Managed rollout: where to start

In a managed rollout you set BeeSensible up centrally for your organisation, so that employees do not have to install or configure anything themselves. The extension appears in Chrome and Edge on its own, employees sign in with their work account without typing an address, and the desktop app installs silently in the background. This guide is written for the IT administrator who handles that through Microsoft Intune. Work through the articles from top to bottom: each step builds on the previous one and ends with a check of what you should see at that point.

#The order

The rollout console shows the same steps as this guide, under the same names and in the same order:

1. Identity. You verify your organisation's email domain and connect the identity provider. Without this step BeeSensible cannot assign a new employee to your organisation, and that employee ends up outside it.
2. Provide work sign-in. The sign-in script prepares each employee's work account, so that they do not type an address or pick an account when they sign in.
3. Install the extension automatically. You use browser policy to force-install the extension in Chrome and Edge.
4. Desktop app. This step is optional by default, and you can also roll the app out later. If BeeSensible has set up detection on the device for your organisation, the app is a prerequisite and comes before the extension.
5. Verify. You check the whole chain with a pilot group and then roll out organisation-wide.

#One choice up front

Before you start, decide who controls the version of the desktop app, because that choice determines which installer you deploy. If the app updates itself, it installs in the employee's profile and fetches new versions on its own, which suits small teams and individual machines. If you control the version, the app installs machine-wide and you publish every update yourself through Intune, which suits a managed fleet. The differences are set out in First, choose the installer.

#Detection on the device

By default, BeeSensible checks text in the cloud, on its own servers at European providers. In that set-up the desktop app is optional. Your organisation can also choose to run detection on the device itself, so that the text being checked never leaves the device. BeeSensible sets this up for you on request; it is not a setting you switch on in the dashboard. For the rollout, it changes the following:

• The desktop app becomes a prerequisite on every workstation, because it runs the detection for the extension. That is why the app comes before the extension; the console then reorders the steps for you.
• After sign-in, the app downloads a detection package of roughly 2.4 GB once per version. First use therefore takes longer, and the list of hosts for your firewall gains one more.
• More runs on the device, so there is more to check during the pilot.

If you want detection on the device, email hello@beesensible.euCopy. We let you know when the console shows the new order.

#What you need

For a rollout through Intune, your devices and your organisation need the following:

• Devices running Windows 10 (64-bit) or Windows 11, joined to Microsoft Entra ID (Entra joined) and enrolled in Intune. TestedWindows 11, 31 August 2026
• A verified domain and a connected identity provider in BeeSensible; Identity explains how to set these up.
• A target group: a security group in Entra containing the users you are rolling out to. Start with a small pilot group, then assign the same profiles and scripts to the rest of the organisation.

#Network and firewall

If your network filters outbound traffic, devices must be able to reach a number of BeeSensible hosts. The console lists them, with what each one is for. Microsoft publishes the endpoints Intune itself needs in its own documentation.

If you allowlist applications, bear in mind that the desktop app starts its own helper process for detection. In Task Manager and in the reports of your EDR software, that process appears as python.exe, running from the BeeSensible installation folder:

C:\Program Files\BeeSensible\resources\sidecar\python\python.exe