Deploying the desktop agent with Microsoft Intune

Deploy the desktop capture agent as an Intune Win32 app in user context, assigned to a user group. The browser extension is a separate guide: Rolling out the browser extension.

Before you start

• Devices are enrolled in Intune and Microsoft Entra joined (or Entra hybrid joined).
• An Entra group of the engagement's users exists (a user group, not a device group).
• You have flowscope-<version>.intunewin from the dashboard's admin setup checklist (Agent (.intunewin) download). Pre-wrapped; no tooling needed.

Create the Win32 app

In the Microsoft Intune admin center: Apps → Windows → Create, pick Windows app (Win32), Select app package file, upload the .intunewin.

Step 1 · App information

• Name → flowscope agent
• Publisher → flowscope
• Description → flowscope
• Leave the rest blank.

Step 2 · Program

• Installer type → Command line
• Install command → flowscope-agent-windows.exe /S (the file inside the package; it keeps this name every release, so this command never changes)
• Uninstaller type → Command line
• Uninstall command → "%LOCALAPPDATA%\flowscope\uninstall.exe" /S
• Installation time required (mins) → leave default
• Allow available uninstall → Yes
• Install behavior → User
• Device restart behavior → Determine behavior based on return codes
• Return codes → leave defaults

Step 3 · Requirements

• Check operating system architecture → Yes
• Install on x86 system → off
• Install on x64 system → on
• Install on ARM64 system → off
• Minimum operating system → Windows 10 1809
• Leave disk / memory / CPU blank.
• Configure additional requirement rules → none

Step 4 · Detection rules

Rules format → Use a custom detection script. Intune accepts a .ps1 file only, not pasted text. Download and upload as-is:

# Intune Win32 custom detection rule for the per-user flowscope agent.
#
# Why a script and not a file rule: the agent installs per-user into
# %LOCALAPPDATA%\flowscope (Tauri NSIS installMode=currentUser). Intune
# evaluates detection in the SYSTEM context, where %LOCALAPPDATA% resolves to
# C:\Windows\System32\config\systemprofile\AppData\Local — so a built-in
# %LOCALAPPDATA% file rule (or an HKCU registry rule) silently never matches.
# This script enumerates every real user profile instead.
#
# Intune contract: exit code 0 AND non-empty STDOUT = "detected" (skip install);
#                  exit 0 with empty STDOUT          = "not detected" (install).
# Detection is presence-based on purpose: once installed, the agent keeps itself
# current via the in-app updater, so Intune should install once and then leave
# version management to the updater rather than re-pushing on every release.

$ErrorActionPreference = 'SilentlyContinue'

Get-ChildItem 'C:\Users' -Directory | ForEach-Object {
  $exe = Join-Path $_.FullName 'AppData\Local\flowscope\flowscope.exe'
  if (Test-Path $exe) {
    $version = (Get-Item $exe).VersionInfo.ProductVersion
    Write-Output "flowscope $version detected for profile $($_.Name)"
  }
}

exit 0

• Run script as 32-bit process on 64-bit clients → No
• Enforce script signature check and run script silently → No

Step 5 · Dependencies

Skip.

Step 6 · Supersedence

Skip. The agent self-updates.

Step 7 · Assignments

• Required → the engagement's user group
• Leave Available for enrolled devices and Uninstall empty

Step 8 · Review + create

Create. The agent installs for each assigned user at their next Intune check-in and shows as Installed per user.

Network egress

The agent reaches two hosts over TCP/443 HTTPS, both of which must be allowed. It talks to app.flowscope.com for ingestion, pairing, sign-in, and the version-check and download-link requests that drive auto-update. Those requests then hand back a short-lived signed URL, so the installer and updater bytes themselves download from the agent-releases blob host (stflowscopeagentrel.blob.core.windows.net); that host must be reachable for both the initial download and auto-update to complete. Standard HTTPS, no certificate pinning. Full egress list including the extension's host: Network and security requirements.

Confirming the rollout

Success shows as the agent Installed per user under the app in Intune, plus flowscope in the user's Start menu.

If install fails, check in order:

1. The app's per-user install status in Intune.
2. %ProgramData%\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log and AgentExecutor.log.
3. If a Defender ASR rule is blocking the install, the section above. The block shows in the Windows event log under Windows Defender → Operational (1121/1122).
4. The detection rule. It must be the script above, not a %LOCALAPPDATA% file rule.