the same Devices > Downloads page, locate the Installation Key section.

2. Generate a unique installation key (tenant token). This key is visible only to Admin users.

3. Copy and securely store the tenant token. You will embed it in the Intune install command.

Package the SASE Agent for Intune

Microsoft Intune requires Win32 apps to be packaged in .intunewin format using the Microsoft Win32 Content Prep Tool. This applies even though the  is distributed as an MSI, because the Win32 app type offers richer control over install commands, detection rules, and dependencies.

Download the Win32 Content Prep Tool

1. Download IntuneWinAppUtil.exe from the Microsoft GitHub repository.

2. Save it to a working directory (for example, C:\IntuneTools\).

Prepare the Source Folder

1. Create a source folder (for example, C:\IntuneApps\CPSASE\Source\).

2. Copy the downloaded Harmony_SASE_x.x.x.xxx.msi file into this folder.

3. Create an output folder (for example, C:\IntuneApps\CPSASE\Output\).

Create the .intunewin Package

Open a command prompt and run the Content Prep Tool:

IntuneWinAppUtil.exe ^
  -c "C:\IntuneApps\CPSASE\Source" ^
  -s "Harmony_SASE_x.x.x.xxx.msi" ^
  -o "C:\IntuneApps\CPSASE\Output" ^
  -q

• -c - Source folder containing the MSI

• -s - The setup file (MSI) within the source folder

• -o - Output folder for the .intunewin package

• -q - Quiet mode (suppress prompts)

The tool produces a file named Harmony_SASE_x.x.x.xxx.intunewin in the output folder.

Create the Win32 App in Intune

Add the Application

1. In the Intune admin center, go to Apps > Windows.

2. Click Add and select Windows app (Win32) as the app type.

3. Click Select, then upload the .intunewin file from the previous phase.

App Information

Enter the following values on the App information tab:

• Name - Check Point SASE Agent

• Description - Check Point SASE agent for secure internet and private access

• Publisher - Check Point Software Technologies Ltd.

• App version - (match the MSI version, for example 12.6.0)

• Category - Security (optional)

Program Configuration

This is where the silent install command embeds all SASE configuration. The MSI accepts workspace, region, and tenant token as command-line properties, eliminating the need for a separate pre-install script.

Install command:

msiexec /quiet /i "Harmony_SASE_x.x.x.xxx.msi" WORKSPACE="your-workspace-name" REGION="US" TENANT_TOKEN="your-tenant-token-here"

Uninstall command:

msiexec /x "Harmony_SASE_x.x.x.xxx.msi" /quiet

Configure the remaining program settings:

• Install behavior - System (installs in SYSTEM context)

• Device restart behavior - App install may force a device restart

Detection Rules

Detection rules tell Intune how to verify the agent was installed successfully. Choose one of the following methods:

Option A: MSI Product Code (simplest)

Select MSI as the rule type. Intune auto-populates the product code from the .intunewin package. Enable MSI product version check and set the operator to "Greater than or equal to" with the version you are deploying.

Option B: File-Based Detection

• Rule type - File

• Path - C:\Program Files\Harmony SASE

• File or folder - Harmony SASE.exe

• Detection method - File or folder exists

Option C: Registry-Based Detection

• Rule type - Registry

• Key path - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ProductCode}

• Value name - DisplayName

• Detection method - String comparison - Equals - Harmony SASE

Requirements

• Operating system architecture - 64-bit (or both 32-bit and 64-bit if needed)

• Minimum operating system - Windows 10 1607

Click Next through Dependencies and Supersedence (leave empty unless replacing a prior version). Click Next to proceed to Assignments.

Assign and Deploy

1. On the Assignments tab, under Required, click Add group.

2. Select the Entra ID device group(s) that should receive the .

3. Click Select, then Next.

4. Review the summary and click Create.

Intune deploys the app on the next device sync. The  installs silently with the workspace, region, and tenant token parameters embedded in the MSI command, enabling immediate SWG protection.

Verification and Troubleshooting

Verify a Successful Deployment

• The Check Point SASE  appears in the system tray and connects to the nearest PoP without certificate errors.

• In Intune admin center, go to Apps > Monitor > App install status and confirm the app shows as Installed for targeted devices.

• On the endpoint, open certlm.msc and verify the SASE root certificate appears under Trusted Root Certification Authorities > Certificates (installed automatically by the agent).

Common Issues

Useful Diagnostic Commands

# Check if the SASE agent is installed (PowerShell)
Get-WmiObject Win32_Product | Where-Object {
  $_.Name -like "*Harmony*SASE*"
} | Select Name, Version

# Verify the root certificate is in the Trusted Root CA store
Get-ChildItem Cert:\LocalMachine\Root | Where-Object {
  $_.Subject -like "*Check Point*" -or $_.Subject -like "*SASE*"
}

# Check the SASE agent service
Get-Service | Where-Object { $_.DisplayName -like "*Harmony*" -or
  $_.DisplayName -like "*Perimeter*" -or $_.DisplayName -like "*SASE*" }

# Force Intune sync
Start-Process -FilePath "ms-device-enrollment:?mode=mdm"

# View Intune Management Extension logs
Get-Content "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log" -Tail 50

MSI Command-Line Reference

• WORKSPACE - Your organization's Check Point SASE workspace identifier (for example, "acme-corp")

• REGION - Data residency region: US (America), EU (Europe), AU (Australia), IN (India)

• TENANT_TOKEN - Installation token from the SASE portal for Transparent Internet Access (v11.5+)

• EMAIL - Optional. User email for Transparent Registration when whoami /upn does not match

Full silent install example:

msiexec /quiet /i "Harmony_SASE_12.6.0.xxxx.msi" WORKSPACE="acme-corp" REGION="US" TENANT_TOKEN="eyJhbG..."

Silent uninstall:

msiexec /x "Harmony_SASE_12.6.0.xxxx.msi" /quiet

Check install status (useful for scripted deployments):

start /wait msiexec /quiet /i "Harmony_SASE_12.6.0.xxxx.msi" WORKSPACE="acme-corp" REGION="US" TENANT_TOKEN="eyJhbG..."
echo %errorlevel%

For additional MSI parameters and OS-specific commands, see Deploying the Agent.

Transparent Internet Access (Silent Deployment)

Starting with Check Point SASE  version 11.5, the Transparent Internet Access feature enforces internet security policies immediately upon agent installation, without requiring any end-user interaction. When deployed via Intune:

• The remote installation process bypasses both device and member registration.

• Users receive the latest security policies even if they have not signed in to the agent.

• Internet Access policy enforcement begins as soon as the agent is running, providing SWG protection from the moment of deployment.

• Private Access remains restricted until the user authenticates and registers on the platform.

Transparent Internet Access requires the WORKSPACE, REGION, and TENANT_TOKEN parameters to be passed during installation, which is handled through the msiexec install command in the Win32 app configuration. For more information, see Deploying the Agent.