> ## Documentation Index
> Fetch the complete documentation index at: https://docs.screenpipe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# deploy screenpipe via Microsoft Intune

> Fleet-deploy screenpipe enterprise to Windows devices via Microsoft Intune by assigning a Microsoft Entra group for automatic installation.

{/* https://screenpi.pe */}

deploy screenpipe enterprise to every Windows machine in a Microsoft Entra (Azure AD) security group via Intune. no per-laptop install, no IT touching individual devices. end-to-end takes \~10 minutes once you have the enterprise license.

<Note>
  this guide is for IT admins on **screenpipe enterprise**. consumer / team plans don't ship the .intunewin package. if you don't have a license yet, email [louis@screenpi.pe](mailto:louis@screenpi.pe).
</Note>

## prerequisites

* screenpipe enterprise license (your admin email is on the license's `admin_emails`)
* Microsoft Intune subscription (included in Microsoft 365 E3/E5, EMS E3/E5, or Intune standalone)
* a Microsoft Entra security group containing the users that should receive screenpipe
* access to the [Intune admin center](https://intune.microsoft.com)

## step 1 — download the .intunewin

sign in to [screenpi.pe/enterprise](https://screenpi.pe/enterprise) with the admin email on your license, open the **builds** tab, and download the latest **windows x64** `intunewin` file.

the `.intunewin` is a Microsoft Win32 Content Prep wrapper around a code-signed NSIS installer (`screenpipe_<version>_x64-setup.exe`). screenpipe builds this for every enterprise release.

## step 2 — create the Win32 app in Intune

in the [Intune admin center](https://intune.microsoft.com):

<Steps>
  <Step title="navigate to apps">
    **Apps → Windows → Add**. for app type pick **Windows app (Win32)**.
  </Step>

  <Step title="upload the package">
    **App package file** → upload the `.intunewin` from step 1. Intune reads the installer metadata automatically.
  </Step>

  <Step title="fill in app information">
    name, publisher, description as you'd like them to appear to end users in the Company Portal. logo: download from [screenpi.pe/icon.png](https://screenpi.pe/icon.png).
  </Step>
</Steps>

## step 3 — program (install & uninstall commands)

<CodeGroup>
  ```bash install command theme={null}
  powershell.exe -ExecutionPolicy Bypass -File install-screenpipe-enterprise.ps1
  ```

  ```bash uninstall command theme={null}
  "%ProgramFiles%\screenpipe\uninstall.exe" /S
  ```
</CodeGroup>

the `.intunewin` contains the signed NSIS installer plus `install-screenpipe-enterprise.ps1`. the wrapper runs the installer silently and writes `HKLM\SOFTWARE\screenpipe\InstallSource=Intune`, `UpdateManager=mdm`, and `Version=<build version>` so the app and enterprise dashboard can report that updates are Intune-managed.

| field                   | value                                                                                                       |
| ----------------------- | ----------------------------------------------------------------------------------------------------------- |
| install behavior        | **System** (machine-wide install — screenpipe enterprise is built `perMachine`)                             |
| device restart behavior | **No specific action** (no reboot required)                                                                 |
| return codes            | leave Intune's defaults (`0` success, `1707` success, `3010` soft reboot, `1641` hard reboot, `1618` retry) |

## step 4 — requirements

| field                         | value           |
| ----------------------------- | --------------- |
| operating system architecture | x64             |
| minimum operating system      | Windows 10 1809 |

## step 5 — detection rules

pick **Manually configure detection rules**. for first-time installs, a file-exists rule is enough:

| field                                          | value                       |
| ---------------------------------------------- | --------------------------- |
| rule type                                      | File                        |
| path                                           | `%ProgramFiles%\screenpipe` |
| file or folder                                 | `screenpipe-app.exe`        |
| detection method                               | File or folder exists       |
| associated with a 32-bit app on 64-bit clients | No                          |

Intune uses this to decide whether the install succeeded and whether the app is already present on subsequent check-ins.

for versioned upgrades, prefer a registry detection rule:

| field                                          | value                                           |
| ---------------------------------------------- | ----------------------------------------------- |
| rule type                                      | Registry                                        |
| key path                                       | `HKEY_LOCAL_MACHINE\SOFTWARE\screenpipe`        |
| value name                                     | `Version`                                       |
| detection method                               | String comparison                               |
| operator                                       | Equals                                          |
| value                                          | the version you uploaded, for example `2.4.208` |
| associated with a 32-bit app on 64-bit clients | No                                              |

without version-aware detection, Intune can tell that screenpipe exists but cannot tell whether a device is still on an older release.

## step 6 — dependencies & supersedence

screenpipe ships everything it needs (WebView2, ONNX Runtime, ffmpeg) bundled inside the NSIS installer. **leave dependencies empty.**

if you're updating from an older deployed version, set **supersedence** to the previous Intune app entry so Intune uninstalls the old version cleanly.

## step 7 — automatic updates

screenpipe enterprise supports two update managers:

* **Intune/MDM-managed**: the recommended default for centrally managed fleets. upload each new `.intunewin`, use the registry `Version` detection rule above, and supersede the previous app entry.
* **Screenpipe-managed automatic updates**: the app can self-update from signed enterprise releases when enabled in the enterprise dashboard.

in the enterprise dashboard, leave app updates on **auto-detect** unless you explicitly want the app to self-update. devices installed through this Intune package stamp `UpdateManager=mdm`, so auto-detect keeps in-app updates disabled and lets Intune remain the source of truth.

## step 8 — assignments

assign as **Required** to the Microsoft Entra security group containing your screenpipe users (e.g. `screenpipe-users`). Intune will install screenpipe on every device a group member signs into — typically within \~1 hour of next Intune check-in, or immediately if the user clicks **Sync** in Company Portal.

<Tip>
  also assign **Uninstall** to a "screenpipe-revoke" group if you want a kill switch — moving a user there triggers an automatic uninstall at next check-in.
</Tip>

## step 9 — activate the enterprise license

screenpipe needs the license key to enable enterprise mode (centralized telemetry, policy enforcement, dashboard access).

<Tabs>
  <Tab title="users paste it once">
    after Intune installs screenpipe, users open **Settings → Enterprise**, paste the license key, and sign in. the key is stored in the Tauri secure store on their device.
  </Tab>

  <Tab title="pre-stage via registry (zero-touch)">
    add a **PowerShell script** to your Intune device-configuration profile, assigned to the same group, that writes the key before screenpipe first launches:

    ```powershell theme={null}
    $key = "ENT-XXXX-XXXX-XXXX-XXXX"  # your license key
    New-Item -Path "HKLM:\SOFTWARE\screenpipe" -Force | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\screenpipe" -Name "EnterpriseLicenseKey" -Value $key -Type String
    ```

    screenpipe reads `HKLM\SOFTWARE\screenpipe\EnterpriseLicenseKey` on first launch and self-activates without user interaction.
  </Tab>
</Tabs>

## verifying the deployment

* in the Intune admin center: **Apps → screenpipe → Device install status** shows per-device install state
* on the device: `C:\Program Files\screenpipe\screenpipe-app.exe` exists, screenpipe icon appears in the system tray after first user sign-in
* in the [enterprise dashboard](https://screenpi.pe/enterprise) → **devices** tab: each installed device starts heartbeating within minutes of launch, scoped to your license

## troubleshooting

<AccordionGroup>
  <Accordion title="installation succeeds in Intune but screenpipe doesn't open">
    NSIS perMachine installs to `%ProgramFiles%\screenpipe` but doesn't add a Start Menu autostart by default. users either launch from Start Menu, or you can enable autostart via the enterprise policy: in the [enterprise dashboard](https://screenpi.pe/enterprise) → **policy** → toggle `autostart_on_login: true`.
  </Accordion>

  <Accordion title="device shows install failure with exit code 2 or 1603">
    almost always insufficient privileges — confirm install behavior is **System**, not **User**. user-context installs can't write to `%ProgramFiles%`.
  </Accordion>

  <Accordion title="screenpipe shows 'license invalid' after install">
    either the registry pre-stage didn't run before first launch (check Intune script assignment / order) or the license key has expired. check expiry in the [enterprise dashboard](https://screenpi.pe/enterprise) → **policy** → license info.
  </Accordion>

  <Accordion title="audio recording doesn't start">
    on Windows, microphone access is permission-gated. either deploy a Windows privacy-settings profile that grants screenpipe microphone access, or have users approve once at first launch. policy-based grant is cleaner for fleet deployments — contact us if you need the AppX-style manifest mapping.
  </Accordion>
</AccordionGroup>

## also see

* macOS Jamf / Kandji / Mosyle deployment: contact us — `.pkg` distribution flow is identical in shape to the above but with macOS MDM tooling
* enterprise dashboard reference: [screenpi.pe/enterprise](https://screenpi.pe/enterprise) (members, devices, pipes, policy, builds)
* questions or stuck: [louis@screenpi.pe](mailto:louis@screenpi.pe)