# Agent troubleshooting
Source: https://docs.idemeum.com/agent-logs

Troubleshoot idemeum AI support agent.

# Support agent logs

Most issues fall into one of three buckets: the agent can't reach the cloud (skills and tickets stop updating), a permission is missing (specific skills stop before executing), or configuration didn't apply (the agent reads its `.env` once at startup). This page covers where to look, starting with the logs, which almost always contain the answer: the agent logs every run, every gate decision, every cloud call, and every rejected skill update with the reason.

| **OS** | **Path** |
| :- | :- |
| macOS | \~/Library/Logs/AI Support Agent/idemeum-agent.log |
| Windows | %APPDATA%\AI Support Agent\logs\idemeum-agent.log |


# Overview
Source: https://docs.idemeum.com/ai-agents-overview

AI agents to manage IT autonomously.

## The AI agents for IT

| | Purpose | Trigger | Runs on |
| - | - | - | - |
| `Assist` | Help employees | A person asks | Employee's computer |
| `Automate` | Automate IT flows | Webhook | Idemeum cloud |
| `Operate` | Operate IT products | An admin asks | Idemeum cloud |

## Assist

<Columns>
  <Column>
    A desktop app that runs on employees' computers and helps resolve IT issues. Describe a problem in plain language, and Assist repairs the machine itself (VPN issues, low disk space, etc.) or orchestrates cloud actions (password reset, access request, etc.).
  </Column>

  <Column>
    <Card title="Assist overview" icon="handshake-angle" href="/assist-overview">
      Desktop AI agent to resolve employee IT issues.
    </Card>
  </Column>
</Columns>

## Automate

<Columns>
  <Column>
    Cloud AI agent that is triggered by a webhook. Designed to automate IT workflows, such as employee onboarding, ticket management, and more. It starts when another system sends an event or on a schedule you set, and connects to your systems through idemeum connectors.
  </Column>

  <Column>
    <Card title="Automate overview" icon="user-robot" href="/automate-overview">
      Cloud AI agent to automate IT workflows.
    </Card>
  </Column>
</Columns>

## Operate

<Columns>
  <Column>
    Operate is the agent IT teams ask. When an admin asks something like *"why can't user sign in?"*, Operate checks your identity provider, device management and RMM tools, covering account status, sign-in failures, MFA registration and device health, and reports the cause.
  </Column>

  <Column>
    <Card title="Operate overview" icon="truck-container" href="/operate-overview">
      AI agent that investigates and acts across your entire IT stack.
    </Card>
  </Column>
</Columns>


# Analysis AI agent
Source: https://docs.idemeum.com/ai-for-endpoint-control/analysis-ai-agent

AI agent that analyses and explains every application and elevation event.

## What is analysis AI agent?

Idemeum integrates with major LLM providers (Anthropic, OpenAI, and Google Gemini) to leverage the latest models to analyze and explain elevation and execution events. We follow the BYOK (Bring Your Own Key) model, so that you can use your API key to integrate with the LLM provider of choice. Analysis agent explains every event metadata concisely so you can make a quick decision if the application or elevation is safe.

Every time there is an execution or elevation event, you can trigger `AI explanation`, and idemeum will submit event metadata, decision snapshots, along with our custom developed prompts to LLM mode so that every event can be explained.

## Configure analysis AI agent

* Access you idemeum admin portal
* Navigate to `Care settings ` → `AI`
* Enable AI analysis agent with a toggle, choose the LLM provider, model, and input your API key
* Save the configuration

<img alt="Clean Shot 2026 05 26 At 15 52 30@2x" />

## Trigger AI explanation

Navigate to you `Activity` and then choose `Events` or `Requests` and find the event of your choice. Click on `...` and then choose `AI explanation`.

<img alt="Clean Shot 2026 05 26 At 15 45 17@2x" />

The new pop up will open and you will see the streaming of LLM generated explanation. It will include events description along with key metadata so that you can assess how safe the event is.

<img alt="Clean Shot 2026 05 26 At 15 47 20@2x" />


# Allowlisting overview
Source: https://docs.idemeum.com/allowlisting-overview

Control what is allowed to run on Windows and macOS, block malware.

## Allowlisting demo

<Card title="Allowlisting for Windows" icon="video" href="https://www.youtube.com/watch?v=GY2m-_UfRvc">
  Youtube video for Windows allowlisting
</Card>

<Card title="Allowlisting for macOS" icon="video" href="https://www.youtube.com/watch?v=NnLWutlddJc">
  Youtube video for macOS allowlisting
</Card>

## What is allowlisting?

<Check>
  Allowlisting (formerly known as whitelisting) is a proactive cybersecurity practice that permits only explicitly pre-approved applications on your workstations. Operating on a `deny-by-default` principle, it blocks everything not on the approved list, significantly reducing risks from unknown malware, ransomware, and unauthorized access. 
</Check>

Instead of blocking everything that is bad in your environment, you explicitly allow what applications need to run on user workstations. In simple terms, you only allow applications that you trust, and block everything else, including malware and ransomware. When idemeum agent is installed, it intercepts every process execution event and applies `Default deny` policy - if application is not explicitly trusted, it is not allowed.

Allowlisting does not follow the same philosophy of classic block listing approach:

| Security | How it works |
| - | - |
| <Badge icon="filter-circle-xmark">Block-listing</Badge> | Default allow policy with certain apps blocked. Cat and mouse game, you have to constantly track what is bad and update your rules. |
| <Badge icon="shield-check">Allowlisting</Badge> | Default deny policy with certain apps allowed. You only allow what you need and do not worry about malicious applications. |

## Allowlisting primary features

<AccordionGroup>
  <Accordion title="OS binary trust" icon="binary">
    Idemeum automatically trusts Microsoft Windows files that are marked as `OSBinary`. These files are critical for OS operation, and idemeum is not interrupting any critical system flows. As a result you can update and user Windows OS normally.
  </Accordion>

  <Accordion title="Granular rule engine" icon="pen-ruler">
    Idemeum offers a granular rule engine to define what applications are allowed in your environment. Not only can you define what is allowed to `run` (leveraging file attributes, publisher certificate thumbprints, or certificate elements), but you can also define if the application is allowed to `elevate` automatically or not.
  </Accordion>

  <Accordion title="Application fencing" icon="fence">
    When you allow an application, you can also define what that application is allowed to do. If you trust an application from a verified publisher, there is no need to track every single thing this application is doing and launching. Idemeum will do that for you by constructing and tracking the process chain. If you prefer, you can specify specific executables that your trusted application is allowed to run.
  </Accordion>

  <Accordion title="Application catalog" icon="square-list">
    Idemeum offers a pre-configured rules catalog to cover most commonly used Windows and macOS applications. With a click of a button you can allow an application in your environment.
  </Accordion>

  <Accordion title="App store control" icon="store">
    Not only can you control executables directly installed on your workstations, but also control what applications can be delivered from Windows and Apple stores.
  </Accordion>
</AccordionGroup>


# Allowlisting events
Source: https://docs.idemeum.com/allowlisting/allowlisting-events

Idemeum tracks every execution across your workstations and represents each application as an event in the cloud.

## How allowlisting events work

<Note>
  Allowlisting events are collected only when allowlisting is [enabled](/allowlisting/enable-allowlisting), and the [app control mode](/allowlisting/app-control-mode) for the device is set to `audit` or `rules`.
</Note>

* Events are captured on Windows and macOS workstations when applications execute
* Idemeum agent tracks binary executions for `exe`, `msi`, `dmg`, and `pkg` files
* Allowlisting execution events are uploaded to idemeum cloud every `5 minutes`

## Allowlisting event structure

To access allowlisting events navigate to your admin portal and access `Activity` → `Events`. You will be presented with the high level view of all events for your tenant. You can click on each event to expand the metadata for the event.

You can immediately see if EPM and / or Allowlisting are enabled for your tenant. If you see `Execution` column populated for each event, then Allowlisting is enabled. If you see `Elevation` column populated for each event, then EPM is also enabled. \\

<img alt="Clean Shot 2026 05 25 At 12 50 16@2x" />

| Value | Example | Description |
| - | - | - |
| Timestamp | `1/30/26 3:33:52 PM` | Date and time for when the execution or elevation happened. |
| Computer | `AL-W11-L` | Workstation that generated the event. Next to the computer name you will see the icon for Windows or macOS. |
| User | `SYSTEM` | User under which context the application is executing. |
| Filename | `updater.exe` | Filename of the executed application. |
| Execution | `Windows Chrome` | Tag that shows whether the application was allowed to execute or not. When in audit mode, the tag will be `Audit` as there are no rules enforcement. If you hover over the tag, you will see the rule that is matching the execution based on which the decision is made. |
| Elevation | `Allow` | Tag that shows whether the application was allowed to elevate or not. For standard non-admin executions this tag is not shown. |
| Confidence score | `Soft allow` | Idemeum confidence score that shows how safe the application is in your environment. We use 20+ behavioral attributes to calculate the score. Learn more [here](/application-trust/confidence-score). |
| Reputation | `Known good, Unknown, Malware` | Reputation of the file obtained from Sophos Intelligence cloud. Learn more [here](/application-trust/malware-reputation). |
| Publisher | `Google LLC` | Organization that signed the executable. If you expand the event, you will be able to see whether the publisher is verified by operating system or not. |
| Parent | `services.exe` | Parent process that was responsible for launching the executable. |
| Actions | `...` | Actions that you can take on the event, including rule creation. |
| Description | `Google updater` | Description of the executable file. |
| File path | `C:/program...` | File path from where the executable is launching. |
| File version | `2.5.1` | File version of the executable. |
| SHA256 hash | `320F6790E928200...` | Hash of the executable file takes with SHA256 algorithm. |
| Verified publisher | `Yes` | If the executable is legitimately signed with the certificate, and that certificate is trusted on the endpoint, the publisher will show as verfified. |
| Certificate thumbprint | `607A3EDAA64933...` | Hash of the certificate that is used to sign the executable (if executable is signed). |
| Certificate elements | `CN=Google LLC,OU=Google...` | When you expand the event, idemeum shows you the elements of the certificate that is used to sign the executable, such as `CN`, `OU`, `C`, etc. |


# Allowlisting rules
Source: https://docs.idemeum.com/allowlisting/allowlisting-rules

With rules you define what is blocked and what is allowed to execute on your workstations.

## How to think about allowlisting rules

<Note>
  In this case we are showing the end to end cycle of the rule where both [allowlisting](/allowlisting/allowlisting-overview) and [EPM](/epm/endpoint-privilege-management-overview) are enabled. You can [enable EPM](/epm/enable-endpoint-privilege-management) or [allowlisting](/allowlisting/enable-allowlisting) or both.
</Note>

<Steps>
  <Step title="What is the application?">
    The first part of the rule is to catch or match the application you are trying to control. Before allowing something, we need to know what we are allowing. You can match the target application using `file attributes` (hash, name. path, etc.), `publisher thumbprint` (the hash of the certificate that is used to sign the executable, or `certificate elements` (when application is signed you can use certificate elements of the signing certificate to match the app).
  </Step>

  <Step title="Allow execution? ">
    With allowlisting the default policy is to `default deny` everything. if you want to allow an application you need to allow execution, otherwise the application will not launch.
  </Step>

  <Step title="Control what app is doing? ">
    With application fencing you can control child process execution or application interactions (i.e. notepad can not launch command prompt). You can allow all child processes if you trust the application, or define the custom set of processes that application can launch.
  </Step>

  <Step title="Allow elevation? ">
    If an application requires admin privileges, and you maintain standard rights for all users, you can allow the application to automatically elevate.
  </Step>

  <Step title="Can users request? ">
    When application or elevation is blocked, your users can request the permission to run or elevate the application.
  </Step>
</Steps>

## Rule best practices

These are some of the best practices related to rule management:

* Give rules descriptive names so that you know what the rule is doing
* The best rules are the ones that leverage `certificate elements`. For instance you create a rule that allows everything that is signed by certificate belonging to `Zoom Inc`.
* If you do not want to use certificate elements, use `certificate thumbprint`. This is second best. Allowing the whole organization might be too broad, but allowing a certain publisher certificate is a good balance. When the application is updated, rule will still work. But if the organization renews the certificate, you will need to update the rules.
* If the application is not signed and you can not use certificates, then use `file attributes`. Bear in mind that `hash` based rules are the worst, because if the application is updated, the hash will change, and the rule will no longer work. For applications that launch from protected paths, you can leverage the `path` rules, for instance for Windows apps that launch from protected directory.

## Catalog rules

Idemeum comes pre-configured with allowlisting and elevation rules for most common applications. We constantly update applications to make sure the rules are current and do not create any disruptions. With a click of a button you can allow most used applications in your environment.  Idemeum comes pre-configured with allowlisting and elevation rules for most common applications. We constantly update applications to make sure the rules are current and do not create any disruptions. With a click of a button you can allow most used applications in your environment.

<Card title="Catalog rules" icon="book-arrow-up" href="/allowlisting/application-catalog">
  Create elevation or allowlisting rules with a single click.
</Card>

## Create allowlisting rule

If you want to create your own custom rules or allow applications that are not listed in idemeum catalog, you can simply do that from the event. Launch the application you want to allowlist (or trigger elevated launch), the event will be generated and sent to the cloud. Now you can create rule from the event.

* Navigate to the admin portal of your idemeum tenant
* Access `Activity` → `Events` section
* Search for the application / event that you want to create a rule for
* Click on `...` and choose to create a rule
* All metadata for the event will be pre-populated and you can start selecting the attributes.
* Define rule by providing the rule name, choosing the OS where you want the rule to apply, and provide the rule scope (for MSP setting, `local` - only apply to one customer tenant, `global` - apply cross customers).

<img alt="Clean Shot 2026 05 25 At 13 03 01@2x" />

* Now you can match the application by selecting the attributes. Simply check the box next to the attribute that you want to use to identify the application.

<img alt="Clean Shot 2026 05 25 At 13 04 53@2x" />

* Define if you want to allow the application to execute and specify the application fencing rules. You can allow all child processes for an application, or you can create a custom rule to define what the application is allowed to do.

<img alt="Clean Shot 2026 05 25 At 13 06 09@2x" />

* As a final step define if the application is allowed to elevate or not.

<img alt="Clean Shot 2026 05 25 At 13 07 19@2x" />

## Allowlisting rules Regex

Idemeum rule engine supports regular expressions when matching the applications using various attributes. We support regex for `file name`, `file path`, and `certificate elements`. We use case-insensitive match.

* Match the exact file name for the edge browser

```regexp theme={null}
^msedge.exe$
```

* Match any filename that contains `video`

```regexp theme={null}
.*video.*
```

* Match the path that starts with `C:\Program Files\WindowsApps\` and then contains `linkedin` in the path

```regexp theme={null}
C:\Program Files\WindowsApps\.*linkedin.*
```

* Use this in `O `for certificate element to match anything that is signed by organization that contains `Microsoft`

```regexp theme={null}
Microsoft.*
```


# Allowlisting control mode
Source: https://docs.idemeum.com/allowlisting/app-control-mode

Configure how idemeum agent is enforcing allowlisting rules on each endpoint.

## Allowlisting control modes

You can control how allowlisting behaves for each of your devices in idemeum. `App control mode` defines how idemeum agent behaves for rule enforcement and event collection.

| Mode | Definition |
| - | - |
| <Badge>Disabled</Badge> | idemeum agent is not capturing any `execution` events and not enforcing any rules. User experience does not change on the workstation. |
| <Badge>Audit</Badge> | idemeum agent is capturing `execution` events and uploading them to the cloud periodically. However, agent is not applying any rules or interrupting execution or elevation flows. |
| <Badge>Rules</Badge> | Idemeum agent controls application `executions` and enforces the rules that you created in the portal. For allowlisting `default deny` policy is applied for untrusted applications. If the application is not explicitly allowed, it will not run. |

## Change allowlisting control mode

* Navigate to your idemeum admin portal
* Select `Devices` and search for the device you want to change the app control mode for
* Click on `...` then choose `Set app control mode`
* Choose the mode and save the configuration

## Bulk allowlisting control mode change

* Navigate to your idemeum admin portal
* Access `Devices` section and select multiple devices with check boxes
* Click on the bulk change button at the top and choose `Set app control mode`
* Choose the mode and save the configuration


# Application catalog
Source: https://docs.idemeum.com/allowlisting/application-catalog

One-click rules to allowlist and automatically elevate applications.

## Create pre-configured catalog rule

Idemeum comes pre-configured with allowlisting and elevation rules for most common applications. We constantly update applications to make sure the rules are current and do not create any disruptions. With a click of a button you can allow most used applications in your environment.

* Navigate to the admin portal of your child tenant
* Access `Activity` → `Rules` → `Add rule` → `Catalog rule`
* Choose the rules that you want by selecting the applications
* Save the configuration and the rules will be automatically added

<Tip>
  Rules will be added to your list and the names for catalog rules will start with `Catalog-<appname>`. If you want to remove the rule, simply delete it from your list.
</Tip>

<img alt="Clean Shot 2026 05 25 At 13 10 39@2x" />


# Application fencing
Source: https://docs.idemeum.com/allowlisting/application-fencing

Application fencing controls what applications can do once they are running. 

## How application fencing works

With application fencing you can control how your application interacts with other applications. Or in other words, what child processes / applications your current application is allowed to launch.

When legitimate applications are launched, they are doing many things on your system, including other application launches. For instance when you launch `GitHub client` on Windows, it launches other applications such as `git.exe` on your system along with other things. However, certain behaviors need to be restricted, such as `Microsoft Word` document trying to launch `PowerShell`.

## Configure application fencing

If you trust the application publisher / developer, the simplest way is to allow all child processes for that application. This way you do not have to manually track what application needs to install / launch.

Idemeum allows you to create custom rules to explicitly allow or deny certain interactions. For instance, you can deny all applications for `notepad.exe`, or deny only `powershell.exe` for Microsoft Word while allowing to launch other Microsoft applications.

* Navigate to your idemeum admin portal
* Create a manual rule, rule from event, or edit any other idemeum catalog rule
* Navigate to `Application fencing` section and choose `Custom rule`
* Click `+` button to define custom rule
* You can add as many application fencing allow or deny rules as you need
* Save the configuration

<img alt="Clean Shot 2026 05 25 At 13 12 46@2x" />


# Confidence score
Source: https://docs.idemeum.com/allowlisting/confidence-score

Each application is assigned a confidence score to determine how safe the application behaves

## Overview

When idemeum captures an application event (either execution event for allowlisting or elevation event for elevation control), it calculates a `confidence score` for that application.

<Info>
  `Confidence score` determines how confident we are that allowing execution or elevation of this app is save in our environment. For each application we look at more than 20 signals, calculate the score as a weighted sum across independent signal groups, and then present the score as a recommendation zone.
</Info>

We look at the following signal categories:

| Category | Definition |
| - | - |
| Identity trust | Capturing signals that represent the metadata of the application, including signature, verified publisher, OS binary, etc. |
| Execution context risk | Capturing signals related how application executes, from what path, under what context, what is the parent process chain and more. |
| Prevalence and history | Capturing stats how prevalent this application is across idemeum customers and how and when it was seen in your environment. |
| Malware verdict | Capturing signals, reputation and metadata returned by Sophos reputation API |
| Policy trust | What rules the application matching |

At the end of the scoring computation we return the confidence zone for each application:

* `hard block` - certainly malicious
* `high risk` - likely unsafe to allow
* `ambiguous`- applications and needs careful review
* `soft allow` - likely safe to allow for the organization
* `allow` - high confidence of a safe application

Here is the example of the confidence score calculation:

```text theme={null}
- Signed by Microsoft
- Standard User + running from Program Files
- Low Tenant Prevalence
- CLEAN Reputation
- Publisher allow rule

=  89.5

—>  High Confidence Allow
```

## Where confidence score is shown

Confidence score is shown in all places where you are interacting with an application event:

* For each application event in the portal in the `Events` table
* For each elevation or execution request in the web portal
* Mobile request notifications
* Email admin notifications
* Tickets we create in the ticketing system

Here is the example of the confidence score displayed in the admin portal `Events` view:

<Frame>
  <img alt="Clean Shot 2026 04 16 At 12 34 58@2x" />
</Frame>


# Enable allowlisting
Source: https://docs.idemeum.com/allowlisting/enable-allowlisting

Enable allowlisting for your organization.

## Turn allowlisting on for your tenant

Before you start using allowlisting and enforcing application control, you need to enable the feature for your tenant:

* Login to your idemeum admin portal
* Access `Control settings` → `Allowlisting`
* Enable the product with a toggle

<img alt="Clean Shot 2026 05 25 At 12 36 09@2x" />


# Events deep dive
Source: https://docs.idemeum.com/allowlisting/events-deep-dive

Deep dive into how allowlisting events work for major use cases. 

## How allowlisting events work

<Note>
  Let's review the major cases of events that you will encounter in idemeum. Here we assume both `Allowlisting` and `Endpoint Privilege Management` are enabled.
</Note>

### Launch app without elevation

Let's say there is no rule for `cmd.exe`. You launch `cmd.exe`, and it gets blocked. There is one execution event generated.

<img alt="Image1" />

Now you create a rule for `cmd.exe` to allow execution, but not allowing child processes. You launch `cmd.exe`, and it is allowed.

<img alt="Image2" />

Let's now explore [application fencing](/documentation/products/allowlisting/application-fencing). You have a rule for `cmd.exe` to allow execution, but not allowing any child processes. You launch `tor.exe` from `cmd.exe`. The TOR launch is blocked. And in the event you can see the message that child process is denied.

<Warning>
  Even if you have a direct rule for `TOR` to allow it, when launching `TOR` from `cmd`, `TOR` will still be blocked becase of application fencing control.
</Warning>

<img alt="Image3" />

Now you edit the existing rule for `cmd.exe` to also allow child processes. You launch `tor.exe` from `cmd.exe`. The execution is allowed. And the badge now shows `Child allowed`.

<img alt="Image5" />

### Launch app with elevation

Let's say you do not have a rule for `notepad++.exe`. Execution is not allowed, and elevation is not allowed. When you trigger `notepad++` installation, the elevation screen is presented and the application is blocked. One event is generated with both execution and elevation denied.

<img alt="Image6" />

Now you have created a rule for `notepad++.exe`. You allow execution and configure the application to automatically elevate. When you trigger `notepad++` installation, elevation screen is presented and then allowed. Installation goes through. There are two events generated - one for elevation, and one for successful execution.

<img alt="Image7" />


# Publishers view
Source: https://docs.idemeum.com/allowlisting/publishers-view

Discover all publishers in your environment so that you can create allowlisting rules with a single click. 

## Overview

When idemeum collects application events, it aggregates information to populate the publishers view. You can quickly see all publishers in your environment and create allow rules with a single click.

* Access your idemeum admin portal
* Navigate to `Activity` → `Events` and then toggle `Learned apps`

<img alt="Clean Shot 2026 05 25 At 13 17 47@2x" />

Now you can see all publishers discovered in your environment.

* `Publisher` - the publisher CN from the application signing certificate.
* `Executables` - the count of applications signed but the publisher. You can click on the number to explore all the files.
* `Confidence` - aggregate confidence score for the publisher. Learn more about [confidence score](/application-trust/confidence-score).
* `Reputation` - aggregate [malware reputation](/application-trust/malware-reputation) for the publisher.
* `Devices` - count of the number of devices that have files signed by this publisher.
* `Rules` - if there is a checkbox that means there are some rules in your environment for this publisher.
* `Country` - country where this publisher certificate is registered

If you want to create a publisher rule with a single click, click on `...` and choose `Create rule`.


# Snooze pop ups
Source: https://docs.idemeum.com/allowlisting/snooze-pop-ups

Prevent multiple block pop ups for the same application.

## Configure block pop ups snoozing

When the application is blocked by allowlisting module, users will see a deny pop up informing them that an application is blocked. Sometimes an application might be persistently restarting in the background / trying to launch again, whereby causing a never ending stream of pop ups. As a result, once the user acknowledges the pop up, it will come up again a couple of seconds later.

In order to prevent this behavior users are given an option to snooze the notifications for the same application for a day. All they need to do is to check the box to snooze the notification. The option to snooze deny pop up notifications is available on both Windows and macOS.

<img alt="Snooze" />


# Allow verified publishers
Source: https://docs.idemeum.com/allowlisting/verified-publishers

Automatically trust all verified publishers on Windows and macOS.

## What are verified publishers?

When application allowlisting is initially deployed by IT teams, there is a concern that operational load will increase. With the `default deny` approach all applications are blocked, unless there is an explicit rule allowing an application. As a result, some applications might be missed, users will be frustrated, and the volume of support tickets will increase.

In order to mitigate this challenge idemeum offers a middle ground approach that provides a great balance between security and usability. With idemeum you can create a rule to **allow all verified publishers on macOS and Windows**. What that means is that any application that is legitimately signed by a verified developer (registered Windows or macOS developer) is allowed along with its dependencies.

* When the application is launched, idemeum agent will extract the signing certificate chain from the application in order to verify trust
* On macOS we leverage `codesign` command to extract the certificate and then use `security verify-cert` to determine if the application is trusted by the local trust store
* On Windows we leverage `Get-AuthenticodeSignature` command that returns the status of the application signature and whether it is trusted by Windows trust store
* What is more, idemeum will automatically allow all dependencies that these verified applications need (allowing all child process executions)

## Configure all verified publishers rule

* Navigate to your idemeum admin portal
* Access `Activity` -> `Rules` -> `Add rule` -> `Catalog rule`
* You can now choose the rule for `Windows` or `macOS`. Select the rule that allows `All verified publishers`
* Save the configuration

<Note>
  If you want to create additional `Deny` rules, for instance you want to allow all verified publishers but still block the `cmd.exe`, you can then create a separate deny rule for `cmd.exe`.
</Note>

<img alt="Clean Shot 2026 05 25 At 13 15 10@2x" />


# Create Plant
Source: https://docs.idemeum.com/api-reference/endpoint/create

POST /plants
Creates a new plant in the store



# Delete Plant
Source: https://docs.idemeum.com/api-reference/endpoint/delete

DELETE /plants/{id}
Deletes a single plant based on the ID supplied



# Get Plants
Source: https://docs.idemeum.com/api-reference/endpoint/get

GET /plants
Returns all plants from the system that the user has access to



# New Plant
Source: https://docs.idemeum.com/api-reference/endpoint/webhook

WEBHOOK /plant/webhook
Information about a new plant added to the store



# Introduction
Source: https://docs.idemeum.com/api-reference/introduction

Example section for showcasing API endpoints

<Note>
  If you're not looking to build API reference documentation, you can delete
  this section by removing the api-reference folder.
</Note>

## Welcome

There are two ways to build API documentation: [OpenAPI](https://mintlify.com/docs/api-playground/openapi/setup) and [MDX components](https://mintlify.com/docs/api-playground/mdx/configuration). For the starter kit, we are using the following OpenAPI specification.

<Card title="Plant Store Endpoints" icon="leaf" href="https://github.com/mintlify/starter/blob/main/api-reference/openapi.json">
  View the OpenAPI specification file
</Card>

## Authentication

All API endpoints are authenticated using Bearer tokens and picked up from the specification file.

```json theme={null}
"security": [
  {
    "bearerAuth": []
  }
]
```


# Confidence score
Source: https://docs.idemeum.com/application-trust/confidence-score

Confidence score allows you to quickly assess if the application is safe in your environment.

## Overview

When idemeum captures an application event (either execution event for allowlisting or elevation event for elevation control), it calculates a `confidence score` for that application.

<Info>
  `Confidence score` determines how confident we are that allowing execution or elevation of this app is save in our environment. For each application we look at more than 20 signals, calculate the score as a weighted sum across independent signal groups, and then present the score as a recommendation zone.
</Info>

We look at the following signal categories:

| Category | Definition |
| - | - |
| Identity trust | Capturing signals that represent the metadata of the application, including signature, verified publisher, OS binary, etc. |
| Execution context risk | Capturing signals related how application executes, from what path, under what context, what is the parent process chain and more. |
| Prevalence and history | Capturing stats how prevalent this application is across idemeum customers and how and when it was seen in your environment. |
| Malware verdict | Capturing signals, reputation and metadata returned by Sophos reputation API |
| Policy trust | What rules the application matching |

At the end of the scoring computation we return the confidence zone for each application:

* `hard block` - certainly malicious
* `high risk` - likely unsafe to allow
* `ambiguous`- applications and needs careful review
* `soft allow` - likely safe to allow for the organization
* `allow` - high confidence of a safe application

Here is the example of the confidence score calculation:

```text theme={null}
- Signed by Microsoft
- Standard User + running from Program Files
- Low Tenant Prevalence
- CLEAN Reputation
- Publisher allow rule

=  89.5

—>  High Confidence Allow
```

## Where confidence score is shown

Confidence score is shown in all places where you are interacting with an application event:

* For each application event in the portal in the `Events` table
* For each elevation or execution request in the web portal
* Mobile request notifications
* Email admin notifications
* Tickets we create in the ticketing system

Here is the example of the confidence score displayed in the admin portal `Events` view:

<img alt="Clean Shot 2026 05 25 At 13 26 30@2x" />


# Malware reputation
Source: https://docs.idemeum.com/application-trust/malware-reputation

Each executable is scanned for malware using Sophos Intellix platform

## How malware reputation works

Every time there is an execution event or elevation event, idemeum desktop agent takes the `file hash` of the executable and performs a look up with Sophos threat database to determine if the executable is a malware or not.

We currently integrate with [Sophos Intellix API ](https://api.labs.sophos.com/doc/)platform to check the malware reputation score for each executable. SophosLabs has, for over 30 years, specialized in threat analysis to power Sophos products with real-time identification of known and unknown malware as well as processing over 600 million threat queries per day within its global reputation service.

Every file hash look up results in the following outcome:

* `known good` - file is known to be a legitimate executable that does not exhibit any malicious behaviors. These files are safe to allow in your environment.
* `unknown` - in this case the file hash has not been observed by Sophos cloud. As a result, it Sophos can not determine if the file is malicious or not.
* `malware` - file is a known malware sample.

<Note>
  If the reputation is `known good` you can safely allow these executables in your environment. Is the reputation is `unknown` you need to rely on other sources to determine if the file is bad or not.
</Note>

## Where reputation is shown

### Events table

The reputation is shown for each event in the `Events` table.

<img alt="Clean Shot 2026 05 25 At 13 22 50@2x" />

### Requests table

We also show the reputation information in the `Requests table`.

<img alt="Clean Shot 2026 05 25 At 13 23 26@2x" />

### Request email

If you configure request notifications with email to admins (for elevation requests and allowlisting requests), you can also view the malware reputation in the email.

<Frame>
  <img alt="Clean Shot 2026 03 31 At 21 59 09@2x" />
</Frame>

### Ticketing system

When you leverage idemeum integration with ticketing systems and we create tickets for elevation or allowlisting requests, you will also be able to see the malware reputation in the tickets that idemeum creates.


# Architecture
Source: https://docs.idemeum.com/architecture

Endpoint Care architecture, design, and terminology.

# How Endpoint Care works

```mermaid theme={null}
%%{init: {"flowchart": {"useMaxWidth": false}, "themeVariables": {"fontSize": "16px"}}}%%
flowchart TD
    A["1 · Understand"] --> M{Skill match?}
    M -- yes --> B["2 · Plan"]
    M -- no --> T[Triage: diagnose, categorize, route]
    B --> C["3 · Check — security gates"]
    C --> D["4 · Execute"]
    D -.->|risky step| G[Preview + consent]
    G -.-> D
    D --> E["5 · Report — ticket with full trail"]
    T --> E
```

Every request follows the same lifecycle:

1. **Understand.** The employee types a request (or clicks a quick action). The agent interprets the intent and selects the matching skill. If nothing matches, the run becomes a triage run.
2. **Plan.** The agent reads the skill and produces an explicit, ordered plan of tool calls for this specific goal.
3. **Check.** The plan passes through the guardrail pipeline: intent screening, plan validation against the skill's allowed tools, and central policy evaluation.
4. **Execute.** Steps run one at a time on the device. Diagnostic steps are read-only. Corrective steps pause at gates: a preview of exactly what will change, and a consent prompt the user must approve.
5. **Verify and report.** The agent confirms the outcome (including asking the user), then produces a summary. Every run, resolved or not, is recorded as a ticket with the full diagnostic trail.


# Architecture
Source: https://docs.idemeum.com/assist-architecture

Assist AI agent architecture, design, and terminology.

## Assist lanes

When an employee sends a message, Assist decides how to respond:

<table>
  <colgroup>
    <col />

    <col />
  </colgroup>

  <thead>
    <tr>
      <th>Lane</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>**Respond**</td>
      <td>The answer is already in the conversation, such as **"what did you find?"** after a fix. Assist replies from what already happened without starting a run.</td>
    </tr>

    <tr>
      <td>**Ask**</td>
      <td>The message is too brief to act on safely, such as **"it's broken"**. Assist asks for more details.</td>
    </tr>

    <tr>
      <td>**Answer**</td>
      <td>The employee wants company information, such as **"what's the leave policy?"**. Assist searches your connected knowledge sources and shows where the answer came from. If nothing is found, Assist offers to raise the question with IT.</td>
    </tr>

    <tr>
      <td>**Act**</td>
      <td>Something on the device or an account needs to change, such as **"my VPN won't connect"** or **"reset my password"**. Assist matches a skill and starts a run.</td>
    </tr>

    <tr>
      <td>**Reject**</td>
      <td>The message isn't about IT or the company, such as **"what's on TV tonight?"**.</td>
    </tr>
  </tbody>
</table>

```mermaid theme={null}
%%{init: {
  "theme": "base",
  "themeVariables": {
    "fontFamily": "Inter, ui-sans-serif, system-ui, sans-serif",
    "fontSize": "14px",
    "primaryColor": "#ffffff",
    "primaryBorderColor": "#e4e4e7",
    "primaryTextColor": "#18181b",
    "lineColor": "#a1a1aa",
    "edgeLabelBackground": "#ffffff"
  },
  "flowchart": { "useMaxWidth": false, "nodeSpacing": 40, "rankSpacing": 42 }
}}%%
flowchart TD
    M("Employee message") --> D{"How should<br/>Assist respond?"}
    D -- in conversation --> R("Respond")
    D -- too brief --> Q("Ask")
    D -- needs a fix --> T("Act")
    D -- company info --> K("Answer")
    D -- off topic --> X("Reject")
    T --> A("1 - Understand")
    A --> B("2 - Plan")
    B --> C("3 - Check security gates")
    C --> E("4 - Execute")
    E -.->|risky step| G("Preview + consent")
    G -.-> E
    E --> V("5 - Verify and report<br/>ticket with full trail")
    V --> O("Summary returns<br/>to the conversation")

    classDef card fill:#ffffff,stroke:#e4e4e7,stroke-width:1px,color:#18181b;
    classDef muted fill:#f4f4f5,stroke:#e4e4e7,stroke-width:1px,color:#3f3f46;
    classDef primary fill:#18181b,stroke:#18181b,color:#fafafa;

    class M,D,T,A,B,C,E card;
    class R,Q,K,X,G,O muted;
    class V primary;
```

## Assist runs

When Assist needs to fix something, it initiates a run:

1. **Understand -** Assist interprets the intent and matches the request to a skill.
2. **Plan -** Assist turns the skill into an ordered list of tool calls for this request.
3. **Check -** the plan is screened, limited to the skill's allowed tools, and checked against your policy.
4. **Execute -** steps run one at a time and changes pause for a preview and the employee's approval.
5. **Verify and report -** Assist confirms the outcome, asks the employee, and records the run as a ticket with the full trail.

## Assist terminology

<table>
  <colgroup>
    <col />

    <col />
  </colgroup>

  <thead>
    <tr>
      <th>Term</th>
      <th>Definition</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Desktop agent</td>
      <td>The Assist app on each computer. Installs with one command.</td>
    </tr>

    <tr>
      <td>Lane</td>
      <td>One of the five ways Assist responds: Respond, Ask, Answer, Act or Reject.</td>
    </tr>

    <tr>
      <td>Conversation</td>
      <td>An ongoing chat with Assist. Closes after 30 minutes without a message, a new chat, or app close.</td>
    </tr>

    <tr>
      <td>Turn</td>
      <td>One employee message and Assist's reply.</td>
    </tr>

    <tr>
      <td>Skill</td>
      <td>A playbook for one problem type, such as disk cleanup. Defines its steps and the tools it may use.</td>
    </tr>

    <tr>
      <td>Tool</td>
      <td>A code-reviewed function that performs one action on the device or in the cloud, with its own risk level.</td>
    </tr>

    <tr>
      <td>Guardrails</td>
      <td>The checks between request and action: screening, plan validation, policy, consent. Enforced by the system, not the model.</td>
    </tr>

    <tr>
      <td>Run</td>
      <td>A turn that fixes something: plan, gated execution, verification and report.</td>
    </tr>

    <tr>
      <td>Plan</td>
      <td>The ordered list of tool steps Assist builds from a skill before anything runs.</td>
    </tr>

    <tr>
      <td>Gate</td>
      <td>A pause for a human: consent, preview, acknowledgment or intake form.</td>
    </tr>

    <tr>
      <td>Triage</td>
      <td>The path for issues no skill can fix. It starts only when the employee chooses it.</td>
    </tr>

    <tr>
      <td>Escalation</td>
      <td>A run handed to IT with the diagnostic bundle attached.</td>
    </tr>

    <tr>
      <td>Diagnostic bundle</td>
      <td>The evidence on a ticket: device context, diagnostics, steps already taken, and the conversation.</td>
    </tr>

    <tr>
      <td>Quick action (pill)</td>
      <td>A one-click shortcut that starts a skill, such as "Free up space".</td>
    </tr>

    <tr>
      <td>Audit trail</td>
      <td>The cloud record of a run: the plan, every gate decision, every tool result and the outcome.</td>
    </tr>

    <tr>
      <td>Connectors</td>
      <td>The cloud systems idemeum connects to, such as identity providers, device management and ticketing.</td>
    </tr>
  </tbody>
</table>


# Chats integrations
Source: https://docs.idemeum.com/assist-chat-integrations

Integration AI support agent with chat platforms.

## What is chat integration?

Chat integrations let employees start Endpoint Care from where they already ask for help: Slack and Microsoft Teams. The employee describes the problem to the bot, and one click later the agent on their device is working on it, with every skill, guardrail, and audit behavior identical to a run started in the app.

```mermaid theme={null}
%%{init: {
  "theme": "base",
  "themeVariables": {
    "fontFamily": "Inter, ui-sans-serif, system-ui, sans-serif",
    "fontSize": "14px",
    "primaryColor": "#ffffff",
    "primaryBorderColor": "#e4e4e7",
    "primaryTextColor": "#18181b",
    "lineColor": "#a1a1aa",
    "edgeLabelBackground": "#ffffff"
  },
  "flowchart": { "nodeSpacing": 40, "rankSpacing": 42 }
}}%%
flowchart TD
    A("Employee messages the bot in Slack or Teams") --> B("Bot verifies the request and identifies your tenant")
    B --> C("Bot replies instantly with a card and a Fix it button")
    C --> D("Button opens the desktop agent with the request pre-filled")
    D --> E("Run executes on the device with full guardrails, recorded like any run")

    classDef card fill:#ffffff,stroke:#e4e4e7,stroke-width:1px,color:#18181b;
    classDef primary fill:#18181b,stroke:#18181b,color:#fafafa;
    class A,B,C,D card;
    class E primary;
```

1. **The employee messages the bot** — "my laptop is slow" — in Slack or Teams.
2. **The bot authenticates the message.** Slack requests are verified with Slack's request signing; Teams requests with Microsoft's JWT verification. The workspace or bot registration maps to your tenant, so multi-tenant deployments stay isolated.
3. **The bot replies immediately** with a card (Slack Block Kit / Teams Adaptive Card) carrying the request and an action button.
4. **The button hands off to the device.** It opens the desktop agent through a secure app link with the employee's request pre-filled; the request text is sanitized and length-capped before it travels. The agent opens even if it wasn't running.
5. **The run executes on the device** — same skills, same gates, same previews and consent, same audit trail. In the console it appears like any other run, with chat recorded as its source.

## Setup

Chat platforms are connected per tenant from the admin portal's **Chat platforms** page: a Slack app for your workspace, an Azure Bot registration for Teams. Employees need the desktop agent installed on their machine; nothing else is required on their side.

Check out [integrations](/integrations) to learn how to connect Slack and Teams.


# Cloud repair
Source: https://docs.idemeum.com/assist-cloud-repair



Assist fixes employee issues using your cloud systems.

## What is cloud repair with Assist?

Cloud actions are fixes Assist makes in your cloud systems rather than on the computer, such as resetting a password or MFA in Microsoft Entra ID or Okta. The employee describes the issue, such as "I'm locked out of Okta", and Assist checks the account to confirm the cause, shows exactly what it will change, and waits for approval. It then makes the change through your connected identity provider, confirms it worked, and records the run as a ticket.

<Note>
  Cloud repair only ever act on the signed-in employee's own account, so [identity resolution](/assist-identity-resolution) must be set up.
</Note>

## Cloud skills and tools

Each cloud action follows a **skill**, a playbook for one type of problem. Its **tools**, such as `c_okta_unlock_account` or `c_entra_reset_mfa`, reach your identity provider through the idemeum cloud gateway.

Some skill examples:

* [entra-password-reset](https://github.com/idemeum/skills/blob/main/entra-password-reset/SKILL.md) - resets a forgotten Microsoft Entra password and emails a temporary one to the employee's recovery address, which also clears a sign-in lockout
* [entra-mfa-reset](https://github.com/idemeum/skills/blob/main/entra-mfa-reset/SKILL.md) - clears the employee's Entra MFA methods, such as after a lost phone, so they can set MFA up again at next sign-in
* [okta-password-reset](https://github.com/idemeum/skills/blob/main/okta-password-reset/SKILL.md) - resets a forgotten Okta password and emails a temporary one to the employee's recovery address
* [okta-mfa-reset](https://github.com/idemeum/skills/blob/main/okta-mfa-reset/SKILL.md) - clears the employee's Okta authenticators so they can enroll again at next sign-in
* [okta-account-unlock](https://github.com/idemeum/skills/blob/main/okta-account-unlock/SKILL.md) - unlocks an Okta account locked after too many failed sign-in attempts

<Card title="Skill and tool library" icon="book" href="https://github.com/idemeum/skills">
  Browse every skill and tool in our library.
</Card>

## Ticketing integrations

Once your ticketing system is connected, Assist sends a ticket to it after every run. Each run is also recorded in the idemeum admin portal with its full audit trail and context. Learn more about [tickets and runs](/assist-runs-tickets), or see the [integration guides](/integrations).

## Set up Assist cloud actions

1. Log in to the idemeum admin portal, go to **Agents → Skills**, and check that the cloud skills you want are enabled.
2. Go to **Agents → Connectors**, connect Microsoft Entra ID or Okta, and select **Use as identity provider**. See [Identity resolution](/assist-identity-resolution).
3. In **Agents → Connectors**, connect your ticketing system and, optionally, Intune or Jamf. See [Integrations](/integrations).
4. [Install the Assist app](/assist-install) on macOS and Windows devices, using your usual deployment tool.
5. On a test device, sign in as a test employee, ask Assist to **"reset my password"**, and approve the change. Check that the temporary password reaches the recovery address and the run appears in the admin portal.


# Custom skills
Source: https://docs.idemeum.com/assist-custom-skills

Create custom skills for Endpoint Care.

## Create custom skills

You can create custom skills for AI support agent using the following:

1. **Manual .md upload** - manually upload the .md file to idemeum admin portal.
2. **Skill builder** - build skill using visual step editor.

## Manual skill upload

* Navigate to idemeum admin portal and access `Skills` menu on the left
* Click `Add skill` → `Manual upload`
* Paste your .md file into the skill editor. It will perform basic validation for the skill syntax

<img alt="Clean Shot 2026 07 15 At 15 52 29@2x" />

## Skill builder

* Navigate to idemeum admin portal and access `Skills` menu on the left
* Click `Add skill` → `Skill builder`
* Provide the skill name as well as description (used to match the user requests)

<img alt="Clean Shot 2026 07 15 At 16 00 57@2x" />

### AI to generate the skill steps

You can use AI to generate skill steps. Simply click on the `AI` button at the top right an provide the description prompt for what you want the skill to do.

<img alt="Clean Shot 2026 07 15 At 16 03 42@2x" />

### Visual step builder

Another option is to define the steps with the visual builder. Click on the `Add step` button at the bottom left and choose from the available tools that you want the step to execute.

<img alt="Clean Shot 2026 07 15 At 16 04 31@2x" />

In the middle section you can configure the step, including notes, conditions, and parameters you want to pass between the steps.

### Preview tab

In the preview tab you can view the live generate markdown from the steps that you are using in the visual builder.

<img alt="Clean Shot 2026 07 15 At 16 06 49@2x" />


# Endpoint repair
Source: https://docs.idemeum.com/assist-endpoint-repair

Assist diagnoses and fixes employees' computers.

## What is endpoint repair with Assist?

Assist can diagnose and fix problems on employees' computers. The employee describes the issue, such as "my VPN won't connect", and Assist runs read-only checks to find the cause, shows exactly what it will change, and waits for approval. It then makes the fix one step at a time, verifies the result, and records the run as a ticket.

<Note>
  Assist fixes software and configuration, not hardware faults. It needs Internet connection to reach its AI model, so it can't help on a device that is fully offline.
</Note>

## Endpoint skills and tools

Each repair follows a **skill**, a playbook for one type of problem. A skill can only use its allowed **tools**: code-reviewed functions that each do one thing, such as `check_vpn_status`, `flush_dns_cache` or `kill_process`.

Some skills examples:

* [disk-cleanup](https://github.com/idemeum/skills/blob/main/disk-cleanup/SKILL.md) - frees up space by finding and removing large and temporary files
* [process-manager](https://github.com/idemeum/skills/blob/main/process-manager/SKILL.md) - fixes a slow computer or frozen app by stopping runaway processes and trimming startup items
* [vpn-repair](https://github.com/idemeum/skills/tree/main/vpn-repair) - fixes VPN connections that fail or connect without letting traffic through
* [printer-repair](https://github.com/idemeum/skills/blob/main/printer-repair/SKILL.md) - clears stuck print queues and restarts the print service when a printer is offline or not printing
* [usb-device-repair](https://github.com/idemeum/skills/blob/main/usb-device-repair/SKILL.md) - fixes USB devices, docks and hubs that aren't detected or aren't responding

<Card title="Skill and tool library" icon="books" href="https://github.com/idemeum/skills">
  Browse every skill and tool in our library.
</Card>

## Ticketing integrations

After every run Assist sends a ticket to your ticketing system. It also creates a `run` record with all audit trail and context in the idemeum portal. You can learn more about [tickets and runs](/assist-runs-tickets) as well as explore [integration](/integrations) guides.

## Set up Assist endpoint repair

1. Login to your idemeum admin portal, navigate to `Agents` → `Skills` and make sure you have desired endpoint skills enabled
2. Navigate to `Agents` → `Connectors` and connect your ticketing system. You can learn more on [Integrations](/integrations) page.
3. [Install Assist app](/assist-install) (push to employee devices with your deployment tool) on Windows and macOS devices
4. Test your repair flows.


# Guardrails
Source: https://docs.idemeum.com/assist-guardrails

How every Assist run is secured with guardrail architecture.

## What are guardrails?

Guardrails are the checks between a request and any action: the request is screened, the plan is limited to the skill's allowed tools, your policy decides what may run, and risky steps wait for the employee's approval.

```mermaid theme={null}
%%{init: {
  "theme": "base",
  "themeVariables": {
    "fontFamily": "Inter, ui-sans-serif, system-ui, sans-serif",
    "fontSize": "14px",
    "primaryColor": "#ffffff",
    "primaryBorderColor": "#e4e4e7",
    "primaryTextColor": "#18181b",
    "lineColor": "#a1a1aa",
    "edgeLabelBackground": "#ffffff"
  },
  "flowchart": { "useMaxWidth": false, "nodeSpacing": 40, "rankSpacing": 42 }
}}%%
flowchart TD
    A("AI agent run") --> G1("Gate 1 - Intent screening<br/>Is this a legitimate IT request?")
    G1 --> G2("Gate 2 - Plan validation<br/>Only the skill's allowed tools, in a justified order")
    G2 --> G3("Gate 3 - Policy evaluation<br/>Does the plan comply with central policy?")
    G3 --> G4("Gate 4 - Execution gates<br/>Preview, user consent, and audit on every risky step")
    G4 --> R("Fix verified - ticket with full audit trail")

    G1 -.->|fails| X("Blocked and explained")
    G2 -.-> X
    G3 -.-> X

    classDef card fill:#ffffff,stroke:#e4e4e7,stroke-width:1px,color:#18181b;
    classDef muted fill:#f4f4f5,stroke:#e4e4e7,stroke-width:1px,color:#3f3f46;
    classDef primary fill:#18181b,stroke:#18181b,color:#fafafa;
    classDef destructive fill:#fef2f2,stroke:#fecaca,stroke-width:1px,color:#b91c1c;

    class G1,G2,G3,G4 card;
    class A muted;
    class R primary;
    class X destructive;
```

## What each gate does

| Gate | Description | Blocks |
| - | - | - |
| **G1 - Intent** | Rejects anything outside IT support and any attempt to manipulate the agent, including prompt injection. | Off-topic requests, jailbreak attempts, instructions smuggled inside a request. |
| **G2 - Plan** | Checks the plan against the skill: every step must use one of its allowed tools, and diagnostics must run before fixes. A plan that fails is rewritten, never part-run. | Tool outside the skill's allowlist, corrective actions before diagnosis, skipped prerequisites, risk outside boundary. |
| **G3 - Policy** | Checks the approved plan against your central policy: which actions need admin approval, what's forbidden, for whom. | Anything your organization has ruled out. |
| **G4 - Execution** | Risky steps show exactly what would change and wait for the employee to approve or decline. Only code-reviewed tools run — the AI never writes commands or scripts — and every input, result and decision is recorded. | Every sensitive action goes through approval. |


# Identity resolution
Source: https://docs.idemeum.com/assist-identity-resolution

How Assist confirms who the employee is before it acts.

## What is identity resolution?

Assist confirms who the employee is by having them sign in with your identity provider. It uses that verified identity for two things:

* Tickets are assigned to a real directory user, not a local computer account.
* Account fixes, such as a password or MFA reset, only ever act on the signed-in employee's own account. Assist never takes a username from the chat.

## How it works

* When identity resolution is off, device repairs still work, and their tickets are marked as unverified. Account fixes, such as password and MFA resets, are unavailable.
* If identity provider is configured, and the employee asks Assist for help, she will need to be authenticated first. The browser will open and the employee with sign in with the configured identity provider.
* Assist remembers the sign-in for up to 30 days, so employees aren't asked every time.

## Set up identity resolution

Simply navigate to `Agents` → `Connectors`, connect your identity provider, and select `Use as identity provider`.

<img alt="Clean Shot 2026 09 17 At 10 36 37 Pm@2x" />


# Install Assist
Source: https://docs.idemeum.com/assist-install

Install Assist desktop applications for Windows and macOS.

## Single tenant installation

<Tabs>
  <Tab title="Windows">
    ### Installation

    <Steps>
      <Step title="Obtain PowerShell script">
        Navigate to your idemeum admin portal, click `Install agent` button, then choose `AI support agent `and copy the installation script for Windows.

        <img alt="Clean Shot 2026 07 14 At 22 54 29@2x" />
      </Step>

      <Step title="Execute script using PowerShell">
        <Warning>
          Make sure you execute the script with PowerShel Administrator privileges.
        </Warning>

        Open PowerShell and execute the installation script with Administrator privileges. Idemeum will install all required prerequisites before installing the agent. No restart is required after successful installation.
      </Step>
    </Steps>
  </Tab>

  <Tab title="macOS">
    ### Installation

    <Steps>
      <Step title="Obtain installation command for macOS">
        Navigate to your idemeum portal, click `Install agent`, choose `AI support agent`,  then select `macOS` and download profile and script. 

        <img alt="Clean Shot 2026 07 14 At 22 56 18@2x" />
      </Step>

      <Step title="Deploy bash script">
        Now you can deploy the idemeum script to your workstations using the deployment tool of your choice (MDM, RMM, etc.). No restart is required after installation.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Uninstall command

<Warning>
  Administrator permissions are required to uninstall idemeum agent.
</Warning>

<Tabs>
  <Tab title="Windows">
    Open Windows PowerShell as `Administrator` and execute the following commands.

    ```powershell wrap theme={null}
    Start-Process -FilePath "C:\Program Files\AI Support Agent\Uninstall AI Support Agent.exe" -ArgumentList '/allusers /S _?=C:\Program Files\AI Support Agent' -Wait
    ```
  </Tab>

  <Tab title="macOS">
    Open macOS terminal as `Administrator` and execute the following script.

    ```shellscript wrap theme={null}
    sudo bash "/Applications/AI Support Agent.app/Contents/Resources/uninstall.sh"
    ```
  </Tab>
</Tabs>


# Assist overview
Source: https://docs.idemeum.com/assist-overview

Desktop AI agent that resolves employee IT issues autonomously.

## Meet Assist

Assist is the AI agent for your employees. It installs as a desktop app, takes a problem described in plain language, and resolves it on the device or in the cloud. Every action passes through guardrails, the employee approves anything risky, and every run is audited in the cloud.

## How Assist works

1. **Employees asks for IT help** - the employee describes the problem in plain language, such as "my email isn't syncing". They can also click a quick action, or respond when Assist spots a problem first.
2. **Assist chooses what to do** - it answers from the conversation, looks it up in the knowledge base, or starts a run to fix the problem.
3. **Assist chooses a skill** - it matches the request to a skill, builds an ordered plan, and runs each step through the guardrails. Before any change, it shows exactly what it will do and waits for approval.
4. **Assist confirms and reports** - it verifies the outcome, asks the employee to confirm, and records the run as a ticket with the full audit trail.
5. **If Assist can't fix it** - it offers to send the issue to IT, and the employee decides. The ticket carries the diagnostics, the steps already taken, and a screen recording if the employee allows one.

## Assist use cases

<table>
  <colgroup>
    <col />

    <col />
  </colgroup>

  <thead>
    <tr>
      <th>Use case</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>[Endpoint repair](/assist-endpoint-repair)</td>
      <td>Diagnoses and repairs problems on the device itself — disk space, Wi-Fi and network, VPN, email, printers, Bluetooth and USB devices, slow or frozen apps, security agents, and more.</td>
    </tr>

    <tr>
      <td>[Cloud repair](/assist-cloud-repair)</td>
      <td>Resolves cloud IT issues — password resets, MFA resets, accounts unlocks and more.</td>
    </tr>

    <tr>
      <td>[Proactive triggers](/assist-proactive-actions)</td>
      <td>Scheduled checks find problems before the employee notices — a disk nearly full, a certificate about to expire, a security agent that stopped running.</td>
    </tr>

    <tr>
      <td>[Triage and diagnostics](/assist-tickets-audit-trail)</td>
      <td>When Assist cannot resolve an issue, it diagnoses and categorizes it, then submits a ticket to your helpdesk with the device context, the steps already taken and the conversation.</td>
    </tr>

    <tr>
      <td>Knowledgebase answers</td>
      <td>Answers questions about company policies and processes from your connected knowledge sources, instead of opening a ticket.</td>
    </tr>

    <tr>
      <td>Access management</td>
      <td>Grant just-in-time access to applications and resources when employees ask for access in plain language.</td>
    </tr>
  </tbody>
</table>


# Proactive triggers
Source: https://docs.idemeum.com/assist-proactive-actions

Assist spots problems on employees' computers and offers to fix them before anyone asks.

## What are proactive triggers?

Proactive triggers let Assist find problems before the employee notices them. In the background, Assist runs lightweight read-only checks on the computer, such as disk usage every hour. When a check matches a condition you set, such as a disk more than 90% full, Assist offers the employee a fix. If they accept, the fix runs exactly like a request they typed: same skill, same approvals, same ticket.

<Note>
  Triggers decide when to act, and AI decides how. The checks are simple rules, not AI, so they're cheap to run and behave predictably. Assist never starts a fix on its own; the employee always chooses to run it.
</Note>

## What the employee sees

* Assist shows a notification on computer, such as **"Your disk is 95% full. Free up space?"**.
* The employee chooses **Run now**, **Snooze** (1 hour, 8 hours, 24 hours or until restart) or **Dismiss**. The same problem doesn't raise a second offer while one is waiting.
* **Run now** starts the matching skill. Assist still shows what it will change and waits for approval before making any change.

## Set up proactive triggers

Each trigger sets a check, how often it runs, the condition, how long the condition must hold before an offer appears, and the skill that fixes the problem. A trigger can only use checks its skill already allows, so it can't add new actions.

1. Log in to the idemeum admin portal, go to **Agents → Triggers**, and add the triggers you want.
2. [Install the Assist app](/assist-install) on macOS and Windows devices. Proactive checks are on by default. Assist keeps running in the menu bar or system tray when its window is closed, so checks stop only if the employee quits Assist.
3. On a test device, add a trigger that will fire straight away, such as disk usage of 10% or more, and confirm the offer appears. Trigger changes reach devices within about 10 minutes.


# Run dashboard
Source: https://docs.idemeum.com/assist-run-dashboard

Overview of AI agent runs.

## What is a run?

A run is one attempt to fix a problem. Assist matches a skill, builds a plan, checks it against the guardrails, runs the steps with the employee's approval, verifies the result and records it as a ticket. Questions and follow-ups are answered in the conversation without starting a run.

Runs start from a typed request, a quick action or a [proactive trigger](/assist-proactive-actions). Each run records:

* **Goal:** the request, in the employee's words.
* **Skill:** the playbook that handled it, such as `disk-cleanup` or `triage`.
* **Plan and steps:** each step's tool, inputs, result and outcome.
* **Approvals:** every preview shown and every change approved or declined.
* **Feedback:** whether the employee said the problem was fixed.
* **Summary:** the result in plain language.

## Run dashboard

In the idemeum admin portal, go to **Runs**. The overview covers the last 30 days.

<img alt="Runs dashboard in the idemeum admin portal" />

| Metric | What it shows |
| - | - |
| Total | All runs in the period. |
| Resolved | Runs Assist fixed end to end, and their share of the total. |
| Escalated | Runs handed to IT because the employee said the problem wasn't fixed. |
| Failed | Runs that couldn't complete: an error, a stopped run, or no step able to run. |
| MTTR | Average time Assist spent working on a run, not counting time waiting for the employee's approval. |
| Successful run rate | Runs where every step succeeded. |
| CSAT | Positive ratings, and their share of all ratings. |
| Weekly resolution rate | Share of runs resolved each week, over the last 90 days. |

Successful run rate and Resolved measure different things. Every step can succeed while the problem persists, and a run can be resolved even if the employee declined a step. A gap between the two means fixes are running but not always helping.

After you turn on or edit a skill, watch the weekly resolution rate; the effect shows within a week or two.

## How a run's result is decided

Every run ends as **Resolved**, **Escalated** or **Failed**. What the employee says outranks what the steps reported:

1. **Failed:** the steps didn't complete.
2. **Escalated:** the steps ran, but the employee says the problem isn't fully fixed.
3. **Resolved:** the steps ran, and the employee confirmed the fix or didn't answer.

```mermaid theme={null}
%%{init: {
  "theme": "base",
  "themeVariables": {
    "fontFamily": "Inter, ui-sans-serif, system-ui, sans-serif",
    "fontSize": "14px",
    "primaryColor": "#ffffff",
    "primaryBorderColor": "#e4e4e7",
    "primaryTextColor": "#18181b",
    "lineColor": "#a1a1aa",
    "edgeLabelBackground": "#ffffff"
  },
  "flowchart": { "useMaxWidth": false, "nodeSpacing": 40, "rankSpacing": 42 }
}}%%
flowchart TD
    Q1{"Did the steps<br/>complete?"} -- no --> F("Failed")
    Q1 -- yes --> Q2{"Did the employee say<br/>the problem persists?"}
    Q2 -- yes --> E("Escalated")
    Q2 -- "no, or no answer" --> R("Resolved")

    classDef card fill:#ffffff,stroke:#e4e4e7,stroke-width:1px,color:#18181b;
    classDef primary fill:#18181b,stroke:#18181b,color:#fafafa;
    classDef destructive fill:#fef2f2,stroke:#fecaca,stroke-width:1px,color:#b91c1c;
    classDef muted fill:#f4f4f5,stroke:#e4e4e7,stroke-width:1px,color:#3f3f46;

    class Q1,Q2 card;
    class R primary;
    class E muted;
    class F destructive;
```


# Run details
Source: https://docs.idemeum.com/assist-run-details

The full record of a single run.

## Header

In the idemeum admin portal, go to **Runs** and click any run to open its full record: what was asked, what Assist did, what the employee approved and what it cost.

The header shows the goal in the employee's words, who ran it, on which device and when.

<img alt="Run details header with status, duration, LLM calls and cost" />

| Card | What it shows |
| - | - |
| Run status | **Ticket:** the run's result (Resolved, Escalated or Failed). **Tools:** how the steps went (resolved, partial, unresolved, failed or cancelled). **User:** whether the employee said the problem was fixed. |
| Duration | How long the run took. |
| LLM calls | How many AI model calls the run made. |
| Cost | The AI cost of the run, based on actual token usage. |

## Overview tab

A summary of the run.

<img alt="Overview tab with skill, summary and tool counts" />

* **Skill matched:** the skill that handled the request, linked to its page.
* **AI agent summary:** what Assist found, what the employee chose and what changed. It's the same summary the employee saw.
* **Tool counts:** how many steps ran and how each ended:
  * **Approved:** the step ran.
  * **Denied:** the employee declined it, a guardrail blocked it, or it failed.
  * **Skipped:** Assist showed a preview but didn't make the change.

## Tool activity tab

Every step, in order. Use it to check exactly what Assist did, or to see why a run ended as partial.

<img alt="Tool activity tab with each step's status and output" />

Each step shows:

* **Tool and status:** Approved or Denied.
* **Rationale:** what the step was for, such as **"Scanning your home directory to find the largest folders"**.
* **Denial reason:** who stopped the step and why. In the example, a guardrail blocked `disk_scan` because the path was outside the employee's home folder, and the run continued with other checks.
* **Tool output:** the raw result, such as paths, sizes and counts. This is the evidence behind the summary.

## Context tab

Where and how the run happened.

<img alt="Context tab with identifiers, device context and LLM usage" />

| Section | What it shows |
| - | - |
| Identifiers | Session ID and Agent ID. Copy them when checking logs or contacting support. |
| Device context | Hostname, OS version, platform, whether the employee is an admin, and MDM enrollment, as they were during the run. |
| LLM and source | How the run started, the AI provider and model, and tokens used (input, output and cached). |


# Runs and tickets
Source: https://docs.idemeum.com/assist-runs



<table>
  <colgroup>
    <col />

    <col />
  </colgroup>

  <thead>
    <tr>
      <th>Field</th>
      <th>What it contains</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>**Request**</td>
      <td>What the employee asked for, in their words</td>
    </tr>

    <tr>
      <td>**Skill**</td>
      <td>The skill that ran, such as \`vpn-repair\`</td>
    </tr>

    <tr>
      <td>**Outcome**</td>
      <td>Resolved, partial, unresolved, failed or cancelled</td>
    </tr>

    <tr>
      <td>**Feedback**</td>
      <td>The employee's own rating and optional comment</td>
    </tr>

    <tr>
      <td>**Summary**</td>
      <td>A short account of what Assist did, such as \*\*"Freed 6.9 GB"\*\*</td>
    </tr>

    <tr>
      <td>**Steps**</td>
      <td>Every step that ran, its result, and any step the employee declined</td>
    </tr>

    <tr>
      <td>**Attachments**</td>
      <td>A screen recording, when the employee made one</td>
    </tr>
  </tbody>
</table>


# Skill updates
Source: https://docs.idemeum.com/assist-skill-updates

How skill changes reach Assist on every device.

## How are skills updated?

Skills update from the cloud automatically. When you add, change or turn off a skill in the admin portal, Assist on each device picks up the change within about 10 minutes.

* **Safe to apply.** Every update is downloaded over HTTPS and checked for integrity. A skill can only use tools already built into Assist, so no new code ever arrives from the cloud.
* **Applied when idle.** Assist restarts itself in a few seconds to apply the update, waiting until no run is in progress and the employee isn't using the app. Meanwhile, the employee sees **Updates ready · will restart when idle**, with a **Restart now** button. If Assist stays busy for 24 hours, it restarts anyway.
* **Built-in skills stay installed.** You can turn a built-in skill off or replace it with your own version, but not delete it.
* **Works offline.** If the cloud can't be reached, Assist keeps using its current skills and updates on the next successful check.


# Skills overview
Source: https://docs.idemeum.com/assist-skills-overview

Skills are the playbooks Assist follows to fix IT problems.

## What are skills?

A skill is a playbook for one type of IT problem. It says when it applies, which checks and fixes to run, which tools it may use, and how to handle edge cases. Skills are written in plain language: the skill supplies the expertise, and Assist works out how to apply it to the problem on this machine.

## Built-in skills

Assist ships with built-in skills for common problems, such as disk cleanup, VPN repair, printer repair, and password and MFA resets. idemeum maintains them, and every built-in skill and tool is published in our open skill library, so you can read exactly what Assist will do before you turn a skill on. Turn any skill on or off in **Agents → Skills**, or write your own using the format below.

<Card title="Skill and tool library" icon="book" href="https://github.com/idemeum/skills">
  Browse every built-in skill and tool on GitHub.
</Card>

## How a skill is selected

Assist matches the employee's request against each skill's description and example phrases. **"My laptop is crawling"** matches [process-manager](https://github.com/idemeum/skills/blob/main/process-manager/SKILL.md), and **"I keep getting asked for my email password"** matches [email-repair](https://github.com/idemeum/skills/blob/main/email-repair/SKILL.md). No keywords or menus are needed. Skills with a `pill` also appear as quick actions in the app. If nothing matches, Assist asks a clarifying question, and the employee can always raise the issue with IT through the [triage](https://github.com/idemeum/skills/blob/main/triage/SKILL.md) skill.

## Anatomy of a skill

A skill is one `SKILL.md` file with two parts: the frontmatter and the body.

```yaml theme={null}
---
<frontmatter>   ← settings, in YAML
---

<body>          ← the playbook, in Markdown
```

### Frontmatter

```yaml theme={null}
---
name: skill-name
description: Diagnoses and fixes <problem>. Use when the user reports <symptom>.
allowed-tools:
  - tool_one
  - tool_two
metadata:
  prerequisites:
    before-corrective:
      - tool_one
  maxAggregateRisk: medium
  userLabel: "Short label for this skill"
  examples:
    - "user's phrasing 1"
    - "user's phrasing 2"
  pill:
    label: Fix X
    goal: My X is broken, please diagnose and fix it
    icon: HardDrive
    iconClass: text-blue-500
    order: 10
---
```

| Field | Description |
| - | - |
| `name` | The skill's name. Must match its folder name exactly. |
| `description` | What the skill fixes and when to use it. Used to pick the right skill. |
| `allowed-tools` | Every tool the skill may use. Assist refuses to call anything else. |
| `metadata.prerequisites.before-corrective` | Read-only tools that must run before any tool that makes a change. |
| `metadata.maxAggregateRisk` | `low`, `medium` or `high`. Set it to the risk level of your riskiest tool. |
| `metadata.userLabel` | Short label shown when Assist asks the employee to choose between skills. |
| `metadata.examples` | Ways an employee might describe the problem. Used with `description` to pick the skill. |
| `metadata.pill` | Adds a quick action button to the app, with its label, icon and position. |

### Skill body

```markdown theme={null}
## When to use

When this skill is right, and when it isn't (name the skill to use instead).

## Steps

**Step 1 — Short name**
What to do, with conditions and notes.

**Step 2 — Next step**
...

## Edge cases

Unusual situations and how to handle them.
```

Write steps as bold text, `**Step N — Name**`, not as headings such as `### Step N`. Some parts of the system strip Markdown headings.

### Writing a step

Each step usually calls one tool. A step can say:

| What to write | Example |
| - | - |
| The tool to call | Call `check_connectivity` to test internet access. |
| Parameters | Call `check_connectivity` with `targets: ["8.8.8.8", "google.com"]` and `count: 3`. |
| When to run it | Only run when Step 1 found every target unreachable. |
| How to read the output | Note: `proxies[]` can have several entries; check each one. |
| Repeat over a list | For each app the employee approved in Step 4, call `clear_app_cache`. |
| Values from earlier steps | Call `get_disk_usage` with `volume` set to the mount path from Step 1. |
| Sensitive data | Treat `password` as sensitive; never log or repeat it. |
| Always run the step | Add **(MUST include)** after the step name. |

Conditions must refer to what an earlier tool returned, not to the employee's identity, mood or intent.

## Complete skill example

```markdown theme={null}
---
name: dns-flush
description: Diagnoses and fixes DNS resolution failures when websites won't load but IP-level connectivity is working.
allowed-tools:
  - check_connectivity
  - check_vpn_status
  - flush_dns_cache
metadata:
  prerequisites:
    before-corrective:
      - check_connectivity
      - check_vpn_status
  maxAggregateRisk: medium
  userLabel: "DNS resolution failure"
  examples:
    - "websites won't load but my internet is on"
    - "I'm getting DNS_PROBE errors"
    - "names don't resolve but ping works"
    - "Chrome says server not found"
    - "DNS isn't working"
  pill:
    label: Fix DNS
    goal: Websites won't load, please diagnose and fix the DNS issue
    icon: Globe
    iconClass: text-blue-500
    order: 12
---

## When to use

Websites won't load but IP-level connectivity is intact (the user can ping IPs but not hostnames). Do NOT use for full connectivity outages — use `network-reset` instead.

## Steps

**Step 1 — Confirm DNS is the problem**

Call `check_connectivity` with `targets: ["8.8.8.8", "1.1.1.1", "google.com", "example.com"]` and `count: 3`.

Note: if numeric IPs are reachable but hostnames aren't, the issue is DNS. If nothing is reachable, this skill is the wrong tool — switch to `network-reset`.

**Step 2 — Rule out VPN-routed DNS** (MUST include)

Call `check_vpn_status`. A connected VPN routes DNS through its tunnel and can produce DNS-failure symptoms. If a VPN is connected, advise disconnecting and retesting before proceeding.

**Step 3 — Flush the DNS cache**

Call `flush_dns_cache`. Consider this before any heavier fix (like network reset) because flushing is non-destructive and instantly reversible.

Only run when Step 1 showed numeric IPs reachable AND hostnames unreachable, AND Step 2 showed no active VPN.

**Step 4 — Verify the fix**

Call `check_connectivity` with the same hostname targets as Step 1. Only run after Step 3. Success means DNS is working; remaining failures mean the upstream DNS server (router or ISP) is at fault.

## Edge cases

- **VPN active** — Step 2 catches this; advise disconnect-and-retest.
- **Hardcoded DNS server** — if the user set a manual DNS server that's now broken, flushing won't help. Suggest reverting to automatic DNS.
- **macOS mDNSResponder hung** — the flush briefly drops all DNS for 1–2 seconds. Normal.
```


# Triage and diagnostics
Source: https://docs.idemeum.com/assist-triage-diagnostics

When Assist can't fix a problem, it sends it to IT with the details and evidence attached.

## What is triage?

Triage is how Assist hands a problem to IT when no skill can fix it. Assist gathers the details and device evidence IT needs, then creates a ticket. The employee can trigger triage in the following ways:

* Asking for a person, such as **"get me a human"** or **"I need to talk to IT"**.
* Clicking the **Report Issue** quick action.
* Accepting Assist's offer to raise a ticket after it couldn't answer a question or the employee marked an answer as unhelpful.

## How triage works

* Assist fills in a short form from the conversation, following the triage skill: category, urgency, affected system, summary and symptoms.
* The employee reviews the form, corrects anything except the category, and submits it.
* Assist runs the read-only check the skill sets for that category and adds the result to the ticket.
* Assist offers a screen recording, so the employee can show IT the problem.
* The ticket goes to your ticketing system.

## The triage skill

Triage runs from a skill, [triage](https://github.com/idemeum/skills/blob/main/triage/SKILL.md), like every other fix.

* **Category:** Network, Software, Hardware, Account/Access, Email, Printing, Performance, Security or Other. Assist picks the one closest to the root cause.
* **Urgency:** critical when the employee can't work at all, high for major impact with no workaround, medium when a workaround exists, and low for cosmetic issues or questions. Medium is the default when the employee doesn't say.
* **Summary, affected system and symptoms:** written so a technician understands the problem without reading the chat.
* **One check per category**, listed below. The category can't be edited because it decides which check runs.

| Category | Diagnostic Assist collects |
| - | - |
| Network | Connectivity check |
| Software | Installed apps |
| Hardware | Connected USB devices |
| Email | Mail account settings |
| Printing | Installed printers |
| Performance | Apps using the most CPU and memory |
| Security | Firewall status |
| Account/Access and Other | Running processes |

Every check is read-only, so triage never changes the computer. You can customize the skill like any other: add categories, reword the urgency levels, or change the check a category runs. Any check you add must also be in the skill's allowed tools.

## Screen recording

* The employee chooses **Start recording** or **Skip**. Nothing is recorded without their click.
* Recordings capture the full screen, with no audio, for up to 60 seconds.
* The recording is uploaded to idemeum and attached to the ticket.
* On macOS, the employee grants Screen Recording permission the first time, then quits and reopens Assist. Apple doesn't let MDM grant this permission silently.

## Set up triage and diagnostics

1. Log in to the idemeum admin portal, go to **Agents → Skills**, and check that the **triage** skill is enabled.
2. Go to **Agents → Connectors** and connect your ticketing system. See [Integrations](/integrations).
3. On a test device, type **"get me a human"**, submit the form, and record a few seconds of screen. Check that the ticket arrives with the form details, the diagnostic result and the recording.


# Troubleshooting
Source: https://docs.idemeum.com/assist-troubleshooting

Troubleshoot Assist on Windows and macOS.

## Assist agent logs

Most issues fall into one of three buckets: the agent can't reach the cloud (skills and tickets stop updating), a permission is missing (specific skills stop before executing), or configuration didn't apply (the agent reads its `.env` once at startup). This page covers where to look, starting with the logs, which almost always contain the answer: the agent logs every run, every gate decision, every cloud call, and every rejected skill update with the reason.

**Agent log** (`idemeum-agent.log`):

<table>
  <colgroup>
    <col />

    <col />
  </colgroup>

  <thead>
    <tr>
      <th>**OS**</th>
      <th>**Path**</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>macOS</td>
      <td>\~/Library/Logs/AI Support Agent/idemeum-agent.log</td>
    </tr>

    <tr>
      <td>Windows</td>
      <td>%APPDATA%\AI Support Agent\logs\idemeum-agent.log</td>
    </tr>
  </tbody>
</table>

## Generate a diagnostic report

If Assist isn't working as expected, click the **?** icon in the top-right corner of the app and select **Generate Diagnostic Report**. Assist saves a text file, `AISupport-Diagnose-<timestamp>.txt`, to its log folder and shows a notification you can click to open it. The report includes the app and OS version, permissions, recent log entries and the last few steps Assist ran. Credentials are removed, and nothing is sent automatically — attach the file to your support ticket.

If the problem only happens sometimes, select **Start Debug Recording** instead, reproduce the problem, then select **Stop Debug Recording**. This saves `AISupport-Recording-<timestamp>.txt` with detailed logs from that window only, and returns logging to normal when you stop.


# Tools overview
Source: https://docs.idemeum.com/asssit-tools-overview

Code-reviewed functions that perform every action Assist takes.

## What are tools?

Tools are how Assist acts. Each one is a code-reviewed function that does one thing, such as scanning a disk, flushing the DNS cache or resetting an Okta password. Everything Assist does, on the device or in a connected cloud system, goes through a tool.

[Skills](/assist-skills-overview) decide what to do and when; tools do the work. The AI picks which tool to call and with what inputs, but it can't write commands or scripts, or do anything outside the tool list.

* **Read-only counterparts.** Tools that change something usually have a read-only partner, such as `get_*_info`, so skills can diagnose without changing anything.
* **Questions are tools too.** When Assist asks the employee to approve, choose or fill in a form, that pause is a tool, so it's checked and recorded like any other step.

<Card title="Skill and tool library" icon="book" href="https://github.com/idemeum/skills">
  Browse every tool's source and metadata on GitHub.
</Card>

## Tool metadata

Each tool declares its own metadata, and the [guardrails](/assist-guardrails) enforce it on every run:

| Property | What it declares |
| - | - |
| Risk level | Low, medium or high. Higher risk means stronger checks. |
| Destructive | Whether it changes or removes anything. |
| Requires consent | Whether the employee must approve it first. |
| Supports preview | Whether it can show what would change before changing it. |
| Scope | What it can touch, such as the employee's account, network settings or the system. |
| Audited | Whether successful runs are recorded in the audit log. Failures always are. |

For example, `kill_process` is medium risk, destructive, needs consent and supports preview, so Assist always shows a preview and waits for approval before it runs. The tool's metadata sets this, so neither the skill author nor the AI can skip it.

Inputs are checked against a strict schema before any tool runs, and tools refuse protected targets, such as system processes, whatever the plan says.

## Why deterministic tools?

Many AI agents act by writing and running scripts. Assist doesn't:

* **Reviewed once, trusted every time.** Every tool is reviewed and tested before it ships. A generated script is new, unreviewed code on every run.
* **No path from prompt to shell.** The AI can only choose from the tool list, so even a manipulated model can't run arbitrary code.
* **Checks set in advance.** Risk levels only work when every possible action is known ahead of time.
* **A clear audit trail.** The record names exactly which tool ran and with what inputs.
* **Predictable failures.** Tools return known errors that skills are written to handle.


# Automate overview
Source: https://docs.idemeum.com/automate-overview



Automate is currently under development and will be available soon.


# Changelog
Source: https://docs.idemeum.com/changelog

Product updates and release history.

For the desktop agent changes history you can use this [page](https://asset.idemeum.com/assets/desktop-app/versioning.html).

<Update label="8/26/2026">
  ### New

  * Periodically check domain MSP accounts and disable them in case any account is not in use and is enabled.
  * Configurable session timeout for JIT sessions. New customer tenants will have this enabled for 1 hour.
  * Password rotation post sign in and sign out / lock for JIT accounts.
</Update>

<Update label="6/8/2026">
  ### New

  * AI analysis agent to analyze and explain every elevation or execution event - [docs](https://docs.idemeum.com/ai-for-endpoint-control/analysis-ai-agent), [demo video](https://youtu.be/cfXEu1q9T34)
  * Request approval flows for application allowlisting
  * Sudo application control on macOS - [docs](/epm/sudo-control-for-mac-os)
  * New admin portal UI

  ### Improvements

  * Registry flag for application control mode - [docs](https://docs.idemeum.com/desktop-agent/agent-identifier#app-control-mode-registry-key)
  * SMB/IPC protocol replaced with LDAP during JIT login to avoid multiple connection conflicts
  * Fix potential memory leak in IDM notification process
  * Not applying elevation for admin users - [docs](https://docs.idemeum.com/epm/epm-control-mode)
  * Desktop name fix: No longer dependent on network to derive the hostname
</Update>

<Update label="4/16/2026">
  ### New

  * Integration with Sophos Intellix for malware reputation. Every application hash is verified against malware database - [learn more](/application-trust/malware-reputation)
  * Confidence score for each application - [learn more](/application-trust/confidence-score)
  * Publishers view to discover all publishers and auto create rules - [learn more](/allowlisting/publishers-view)
  * Agent diagnostics to troubleshoot installation failures - [learn more](/control-agent/agent-troubleshooting)

  ### Improvements

  * When requesting Entra JIT account we check if the account is locked. If it is, then idemeum automatically unlocks it.
</Update>

<Update label="3/13/2026">
  ### New:

  * Elevation and allowlisting rules when computers are offline
  * Per device rules for EPM and AL
  * Automatic domain JIT account deletion if the account is not used for 30 days
</Update>

<Update label="2/4/2026">
  ### Improvements

  * Events - Disable inputs when attributes values are empty
  * IT Tenant - Show Auto update section in General settings
</Update>

<Update label="12/15/2025">
  ### New:

  * Admin email elevation notifications
  * User email elevation notifications
  * Reason for elevation
  * Snooze allowlisting user pop ups
  * Allowlist all verified publishers (Windows and macOS)

  ### Improvements

  * Improved fragile apps handling in the audit mode
  * Frequent MSA account update skipped to avoid replication conflicts
  * Fixed the issue with application fencing not triggering post elevation flow
  * Fixed the issue with multiple badge ids associated with a user record on enrollment
</Update>

<Update label="11/11/2025">
  ### New:

  * Application allowlisting for macOS (catalog, fencing, rule engine, and more)
</Update>

<Update label="10/14/2025">
  ### New:

  * macOS 2.0.0
  * Unified macOS installation
  * Menu bar dropdown on maOS (notifications and settings update)

  ### Improvements

  * Migrated from daemon to macOS security extension
  * Migrated to APNS notifications
  * Reduced file size from 100MB to 35MB
</Update>

<Update label="9/14/2025">
  ### New:

  * macOS 1.16
  * Support for macOS Tahoe

  ### Improvements

  * macOS UI refresh with updated screen
  * Windows agent migration to .NET 8.0
  * Improved the TOTP login flow to account for the time drift
  * Added support for German, Dutch, and French languages for Windows
  * Improved performance for Windows allowlisting when collecting file information - responds 2x faster
</Update>

<Update label="8/18/2025">
  ### New:

  * Allowlisting for Windows ARM
  * API - on-demand delegation for JIT access

  ### Improvements

  * Ensure the user fast switch is enabled during agent installation and update
  * Fix the issue of special characters in tenant display name - no longer allowing to save the display name with special characters
</Update>

<Update label="8/12/2025">
  ### New:

  * HaloPSA integration to approve tickets with buttons
  * APIs to manage rules
  * Auto user elevation for Windows apps
  * Bulk rule deletion
  * Process tree generation in the UI

  ### Improvements

  * Allow to share desktop for shared and dedicated mode
  * Fixed the elevation installation command for the macOS installer generation in the UI
  * Fixed the rule generation in the UI to add verified element only if more than one subject elements exist
</Update>

<Update label="7/30/2025">
  ### New:

  * Windows allowlisting - public release
</Update>

<Update label="7/23/2025">
  ### Improvements

  * Updated terminology from customer to tenant everywhere in admin and user portals
  * Improved tenant switcher to pull all tenants on customer tenant creation, no need to refresh the page for tenant switcher to display all tenants when new child tenant is created
  * Provide search options for all drop down lists
  * Close notification drawer on outside click
  * Added additional test cases
  * Fixed audit chart scrolling
  * Fixed menu and close icons
  * Fixed clipboard copy for DID
</Update>

<Update label="6/27/2025">
  ### New:

  * Real-time settings

  ### Improvements

  * Updated our APIs to return parametrized installation command in addition to returning the whole command as a string.
  * Enhanced Windows JIT login by avoiding automatic user switch on lock. No longer messing up with VPNs or user desktop settings.
  * Enhanced how we tag devices in the admin portal. Now when agent is installed with properly show servers, domain controllers, or workstations. We also properly reflect domain, local, or Entra-joined status.
  * Made an enhancement to ensure the JIT account always belongs to Administrator group. Even if membership is removed, idemeum will reassign it during next login.
  * Enhanced RFID tap-out flow to ensure card data is cleared, i.e., card hold data time elapses before disconnecting or signing out of the session.
  * Enhanced JIT flow to avoid WMI query which at times takes longer to complete.
  * Enhanced UAC capture flow to handle unverified events properly.
  * Improved log clean up.
  * Google has discontinued support for the authorization flow in Internet Explorer, so changed to a Chromium-based browser instead of the default Internet Explorer for RFID SSO.
  * Managing version.txt for RMM tools that cannot read from the registry.
  * Optimized token fetch calls by leveraging the cached token in the Update Settings flow.
  * Ensuring metadata is synced to the cloud once a day, if not updated
  * Domain JIT account login: do not fail if one or more DC is not reachable during account verification.
  * Fixed the issue of bulk elevation mode change in the UI.
  * Fixed offline transition when DNS does not resolve the idemeum domain.
</Update>

<Update label="4/24/2025">
  ### New:

  * Device agent status

  ### Improvements

  * Updated Immy.bot integration
  * Add an option to set up tap out mode per device for RFID SSO devices
  * Enhanced Entra JIT flows to prevent circular login issue by adding prompt=login query param to OIDC launch URL
  * Show Invited status for newly added users when local directory is used
  * Uninstall notification is now sent to device agent when the record is deleted from the cloud portal
  * We now reload credential provider settings every time you switch between default and idemeum credential providers
  * Fixed the bug in the MSP tenant switcher when multiple tenants were selected at once
</Update>

<Update label="4/3/2025">
  ### New:

  * Windows ARM support
  * New APIs (`devices` and `groups`)

  ### Improvements

  * Enhanced `customer` endpoints to return installation commands for customer tenants
  * Added option to change the display name for a customer tenant.
  * Now when the desktop agent is installed on Windows, there is a unique agentId that is created in the registry.
  * Updated the text and instructions in the welcome email that is received when you add / invite a new user to idemeum MSP tenant.
  * When in RFID mode and Google directory is used as a user source, we now support logins with domain shared account, in case machine is domain-joined.
  * we now support the option to delete the user from idemeum MSP tenant when the user source is Entra
  * Fixed the issue for Entra ID admin accounts not being downgraded when Auto downgrade feature is enabled.
  * Enhanced processing the UAC events when the last logged in user is preselected.
  * Fixed the credential submission loop when auto filling credentials for Entra ID in incognito mode.
  * Fixed the issue of auto filling credentials in RFID mode when native credential provider was used.
  * Fixed macOS issue when pkg files were not properly processed in Technician mode for automatic elevation
</Update>


# Chats integrations
Source: https://docs.idemeum.com/chats-integrations

Integration AI support agent with chat platforms.

# What is chat integration?

Chat integrations let employees start Endpoint Care from where they already ask for help: Slack and Microsoft Teams. The employee describes the problem to the bot, and one click later the agent on their device is working on it, with every skill, guardrail, and audit behavior identical to a run started in the app.

```mermaid theme={null}
%%{init: {
  "theme": "base",
  "themeVariables": {
    "fontFamily": "Inter, ui-sans-serif, system-ui, sans-serif",
    "fontSize": "14px",
    "primaryColor": "#ffffff",
    "primaryBorderColor": "#e4e4e7",
    "primaryTextColor": "#18181b",
    "lineColor": "#a1a1aa",
    "edgeLabelBackground": "#ffffff"
  },
  "flowchart": { "nodeSpacing": 40, "rankSpacing": 42 }
}}%%
flowchart TD
    A("Employee messages the bot in Slack or Teams") --> B("Bot verifies the request and identifies your tenant")
    B --> C("Bot replies instantly with a card and a Fix it button")
    C --> D("Button opens the desktop agent with the request pre-filled")
    D --> E("Run executes on the device with full guardrails, recorded like any run")

    classDef card fill:#ffffff,stroke:#e4e4e7,stroke-width:1px,color:#18181b;
    classDef primary fill:#18181b,stroke:#18181b,color:#fafafa;
    class A,B,C,D card;
    class E primary;
```

1. **The employee messages the bot** — "my laptop is slow" — in Slack or Teams.
2. **The bot authenticates the message.** Slack requests are verified with Slack's request signing; Teams requests with Microsoft's JWT verification. The workspace or bot registration maps to your tenant, so multi-tenant deployments stay isolated.
3. **The bot replies immediately** with a card (Slack Block Kit / Teams Adaptive Card) carrying the request and an action button.
4. **The button hands off to the device.** It opens the desktop agent through a secure app link with the employee's request pre-filled; the request text is sanitized and length-capped before it travels. The agent opens even if it wasn't running.
5. **The run executes on the device** — same skills, same gates, same previews and consent, same audit trail. In the console it appears like any other run, with chat recorded as its source.

# Setup

Chat platforms are connected per tenant from the admin portal's **Chat platforms** page: a Slack app for your workspace, an Azure Bot registration for Teams. Employees need the desktop agent installed on their machine; nothing else is required on their side.

Check out [integrations](/integrations) to learn how to connect Slack and Teams.


# Control agent branding
Source: https://docs.idemeum.com/control-agent/agent-branding

Customize how login screen looks when idemeum control agent is installed.

## Configure agent branding

* Login to your idemeum admin portal (customer tenant in case of MSP setup)
* Access `Control settings` → `Desktop agent`
* You can now upload logo and background images, and specify the text to be displayed on the login screen

<img alt="Branding" />

Here are more details about the configuration options:

<ParamField type="required">
  Upload company logo image and it will be displayed at the top right of the screen. The recommended image is `28x28 px`.
</ParamField>

<ParamField type="required">
  Upload the image that will be used as a background for the login screen. The recommended resolution is `1980x1080 px`.
</ParamField>

<ParamField type="required">
  Upload the image for login tile that is located in the middle of the screen. Recommended resolution is `400x400 px`. Login tile is applicable for logins with RFID badge.
</ParamField>

<ParamField type="required">
  Specify any message that will be displayed to the user on the right side of the screen. The maximum size of the text is 500 characters.
</ParamField>


# Control agent health status
Source: https://docs.idemeum.com/control-agent/agent-health-status

Track control agent last check-in time to monitor health.

## Control agent health states

Every time idemeum contr agent checks in with the cloud, the time stamp is captured and the health status is updated. Agent reaches to cloud every 6 hours in order to retrieve the latest settings, rules, and configuration changes. Also when agent performs operations with the cloud (login processing, events update), the health status is updated as well.

Based on the latest timestamp the agent health status is displayed as the following:

* <Badge icon="circle-dot">Healthy</Badge> - the last check is no more than 1 day ago
* <Badge icon="circle-dot">Unhealthy</Badge> - the last check in is between 1 day and 3 days
* <Badge icon="circle-dot">Out of service</Badge> - the last check in is more than 3 days

<img alt="Clean Shot 2026 05 21 At 15 50 07@2x" />


# Install control agent
Source: https://docs.idemeum.com/control-agent/agent-install

Install idemeum control agent on Windows or macOS.

## Single tenant installation

<Note>
  Here you install control agent and pair it directly with your tenant. If you need to install agent in bulk and pair with multiple tenants (MSP setting) navigate to the next section.
</Note>

<Tabs>
  <Tab title="Windows">
    ### Installation

    <Steps>
      <Step title="Obtain PowerShell script">
        Navigate to your idemeum admin portal, click `Install agent` button, then choose `Control agent` and copy the installation script for Windows.

        <img alt="Clean Shot 2026 05 21 At 15 32 22@2x" />
      </Step>

      <Step title="Execute script using PowerShell">
        <Warning>
          Make sure you execute the script with PowerShel Administrator privileges.
        </Warning>

        Open PowerShell and execute the installation script with Administrator privileges. Idemeum will install all required prerequisites before installing the agent. No restart is required after successful installation.
      </Step>
    </Steps>

    ### Command-line arguments

    You can pass additional command-line arguments to the installation script:

    <ParamField type="'true' | 'false'">
      Restart is not required, however you can still trigger the restart after the successful installation by passing `true` as an option.
    </ParamField>

    <ParamField type="'disabled' | 'audit' | 'rules'">
      By default when the agent is installed it operates in `disabled` mode. You can pass the mode which you want to apply at installation time.
    </ParamField>

    <ParamField type="'2.5.1'">
      Pass the desktop version that you want to install. By default the latest version will be installed. You need to pass the version with '', for instance '2.5.1'.
    </ParamField>
  </Tab>

  <Tab title="macOS">
    ### Installation

    <Warning>
      When installing macOS control agent you will need to enable security permissions, including Security Extension and Full Disk Access. We recommend deploying production agents with MDM profile to make sure permissions stay enabled after agent updates.
    </Warning>

    <Steps>
      <Step title="Obtain profile and script for macOS">
        Navigate to your idemeum portal, click `Install agent`, choose `Control agent`,  then select `macOS` and download profile and script. 

        <img alt="Clean Shot 2026 05 21 At 15 11 12@2x" />
      </Step>

      <Step title="Deploy profile with your MDM">
        Push the idemeum profile to macOS workstations where idemeum agent will be deployed. Profile automatically enables all required settings.
      </Step>

      <Step title="Deploy bash script">
        Now you can deploy the idemeum script to your workstations using the deployment tool of your choice (MDM, RMM, etc.). No restart is required after installation.
      </Step>
    </Steps>

    ### Command-line arguments

    You can pass additional command-line arguments to the installation script:

    <ParamField type="'disabled' | 'audit' | 'rules'">
      By default when the agent is installed it operates in `disabled` mode. You can pass the mode which you want to apply at installation time.
    </ParamField>
  </Tab>
</Tabs>

## Bulk agent installation

Bulk installation helps MSPs to deploy agent across multiple tenants with a single command. Instead of obtaining installation command from a customer tenant, obtain a command from your MSP tenant instead. Then you can use this command with RMM and leverage RMM variables to dynamically pass the customer name to an installation command. Idemeum control agent will automatically create customer tenants.

<Steps>
  <Step title="Obtain bulk command from MSP parent tenant">
    Login to your MSP tenant, click `Bulk agent install` and then choose `Control agent`. Copy the installation command for Windows or download the profile and installation script for macOS.

    <img alt="Clean Shot 2026 05 21 At 15 17 46@2x" />
  </Step>

  <Step title="Store the command in your RMM">
    Store the bulk installation command in your RMM. Make sure you leverage proper customer name variable and pass it to the installation script `-customerName` input variable.
  </Step>

  <Step title="Explore integration guides">
    Check our [integration](/integrations) page to explore the examples of how to deploy idemeum agent with various RMMs.
  </Step>
</Steps>


# Control agent logs
Source: https://docs.idemeum.com/control-agent/agent-logs

Idemeum control agent logs to troubleshoot misconfigurations.

## Control agent logs location

Idemeum control agent collects various logs, including installation, authentication, and application events. The logs are kept for 3 days on a rolling window, and each file is named as `<log module>_month_day_year`. At any given point in time you can access the logs for the last three days.

Here is where you can locate logs on the workstation:

<CodeGroup>
  ```text Windows theme={null}
  C:\Program Files\idemeum Inc\idemeum Desktop Client\logs
  ```

  ```text macOS theme={null}
  /usr/local/var/idemeum/logs
  ```
</CodeGroup>

## Push logs to idemeum team

For help and troubleshooting you can push logs to idemeum team right from your workstation. Simply login to workstation, open idemeum application, and click `Send logs to cloud`.

<img alt="Image" />


# Control agent requirements
Source: https://docs.idemeum.com/control-agent/agent-requirements

Meet these requirements to install idemeum control agents.

## Operating system support

<Tabs>
  <Tab title="Windows">
    | Operating system | x64 | ARM | Products |
    | - | - | - | - |
    | Windows 10 | Yes | - | <Badge>AL</Badge><Badge>EPM</Badge><Badge>MSP JIT</Badge> |
    | Windows 11 | Yes | Yes | <Badge>AL</Badge><Badge>EPM</Badge><Badge>MSP JIT</Badge> |
    | IoT Enterprise | Yes | - | <Badge>AL</Badge><Badge>EPM</Badge><Badge>MSP JIT</Badge> |
    | Server 2016 | Yes | - | <Badge>MSP JIT</Badge> |
    | Server 2019 | Yes | - | <Badge>MSP JIT</Badge> |
    | Server 2022 | Yes | - | <Badge>MSP JIT</Badge> |
    | Server 2025 | Yes | - | <Badge>MSP JIT</Badge> |
  </Tab>

  <Tab title="macOS">
    | Operating system | Intel | Apple Silicon | Products |
    | - | - | - | - |
    | macOS 14 Sonoma | Yes | Yes | <Badge>AL</Badge><Badge>EPM</Badge><Badge>MSP JIT</Badge> |
    | macOS 15 Sequoia | Yes | Yes | <Badge>AL</Badge><Badge>EPM</Badge><Badge>MSP JIT</Badge> |
    | macOS 26 Tahoe | Yes | Yes | <Badge>AL</Badge><Badge>EPM</Badge><Badge>MSP JIT</Badge> |
  </Tab>
</Tabs>

## Network requirements

The control agent does not listen on any port for traffic initiated external to the `localhost`, thus does not increase potential attack vectors. However, as outbound connections are made, any egress filtering performed by antivirus software, firewalls, routers, etc. would need to be opened.<br /><br />The `IDMNotification` component of the idemeum desktop client delivers push notifications to end-user workstations. It connects to Google's Firebase Cloud Messaging infrastructure using the same registration and delivery flow an Android device uses: a set of HTTPS calls to register the device, followed by a single long-lived TLS connection that stays open to receive messages as they arrive.

| FQDN | Port | Protocol | Notes |
| - | - | - | - |
| **mtalk.google.com** | 5228 | `TLS` | Primary delivery channel — the persistent connection notifications actually arrive on. Must stay open and idle-tolerant. |
| **mtalk.google.com** | 5229, 5230 | `TLS` | Google's documented fallback ports for the same delivery channel, used if 5228 is unreachable. |
| **android.clients.google.com** | 443 | `HTTPS` | Device check-in and app registration, performed on every client start or reconnect. |
| **firebaseinstallations.googleapis.com** | 443 | `HTTPS` | Firebase Installations API — issues the install token used to register with FCM. |
| **fcmregistrations.googleapis.com** | 443 | `HTTPS` | FCM Registration API — exchanges the install token for the device's push subscription. |
| **fcm.googleapis.com** | 443 | `HTTPS` | Resolves the push subscription endpoint referenced during registration. |
| **dvmi.idemeum.com** | 443 | `HTTPS` | Registration with idemeum cloud. |
| **asset.idemeum.com** | 443 | `HTTPS` | Pulling the desktop settings and updates. |
| **\<tenant name>.idemeum.com** | 443 | `HTTPS` | Registration with idemeum tenant. |

### Notes on notifications

All six destinations are outbound-initiated from the workstation. No inbound firewall rule is required — this governs which side opens the connection, not which side sends data on it. Once the workstation opens the socket to **mtalk.google.com**, Google's servers push notifications back down that same connection; no new inbound connection to the workstation is ever created.

The connection to **mtalk.google.com** is long-lived by design — it is expected to sit idle between notifications rather than open and close per message. Firewalls or proxies that aggressively time out idle TCP/TLS sessions should exempt this destination.

## DLLs and executables

Idemeum control agent is installed in the following location on Windows - `C:\Program Files\Idemeum Inc\Idemeum Desktop Client`. There are a number of executables and DLLs that idemeum control agent is using. All DLLs and executables are signed with idemeum certificate (signer `IDEMEUM INC`).

Also some of the required DLLs are placed in the `System32` folder. Those DLLs are also signed.


# Control agent troubleshooting
Source: https://docs.idemeum.com/control-agent/agent-troubleshooting

When you have agent installation issues, follow these steps to diagnose the problems.

## Overview

Sometimes when you install idemeum control agent you might experience installation errors on certain machines. This typically happens when you do not have sufficient permissions to install idemeum agent, the idemeum service is blocked when starting, security software is interfering, etc. In order to help you diagnose these issues, we created diagnostic scripts to identify the root cause of the problem.

## Service installation failure

You execute the agent install, and it fails with error `1603`. Then you open `idemeum_install.log` and observe the following:

```log lines wrap theme={null}
MSI (s) (E0:80) [08:16:56:573]: Product: Idemeum Desktop Client -- Error 1920. Service 'Idemeum Service' (IDMService.exe) failed to start. Verify that you have sufficient privileges to start system services.
```

This means idemeum service is not able to start successfully. Run this in `PowerShell` as `Administrator`.

```powershell wrap theme={null}
Set-ExecutionPolicy RemoteSigned -Scope Process -Force; Invoke-WebRequest -Uri https://asset.idemeum.com/desktoplogin/idemeumServiceCheckUtility.ps1 -OutFile "idemeumServiceCheckUtility.ps1"; .\idemeumServiceCheckUtility.ps1
```

This is a healthy sample output from a functioning machine.

```text lines wrap theme={null}
--- dotnet --list-runtimes ---
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.25 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.25 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
------------------------------

Registering DLL...
DLL registered successfully.
Starting service...
Service started successfully. Status: Running
Stopping service...
```

## Overall diagnostic

To diagnose the general state of the machine and any other idemeum installation failures run the following in `PowerShell` as `Administrator`:

```powershell wrap theme={null}
Set-ExecutionPolicy RemoteSigned -Scope Process -Force; Invoke-WebRequest -Uri https://asset.idemeum.com/desktoplogin/diagnostic.ps1 -OutFile "diagnostic.ps1"; .\diagnostic.ps1
```

Here is a healthy sample output:

```log lines theme={null}
=== Credential Provider Diagnostic ===
Target CLSID: {417C7858-EE65-42AD-9F11-5BA27FB1FF64}

=== Credential Provider Filters ===
Filter detected:
  CLSID : {DDC0EED2-ADBE-40b6-A217-EDE16A79A0DE}
  Name  : GenericFilter
  Note  : Benign / generic filter (ignored)

✔ No effective third-party Credential Provider Filters detected.

=== Idemeum Credential Provider Registration ===
✔ Credential Provider registry key exists.
✔ Credential Provider is not marked as disabled.

=== COM Registration Check ===
COM DLL path: IDMCP.dll
✔ COM DLL exists on disk.

=== All Registered Credential Providers ===
  CLSID : {1b283861-754f-4022-ad47-a5eaaa618894}
  Name  : Smartcard Reader Selection Provider

  CLSID : {1ee7337f-85ac-45e2-a23c-37c753209769}
  Name  : Smartcard WinRT Provider

  CLSID : {2135f72a-90b5-4ed3-a7f1-8bb705ac276a}
  Name  : PicturePasswordLogonProvider

  CLSID : {25CBB996-92ED-457e-B28C-4774084BD562}
  Name  : GenericProvider

  CLSID : {27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}
  Name  : TrustedSignal Credential Provider

  CLSID : {3dd6bec0-8193-4ffe-ae25-e08e39ea4063}
  Name  : NPProvider

  CLSID : {417C7858-EE65-42AD-9F11-5BA27FB1FF64}
  Name  : IDMCP

  CLSID : {48B4E58D-2791-456C-9091-D524C6C706F2}
  Name  : Secondary Authentication Factor Credential Provider

  CLSID : {600e7adb-da3e-41a4-9225-3c0399e88c0c}
  Name  : CngCredUICredentialProvider

  CLSID : {60b78e88-ead8-445c-9cfd-0b87f74ea6cd}
  Name  : PasswordProvider

  CLSID : {8FD7E19C-3BF7-489B-A72C-846AB3678C96}
  Name  : Smartcard Credential Provider

  CLSID : {94596c7e-3744-41ce-893e-bbf09122f76a}
  Name  : Smartcard Pin Provider

  CLSID : {BEC09223-B018-416D-A0AC-523971B639F5}
  Name  : WinBio Credential Provider

  CLSID : {C5D7540A-CD51-453B-B22B-05305BA03F07}
  Name  : Cloud Experience Credential Provider

  CLSID : {cb82ea12-9f71-446d-89e1-8d0924e1256e}
  Name  : PINLogonProvider

  CLSID : {D6886603-9D2F-4EB2-B667-1971041FA96B}
  Name  : NGC Credential Provider

  CLSID : {e74e57b0-6c6d-44d5-9cda-fb2df5ed7435}
  Name  : CertCredProvider

  CLSID : {F8A0B131-5F68-486c-8040-7E8FC3C85BB6}
  Name  : WLIDCredentialProvider

  CLSID : {F8A1793B-7873-4046-B2A7-1F318747F427}
  Name  : FIDO Credential Provider


=== Diagnostic Summary ===
✔ Credential Provider is correctly installed.
✔ No effective filter-based suppression detected.

=== UAC Settings (Readable) ===
EnableLUA                       : 1    (Enabled)
ConsentPromptBehaviorAdmin      : 0    (Elevate without prompting)
ConsentPromptBehaviorUser       : 3    (Prompt for credentials)
PromptOnSecureDesktop           : 1    (Enabled)
FilterAdministratorToken        :      (Not set)
EnableInstallerDetection        : 1    (Enabled)
EnableSecureUIAPaths            : 1    (Enabled)
ValidateAdminCodeSignatures     : 0    (Disabled)

=== End of Diagnostic ===
```


# Uninstall control agent
Source: https://docs.idemeum.com/control-agent/agent-uninstall

Uninstall idemeum control agent.

## Uninstall command

<Warning>
  Administrator permissions are required to uninstall idemeum agent.
</Warning>

<Tabs>
  <Tab title="Windows">
    Open Windows PowerShell as `Administrator` and execute the following commands.

    ```powershell theme={null}
    Start-Process -FilePath "msiexec.exe" -ArgumentList "/x {93B9CC98-6004-411E-A8BF-88F7C3BC5541} /qn /norestart" -Wait;
    Start-Process -FilePath "msiexec.exe" -ArgumentList "/x {71216D26-573B-402B-A3F5-A7CB9F950CFF} /qn /norestart" -Wait
    ```
  </Tab>

  <Tab title="macOS">
    Open macOS terminal as `Administrator` and execute the following script.

    ```shellscript theme={null}
    curl -LO https://asset.idemeum.com/desktoplogin/macos/idemeumMacDesktopUninstall.sh && sudo chmod +x idemeumMacDesktopUninstall.sh && ./idemeumMacDesktopUninstall.sh
    ```
  </Tab>
</Tabs>


# Update control agent
Source: https://docs.idemeum.com/control-agent/agent-update

Desktop agent can be automatically or manually updated.

## Auto control agent update

<Note>
  To enable automatic agent updates, access your idemeum admin portal, navigate to `Control settings` → `Desktop agent` and make sure auto update is enabled.
</Note>

<img alt="Clean Shot 2026 05 21 At 15 41 27@2x" />

Idemeum agent can be automatically updated when the new version is released. The update is silent and does not require restarts. 

## Manual control agent update

You can also update agent manually by executing the same [installation script](/desktop-agent/agent-install) from the admin portal. Get the install script for Windows or macOS and deploy directly or with your [deployment tool](/integrations). The script will identify that idemeum agent is already installed, and it will pull the update if available.


# Custom skills
Source: https://docs.idemeum.com/custom-skills

Create custom skills for Endpoint Care.



# Dashboard
Source: https://docs.idemeum.com/dashboard

Runs represent AI agent end to end executions.



# Control agent identifier
Source: https://docs.idemeum.com/desktop-agent/agent-identifier

Endpoint Control agent manages various Windows registry keys.

## Agent ID registry key

When idemeum control agent is installed, it pairs with a cloud tenant, and the record is created in the cloud with a uniquely assigned `AgentId`. This identifier is also written to the Windows registry in the following location:

```text wrap theme={null}
Path = Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Idemeum Inc\Idemeum Desktop Client
Key = AgentId
```

<img alt="Agentid" />

## App control mode registry key

When idemeum control agent is installed, and the EPM or allowlisting is enabled, the agent manages the registry key that reflects that current application control mode. So if you change or enable application control `disabled`, `audit`, or `rules`), the registry key will be set to appropriate value. Here is the location of the key.

```text wrap theme={null}
Path = KEY_LOCAL_MACHINE\SOFTWARE\Idemeum Inc\Idemeum Desktop Client\AppControlMode 
Values = Disabled/Audit/Rules
```


# Built-in skills
Source: https://docs.idemeum.com/endpoint-care-built-in-skills

Leverage skills that are developed and tested by idemeum team.

# What are built-in skills?

Endpoint Care ships with a library of built-in skills covering the most common IT problems: the issues that make up the bulk of a typical helpdesk queue. Each skill is an expert-authored playbook that defines when it applies, the diagnostic and corrective steps it takes, the tools it is allowed to use, and how it escalates when a fix is out of reach.

Built-in skills work out of the box: no configuration is needed, and they are updated automatically from the cloud. Any skill can be disabled fleet-wide from the console. You can view all available skills in the [idemeum/skills repo](https://github.com/idemeum/skills).


# Overview
Source: https://docs.idemeum.com/endpoint-care-overview

AI agents to manage IT autonomously.

Today we offer the following AI agents for IT teams.

| | Purpose | Trigger | Runs on |
| - | - | - | - |
| `Assist` | Help employees | A person asks | Employee's computer |
| `Automate` | Automate IT flows | A system triggers | Idemeum cloud |
| `Operate` | Operate IT products | An admin asks | Idemeum cloud |

## Assist

Assist is the agent employees talk to. It starts when an employee describes a problem, such as *"my VPN won't connect"*, or when a proactive trigger detects one, such as a disk running out of space. Because Assist runs as a desktop app on the employee's computer, it can repair the machine itself, fixing issues like [low disk space](https://github.com/idemeum/skills/blob/main/disk-cleanup/SKILL.md) or a [broken VPN](https://github.com/idemeum/skills/blob/main/vpn-repair/SKILL.md). It can also act in the cloud, for example to [reset a password](https://github.com/idemeum/skills/blob/main/entra-password-reset/SKILL.md). Guardrails require Assist to ask for the employee's consent before any sensitive action.

Anything Assist can't fix is triaged: categorized, enriched with diagnostics, and routed to the right team in your ticketing system. IT teams manage everything centrally: which skills are available, security policy, and a full audit of every run.

<Card title="Assist" icon="handshake-angle" href="/assist-overview">
  Conversational AI agent that resolves end user IT requests.
</Card>

## Automate

Automate runs IT workflows without anyone watching, such as onboarding an employee, adding a user to a group or assigning a license. It starts when another system sends an event, such as a new hire in your HR system, or on a schedule you set. Automate runs in idemeum cloud and works only through your connected systems, so nothing is installed on employee computers. With no user present, your policy approves each action, and every run is recorded in an audit trail.

## Operate

Operate is the agent IT teams ask. When an admin asks something like *"why can't [priya@acme.com](mailto:priya@acme.com) sign in?"*, Operate checks your identity provider, device management and RMM tools, covering account status, sign-in failures, MFA registration and device health, and reports the cause. Its diagnostic skills are read-only, so Operate changes nothing; any fix is a separate step the admin chooses.


# Assist troubleshooting
Source: https://docs.idemeum.com/endpoint-care-support-agent-troubleshooting

Troubleshoot Assist on Windows and macOS.

# Assist agent logs

Most issues fall into one of three buckets: the agent can't reach the cloud (skills and tickets stop updating), a permission is missing (specific skills stop before executing), or configuration didn't apply (the agent reads its `.env` once at startup). This page covers where to look, starting with the logs, which almost always contain the answer: the agent logs every run, every gate decision, every cloud call, and every rejected skill update with the reason.

**Agent log** (`idemeum-agent.log`):

| **OS** | **Path** |
| :- | :- |
| macOS | \~/Library/Logs/AI Support Agent/idemeum-agent.log |
| Windows | %APPDATA%\AI Support Agent\logs\idemeum-agent.log |

# Generate a diagnostic report

If Assist isn't working as expected, click the **?** icon in the top-right corner of the app and select **Generate Diagnostic Report**. Assist saves a text file, `AISupport-Diagnose-<timestamp>.txt`, to its log folder and shows a notification you can click to open it. The report includes the app and OS version, permissions, recent log entries and the last few steps Assist ran. Credentials are removed, and nothing is sent automatically — attach the file to your support ticket.

If the problem only happens sometimes, select **Start Debug Recording** instead, reproduce the problem, then select **Stop Debug Recording**. This saves `AISupport-Recording-<timestamp>.txt` with detailed logs from that window only, and returns logging to normal when you stop.


# Endpoint control overview
Source: https://docs.idemeum.com/endpoint-control-overview

Endpoint control allows you to control applications, govern privileges, and secure admin accounts on your endpoints.

## What is Endpoint Control?

Endpoint Control unifies multiple products under the same umbrella.

<Card title="Endpoint Privilege Management" icon="arrow-up-from-bracket" href="/endpoint-privilege-management-overview">
  Remove admin privileges and manage elevations with rules and request / approval flows. 
</Card>

<Card title="Application allowlisting" icon="clapperboard" href="/allowlisting-overview">
  With allowlisting you control what applications run on endpoint, blocking everything else including ransomware. Unless allowed, it can not run.
</Card>

<Card title="Just-in-time Admin Access" icon="user" href="/jit-admin-access-overview">
  Replace shared credentials with on-demand admin accounts with passwordless access.
</Card>


# EPM overview
Source: https://docs.idemeum.com/endpoint-privilege-management-overview

Manage local admin rights and automate elevation requests.

## EPM YouTube demo

<Card title="EPM for Windows and macOS" icon="video" href="https://www.youtube.com/watch?v=AteSYJAGpyo">
  Youtube video for macOS and Windows Endpoint Privilege Management
</Card>

## What is Endpoint Privilege Management?

<Note>
  Endpoint Privilege Management (EPM) is a security solution that enforces the `principle of least privilege` by removing local administrative rights from users, allowing them to run necessary, approved applications with elevated privileges only when required. It reduces the attack surface, prevents unauthorized software execution, and mitigates ransomware risks by controlling which applications have high-level access. 
</Note>

Endpoint Privilege Management (EPM) is all about implementing least privilege security on your Windows and macOS workstations. It is a cloud solution that allows you to remove local admin rights on your workstations to protect your organization. A user without local admin rights can't make changes to system folders, kill processes, remove security software, and more. This makes your organization more secure, but the weakness is that users still need admin rights from time to time to install, update, or use business software. With idemeum EPM you can apply rules to automatically elevate certain apps or system actions without giving users permanent admin permissions.

## EPM primary features

<AccordionGroup>
  <Accordion title="Rule engine">
    Flexible rule engine to determine how elevation requests need to be handled. You can match applications with `file attributes`, `publishers`, or `certificate elements`, and then define what applications need to be elevated automatically or blocked.
  </Accordion>

  <Accordion title="Audit mode">
    Idemeum agent can operate in `audit` mode to discover applications that users are elevating without enforcing any rules. After you identify the applications you need, you can enforce the `rules` mode.
  </Accordion>

  <Accordion title="Request / approval flows">
    Idemeum offers the option for users to request elevated actions. Once the request is submitted, IT team will receive a notification / ticket will be created in the ticketing system.
  </Accordion>

  <Accordion title="Integrations with ticketing systems">
    Idemeum integrates with various ticketing systems (HaloPSA, ConnectWise, etc.) to be able to create tickets when users request elevated actions.
  </Accordion>

  <Accordion title="Allowlisting integration">
    Idemeum EPM integrates seamlessly with allowlisting so that you can combine application control with elevation management.
  </Accordion>

  <Accordion title="Technician mode">
    Idemeum agent offers protected mode for IT technicians to bypass any enforcement rules when they need to troubleshoot the workstation. Authenticate with mobile application to access the technician mode on any workstation.
  </Accordion>

  <Accordion title="Auto account downgrade">
    For compliance requirements you can enforce standard user accounts across your workstations. Idemeum agent will periodically check the local `Administrators` group and downgrade all accounts there, except the exclusion list that you specify.
  </Accordion>

  <Accordion title="Account discovery and management">
    Idemeum agent automatically discovers all local admin and domain admin accounts across your workstations and offers an option to downgrade or remove these accounts.
  </Accordion>
</AccordionGroup>


# Account auto downgrade
Source: https://docs.idemeum.com/epm/account-auto-downgrade

Automatically downgrade admin accounts on your workstations.

## How accounts are discovered

When idemeum control agent is installed, it will automatically discover all local and domain admin accounts. You can manually manage these accounts from the cloud, or you can automatically downgrade them.

## Manage accounts manually

* Access admin portal of your organization / customer
* Navigate to `Devices` → `Accounts`
* You can now filter accounts with the device filter, select the account and downgrade or remove it from the workstation

## Automatically downgrade admin accounts

* Access admin portal of your organization / customer
* Navigate to `Control settings` → `EPM` and enable the auto downgrade feature.
* You can also specify the accounts that you would not want idemeum agent to downgrade.

<img alt="Clean Shot 2026 05 25 At 12 10 48@2x" />


# Admin elevation notifications
Source: https://docs.idemeum.com/epm/admin-elevation-notifications

How IT admins receive notifications when users request elevations.

## How admin notifications work

There are several ways IT admins can be notified when there is an elevation request.

<AccordionGroup>
  <Accordion title="Web admin portal" icon="page">
    Open your idemeum admin portal and navigate to `Activity`→ `Requests` section where you can see all elevation requests. You can respond to any request by clicking on `...`. 
  </Accordion>

  <Accordion title="Mobile notifications" icon="mobile">
    When the elevation request is received, idemeum will send push notification to all admin mobile devices. Right from the mobile device you can respond to the request.
  </Accordion>

  <Accordion title="Ticketing integrations" icon="ticket">
    Idemeum supports integrations with various ticketing systems in order to create tickets for elevation requests. Check our integrations page for all available integrations.
  </Accordion>

  <Accordion title="Admin email notifications" icon="message">
    Idemeum can also send the email to specified email address when the elevation is requested. In the admin portal you can configure multiple email address that need to receive the elevation notification.
  </Accordion>
</AccordionGroup>

## Configure admin email notifications

* Navigate to your idemeum admin portal
* Access `Control settings` -> `EPM`
* In the `Emails to notify` section you can add up to three email addresses to receive elevation notifications.

<img alt="Clean Shot 2026 05 25 At 12 20 47@2x" />

Here is the example email elevation notification received to the specified email address. The email contains all the metadata about the user, application, and idemeum tenant. When you click on the button, you will be redirected to idemeum portal to approve or deny elevation notification.

<img alt="IMG 1375" />


# Admin / user elevation
Source: https://docs.idemeum.com/epm/admin-user-elevation

You can elevate applications with on-demand account or temporarily promote the user account.

## How different elevation types work

Idemeum EPM offers two types of elevation:

<AccordionGroup>
  <Accordion title="Admin elevation" icon="user-clock">
    User request is elevated using another admin account, therefore the program will run in the context of an admin user. Agent will use `msp-elevate` account that will be automatically created on the workstation. This is the default elevation type. No user authentication is needed.
  </Accordion>

  <Accordion title="User elevation" icon="user-check">
    User who made the request will be temporarily promoted to an `Administrator` role. And then this user account will be used to elevate the privileged action. As a result, the requested application will run in the context of a user who made the request. Immediately after the elevation is competed, the user is demoted back to a Standard user. When the user elevation occurs for the first time for any given user, idemeum will prompt the user to enter username and password. Once the valid credentials are entered, these credentials will be stored locally on the workstation and will be used for manage UAC prompts.
  </Accordion>
</AccordionGroup>

## Choose elevation type

When approving elevation requests (on the mobile or web portal), or creating the elevation rules you will be presented with the drop down to select elevation type.

<img alt="Clean Shot 2026 05 25 At 11 55 00@2x" />


# Elevation events
Source: https://docs.idemeum.com/epm/elevation-events

Control agent captures every elevation event on your workstation and uploads each event metadata to the cloud. 

## How elevation events work

<Note>
  Elevation events are collected only when EPM is [enabled](/documentation/products/epm/enable-epm), and the [EPM control mode](/documentation/products/epm/epm-control-mode) for the workstation is set to `audit` or `rules`.
</Note>

* Events are captured on Windows and macOS workstations when applications need to launch with administrative privileges or user needs to take a privileged action.
* On windows idemeum agent intercepts and captures the [UAC](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works) event. For macOS we rely on [endpoint security API ](https://developer.apple.com/documentation/endpointsecurity)to capture the elevation event.
* For `audit` mode elevation events are captured for both `admin` and `standard` users
* Idemeum cloud retains `120 days` of elevation events per tenant
* Elevations events are uploaded to cloud in real time

## Elevation event structure

To access elevation events navigate to your admin portal and access `Activity` → `Events`. You will be presented with the high level view of all events for your tenant. You can click on each event to expand the metadata for the event.

<img alt="Clean Shot 2026 05 25 At 11 04 27@2x" />

Now let's look at what each attribute in the event means.

| Value | Example | Description |
| - | - | - |
| Timestamp | `1/30/26 3:33:52 PM` | Date and time for when the execution or elevation happened. |
| Computer | `AL-W11-L` | Workstation that generated the event. Next to the computer name you will see the icon for Windows or macOS. |
| User | `SYSTEM` | User under which context the application is executing. |
| Filename | `updater.exe` | Filename of the executed application. |
| Elevation | `Allow, Deny, Audit` | Tag that shows whether the application was allowed to elevate or not. For standard non-admin executions this tag is not shown. `Audit` represents the device that is in audit mode and not enforcing any rules. |
| Confidence | `Soft allow` | Idemeum confidence score that shows how safe the application is in your environment. We use 20+ behavioral attributes to calculate the score. Learn more [here](/application-trust/confidence-score). |
| Reputation | `Known good, Unknown, Malware` | Reputation of the file obtained from Sophos Intelligence cloud. Learn more [here](/application-trust/malware-reputation). |
| Publisher | `Google LLC` | Organization that signed the executable. If you expand the event, you will be able to see whether the publisher is verified by operating system or not. |
| Parent | `consent.exe` | Parent process that was responsible for launching the executable. |
| Actions | `...` | Actions that you can take on the event, including rule creation. |
| Description | `Google updater` | Description of the executable file. |
| File path | `C:/program...` | File path from where the executable is launching. |
| File version | `2.5.1` | File version of the executable. |
| SHA256 hash | `320F6790E928200...` | Hash of the executable file takes with SHA256 algorithm. |
| Verified publisher | `Yes` | If the executable is legitimately signed with the certificate, and that certificate is trusted on the endpoint, the publisher will show as verified. |
| Certificate thumbprint | `607A3EDAA64933...` | Hash of the certificate that is used to sign the executable (if executable is signed). |
| Certificate elements | `CN=Google LLC,OU=Google...` | When you expand the event, idemeum shows you the elements of the certificate that is used to sign the executable, such as `CN`, `OU`, `C`, etc. |


# Elevation requests
Source: https://docs.idemeum.com/epm/elevation-requests

Users can submit requests for application elevations.

## How elevation requests work

* When the application needs elevation, and the elevation is not blocked or auto approved, then users can submit the request to allow elevation.
* To notify admins on the request and users about the status the following will be done:
  * Mobile notification will be sent to all admins of the idemeum tenant
  * If integration with ticketing is configured, idemeum will create an elevation ticket
  * If users provided the email address when requesting an elevation, the approval or denial updates will sent to that email address ([user elevation notifications](/epm/user-elevation-notifications))
  * When the elevation request is approved / denied idemeum will send a push notification to the user workstation
  * If [admin elevation notifications ](/epm/admin-elevation-notifications)are configured, idemeum will send the request information to the specified list or email addresses
* Requests can be viewed in the web portal and also the mobile app
* Requests contain all metadata information for who is requesting what
* IT technicians can approve / deny requests from mobile app, web portal, or integrated ticketing system.
* Once request is approved, it is removed from the list, and the audit event is created for who handled the request
* Requests automatically expire if not acted upon after `4 days`

## Elevation request actions

When you approve / deny elevation request, you can take the following actions:

1. `Approve /deny once for user` - you can approve or deny request once for the current application and requesting user. Once the request is approved, user will be able to carry our privileged action without the need to elevate. The approval will only be valid for one-time use, and if the user tries to do the same action again, she will need to request again.
2. `Approve / deny for tenant` - you can approve or deny request with automatic rule creation, so that all further requests from other users for this application or action will be handled by the rule. For example, if you deny PowerShell launch as `admin` for user `alex` by creating a rule, all other users will not be able to launch PowerShell as admin.

## Respond to elevation requests

### EPM requests in web portal

* Navigate to your idemeum admin portal
* Access `Activity` → `Requests` to see all requests in the queue
* Once you access the request, you can click on `...` and choose if you want to approve or deny the request. If you decide to create a rule, you will be presented with the dialog for rule configuration, and you can leverage any event attributes for rule definition.

### EPM requests on mobile

* If you received a mobile notification, click on it and the request details will be shown. You will be able to see all associated metadata, and you will be able to approve / deny the request

<img alt="Mobile Request" title="Mobile Request" />


# Elevation rules
Source: https://docs.idemeum.com/epm/elevation-rules

With elevation rules you can define what can auto elevate on your workstations.

## Elevation rules framework

<Note>
  In this case we are only looking at elevation rules, without allowlisting to control application execution. If you want to learn more about allowlisting and full cycle rules, please check [here.](/allowlisting/allowlisting-rules)
</Note>

<Steps>
  <Step title="What is the application?">
    The first part of the rule is to catch or match the application you are trying to elevate. Before elevating something, we need to know what it is. You can match the target application using `file attributes` (hash, name. path, etc.), `publisher thumbprint` (the hash of the certificate that is used to sign the executable, or `certificate elements` (when application is signed you can use certificate elements of the signing certificate to match the app).
  </Step>

  <Step title="Allow elevation?">
    If an application requires admin privileges, and you maintain standard rights for all users, you can allow the application to automatically elevate.
  </Step>

  <Step title="Can users request?">
    When application elevation is blocked, your users can request the permission or elevate the application.
  </Step>
</Steps>

## Elevation rules best practices

These are some of the best practices related to rule management:

* Give rules descriptive names so that you know what the rule is doing
* The best rules are the ones that leverage `certificate elements`. For instance you create a rule that allows everything that is signed by certificate belonging to `Zoom Inc`.
* If you do not want to use certificate elements, use `certificate thumbprint`. This is second best. Allowing the whole organization might be too broad, but allowing a certain publisher certificate is a good balance. When the application is updated, rule will still work. But if the organization renews the certificate, you will need to update the rules.
* If the application is not signed and you can not use certificates, then use `file attributes`. Bear in mind that `hash` based rules are the worst, because if the application is updated, the hash will change, and the rule will no longer work. For applications that launch from protected paths, you can leverage the `path` rules, for instance for Windows apps that launch from protected directory.

## Catalog rules

Idemeum comes pre-configured with allowlisting and elevation rules for most common applications. We constantly update applications to make sure the rules are current and do not create any disruptions. With a click of a button you can allow most used applications in your environment.  Idemeum comes pre-configured with allowlisting and elevation rules for most common applications. We constantly update applications to make sure the rules are current and do not create any disruptions. With a click of a button you can allow most used applications in your environment.

<Card title="Catalog rules" icon="book-arrow-up" href="/allowlisting/application-catalog">
  Create elevation or allowlisting rules with a single click.
</Card>

## Create elevation rule

If you want to create your own custom rules or elevate applications that are not listed in idemeum catalog, you can simply do that from the event. Launch the application you want to elevate, the event will be generated and sent to the cloud. Now you can create rule from the event.

* Navigate to the admin portal of your idemeum tenant
* Access `Activity` → `Events` section
* Search for the application / event that you want to create a rule for
* Click on `...` and choose to create a rule
* All rule metadata will be populated and you can choose the attributes:
  * Define the rule by providing the rule name, OS it applies to, the scope of the rule (used for MSP tenants - `local` customer only, `global` - across customers). And optionally choose the devices this rule needs to apply to.
  * Match application by file attributes, certificate thumbprint, or certificate elements. Simply click the checkbox next to the attribute.
  * Define what you want to do with the rule - auto elevate or block.
  * Define the rule by providing the rule name, OS it applies to, the scope of the rule (used for MSP tenants - `local` customer only, `global` - across customers). And optionally choose the devices this rule needs to apply to.
  * Match application by file attributes, certificate thumbprint, or certificate elements. Simply click the checkbox next to the attribute.
  * Define what you want to do with the rule - auto elevate or block.
* Save the rule

<img alt="Clean Shot 2026 05 25 At 11 33 42@2x" />

## Elevation rules Regex

Idemeum rule engine supports regular expressions when matching the applications using various attributes. We support regex for `file name`, `file path`, and `certificate elements`. We use case-insensitive match.

* Match the exact file name for the edge browser

```regexp theme={null}
^msedge.exe$
```

* Match any filename that contains `video`

```regexp theme={null}
.*video.*
```

* Match the path that starts with `C:\Program Files\WindowsApps\` and then contains `linkedin` in the path

```regexp theme={null}
C:\Program Files\WindowsApps\.*linkedin.*
```

* Use this in `O `for certificate element to match anything that is signed by organization that contains `Microsoft`

```regexp theme={null}
Microsoft.*
```


# Enable EPM
Source: https://docs.idemeum.com/epm/enable-endpoint-privilege-management

Enable Endpoint Privilege Management (EPM) for your organization.

## Turn EPM on for your tenant

Before you can use Endpoint Privilege Management you need to enable it in the tenant settings.

* Login to your idemeum admin portal
* Access `Control settings` → `EPM`
* Enable the product with a toggle

<img alt="Clean Shot 2026 05 21 At 16 15 00@2x" />


# EPM control mode
Source: https://docs.idemeum.com/epm/epm-control-mode

Configure how control agent is enforcing elevation rules on your workstations.

## EPM control modes

Assuming the [EPM is enabled](/epm/enable-endpoint-privilege-management) for your tenant, you can change the `control mode` for each device to define how the control agent will handle elevations.

* <Badge>offline</Badge> - idemeum control agent is not doing anything
* <Badge>audit</Badge> - idemeum control agent collects events, but does not enforce rules
* <Badge>rules</Badge> - idemeum agent applies rules and performs auto elevation

The sections below show how Windows and macOS devices behave with idemeum control agent installed depending on certain parameters.

### Windows

| Mode | User type | Control agent | User experience |
| - | - | - | - |
| <Badge>offline</Badge> | admin | no actions | No experience change |
| <Badge>offline</Badge> | standard | no actions | No experience change |
| <Badge>audit</Badge> | admin | capture events | UAC set to always prompt<br />Native auth<br />Events captured in the cloud |
| <Badge>audit</Badge> | standard | capture events | UAC set to always prompt<br />Native auth<br />Events captured in the cloud |
| <Badge>rules</Badge> | admin | no actions | Native auth<br />No events in the cloud<br />No rules or auto elevations |
| <Badge>rules</Badge> | standard | enforce rules | Rules and auto elevations<br />Events captured in the cloud |

### macOS

| Mode | User type | Control agent | User experience |
| - | - | - | - |
| <Badge>offline</Badge> | admin | no actions | No experience change |
| <Badge>offline</Badge> | standard | no actions | No experience change |
| <Badge>audit</Badge> | admin | capture events | Native auth<br />Events captured in the cloud |
| <Badge>audit</Badge> | standard | capture events | Native auth<br />Events captured in the cloud |
| <Badge>rules</Badge> | admin | no actions | Native auth<br />No events in the cloud<br />No rules or auto elevations |
| <Badge>rules</Badge> | standard | enforce rules | Rules and auto elevations<br />Events captured in the cloud |

## Change EPM control mode

* Navigate to your idemeum admin portal
* Select `Devices` and search for the device you want to change the app control mode for
* Click on `...` then choose `Set app control mode`
* Choose the mode and save the configuration

<img alt="Clean Shot 2026 05 22 At 00 08 03@2x" />

## Bulk EPM control mode change

* Navigate to your idemeum admin portal
* Access `Devices` section and select multiple devices with checkboxes
* Click on the bulk change button at the top and choose `Set app control mode`
* Choose the mode and save the configuration


# Reason for elevation
Source: https://docs.idemeum.com/epm/reason-for-elevation

Users provide context on why they need to elevate an application.

## How reason for elevation works

When users request application elevation, they can provide several pieces of information with their request. One attribute is the reason for why the application elevation is requested. Using the simple text area users can provide the explanation why they need to elevate the application.

* The reason for elevation is currently available in the admin portal requests section, admin email elevation notifications, and when elevation ticket is created in the ticketing system. Today we do not show the reason in the mobile application elevation request.
* Providing the reason for elevation is not mandatory and can be submitted as a blank field.

<img alt="IMG 1369" />


# SUDO control for macOS
Source: https://docs.idemeum.com/epm/sudo-control-for-mac-os

Automatically elevate SUDO commands on macOS with Endpoint Privilege Management

## Overview

When you remove local admin rights on macOS, users will not be able to use sudo on macOS workstations. If you need to allow sudo for certain users, you can create rules to automatically elevate sudo commands.

<img alt="Clean Shot 2026 06 08 At 17 35 50@2x" />

When your users are downgraded to standard user accounts you need to create a sudo rule. Create the following rule for sudo:

* Create a rule for sudo with a descriptive name
* Choose `sudo` for filename
* Use certificate elements to check for `Apple Inc.` in the organization attribute
* Allow application to execute and elevate
* Assign the rule to certain devices you need

<Frame>
  <img alt="Clean Shot 2026 06 08 At 17 38 25@2x" />
</Frame>


# Technician mode
Source: https://docs.idemeum.com/epm/technician-mode

IT admins bypass rules to perform administrative work on the workstation.

## How technician mode works

<Card title="Technician mode demo" icon="video" href="https://youtu.be/01dWqBg8G8g?si=wYvdUTF2Faivmv5t">
  Watch the video to see how technician mode works
</Card>

Technician mode allows your IT staff to do administrative work on computers (Windows and MacOS) without being logged in with an admin account. There is no need to know admin credentials - simply launch the technician mode application and scan the QR-code to authenticate.

Once technician mode is initiated:

* All elevation block rules will be bypassed
* The default 10-minute timer will start after which the computer will revert back to user more with rule enforcement. The timer can be configured in the admin portal.
* Every elevation performed while in technician mode is performed as `admin` elevation with local admin account
* Technician mode session is captured in the audit logs

## How to launch technician mode

* When the the user is logged into the workstation and you need to enter the `Technician mode`, simply search for `Technician mode` application on Windows or MacOS.
* Then you will see the pop up with the idemeum QR-code. Scan this QR-code with idemeum mobile application and authenticate with biometrics.

<img alt="IMG 1367" />

* Once approved, the default 10-minute timer will start. You will be able to perform any privileged actions bypassing the elevation rules.
* To exit the `Technician mode` simply close the pop up windows or click on `Back to user mode`

<img alt="IMG 1368" />


# User elevation notifications
Source: https://docs.idemeum.com/epm/user-elevation-notifications

How users are notified when elevation requests are approved or denied.

## How user notifications work

When users request application elevations, and these requests are approved or denied by IT team, idemeum offers a feedback loop to notify users of the request outcome. There are several ways users get notified.

<AccordionGroup>
  <Accordion title="Push notifications" icon="laptop-arrow-down">
    When the elevation request is approved or denied, idemeum will send a push notification back to Windows or macOS agent. If notifications are enabled on the desktop, the user will see a pop up notification detailing the request and the outcome.

    <Note>
      We are leveraging [**APNS**](https://en.wikipedia.org/wiki/Apple_Push_Notification_service?ref=docs.idemeum.com) for macOS and [**FCM**](https://firebase.google.com/docs/cloud-messaging?ref=docs.idemeum.com) for Windows to deliver notifications. While these notifications can be real time, they are best effort and not guaranteed. If the device is offline when the push notification is sent, the notification will be lost.
    </Note>
  </Accordion>

  <Accordion title="Email notifications" icon="send-backward">
    When users request application elevations, they can provide certain pieces of information with the request, including email address. When the application elevation is approved or denied, the email with the result will be sent to user provided email address.

    <Info>
      Users need to provide the email only once. Once entered, it will saved and auto filled for any subsequent requests.
    </Info>
  </Accordion>
</AccordionGroup>

## Push notifications user experience

On Windows we send the notification back to device and display it at the bottom right of the screen.

<img alt="IMG 1372" />

On macOS we also display application notifications in a standard way. In addition to this, we offer the notification tray in the top bar menu. When you click on the idemeum icon, you will be able to see all your requests along with the requests status.

<img alt="IMG 1373" />

## Email notifications user experience

On Windows or macOS workstation users can provide the email address when requesting application elevation.

<img alt="IMG 1370" />

When application is approved or denied, the email is sent to the user to specified email address to inform about the request resolution.

<img alt="IMG 1371" />


# Guardrails
Source: https://docs.idemeum.com/guardrails

How every run is secured with guardrail architecture.



# Quickstart guides
Source: https://docs.idemeum.com/guides

Get started with idemeum by following our simple and quick product guides.

## Endpoint Control

These guides cover the major features of our [Endpoint Control](/endpoint-control-overview) product.

### Quickstart - JIT admin access

<Card title="Quickstart - JIT for computers" icon="book" href="/guides/quickstart-jit-for-computers">
  Set up passwordless on-demand access to servers and workstations.
</Card>

<Card title="Quickstart - JIT for Entra ID" icon="book" href="/guides/quickstart-jit-for-entra-id">
  Set up on-demand access to Microsoft Entra ID tenants.
</Card>

<Card title="Quickstart - Cloud LAPS" icon="book" href="/guides/quickstart-cloud-laps">
  Set up break-glass password rotation for computers and Entra tenants.
</Card>

### Quickstart - Endpoint Privilege Management

<Card title="Quickstart - Endpoint Privilege Management" icon="book" href="/guides/quickstart-endpoint-privilege-management">
  Set up elevation control on Windows and macOS.
</Card>

### Quickstart - Allowlisting

<Card title="Quickstart - Allowlisting" icon="book" href="/guides/quickstart-allowlisting">
  Set up application control on Windows and macOS.
</Card>


# Quickstart - Allowlisting
Source: https://docs.idemeum.com/guides/quickstart-allowlisting

Set up application control on Windows and macOS.

## What is allowlisting?

Instead of blocking everything that is bad in your environment, you explicitly allow what applications need to run on user workstations. In simple terms, you only allow applications that you trust, and block everything else, including malware and ransomware. When idemeum agent is installed, it intercepts every process execution event and applies `Default deny` policy - if application is not explicitly trusted, it is not allowed.

<Card title="Application allowlisting overview" icon="page" href="/allowlisting-overview">
  Full documentation section for allowlisting
</Card>

## Get started with allowlisting

In this guide we will install the agent and quickly try the application control enforcement.

<Steps>
  <Step title="Sign up for idemeum tenant">
    Sign up for free idemeum IT or MSP tenant on our website → [idemeum.com](https://idemeum.com)
  </Step>

  <Step title="(MSP) - Create child tenant">
    If you are an MSP, please create a child tenant / organization. 

    * Login to your MSP admin portal
    * Navigate to `Tenants` → click `Add tenant` and choose manually
    * Provide subdomain and display names and save the configuration

      <img alt="Clean Shot 2026 05 27 At 10 40 29@2x" />
  </Step>

  <Step title="Enable allowlisting for your tenant">
    * Navigate to your idemeum tenant admin portal
    * Click `Control settings` → `Allowlisting`
    * Make sure allowlisting is enabled for your tenant

      <img alt="Clean Shot 2026 05 27 At 12 38 31@2x" />
  </Step>

  <Step title="Configure baseline rules">
    We will now create baseline rules for most used applications on your workstation.

    * Access `Activity` → `Rules`
    * Click `Add rule` → `Catalog`
    * Check the rules that you need. 
    * We recommend allowing everything that is signed by Microsoft, Apple, and Google. 

      <img alt="Clean Shot 2026 05 27 At 12 41 28@2x" />
  </Step>

  <Step title="Grab installation command to deploy agents">
    <Warning>
      macOS agent deployment requires privacy and security permissions so it is recommended to deploy the agent with an MDM profile. 
    </Warning>

    Click on the `Install agent` → choose `Control agent` and copy the installation command for Windows or macOS. 

    <img alt="Clean Shot 2026 05 27 At 10 46 44@2x" />
  </Step>

  <Step title="Turn application control mode to rules">
    Once the agent is installed it will appear in the `Devices` table and the default mode for application control will be turned off. Click on `...` and turn the application control mode to `Rules`.

    <img alt="Clean Shot 2026 05 27 At 12 13 41@2x" />
  </Step>

  <Step title="Test application launch">
    * Launch any application that is not covered by any rules - application will be blocked
    * Launch any application what is covered by rules - it will be allowed

      <img alt="Clean Shot 2026 05 27 At 12 43 26@2x" />
  </Step>
</Steps>

<Tip>
  Allowlisting has many more features that we can cover in this guide. Please consult our [documentation](/allowlisting-overview) to learn about all features EPM has to offer.
</Tip>


# Quickstart - Cloud LAPS
Source: https://docs.idemeum.com/guides/quickstart-cloud-laps

Set up break-glass password rotation for computers and Entra tenants.

## What is LAPS for computers?

Cloud LAPS allows you to create break-glass / emergency accounts on all customer workstations (including domain controllers), automatically rotate passwords for these accounts every `24 hours`, and store the credentials in idemeum zero-knowledge cloud vault.

<Card title="Cloud LAPS overview" icon="page" href="/jit/cloud-laps-overview">
  Full documentation section for Cloud LAPS
</Card>

## Get started with Cloud LAPS

### LAPS for computers

In this section we will set up break-glass account rotation on workstations. We will need to enable LAPS and install idemeum control agent on workstations.

<Steps>
  <Step title="Sign up for idemeum tenant">
    Sign up for free idemeum IT or MSP tenant on our website → [idemeum.com](https://idemeum.com)
  </Step>

  <Step title="(MSP) - Create child tenant">
    If you are an MSP, please create a child tenant / organization. 

    * Login to your MSP admin portal
    * Navigate to `Tenants` → click `Add tenant` and choose manually
    * Provide subdomain and display names and save the configuration

      <img alt="Clean Shot 2026 05 27 At 10 40 29@2x" />
  </Step>

  <Step title="Configure LAPS settings">
    * In your tenant navigate to `Control settings` → `JIT access` and scroll down to the LAPS section
    * Enable LAPS (you can enable LAPS for workstations to rotate local admin accounts, and for domain controllers to rotate domain admin accounts)
    * Specify the account name to use (if account exists, it will be taken over for password rotation)

      <img alt="Clean Shot 2026 05 27 At 11 19 17@2x" />
  </Step>

  <Step title="Grab installation command to deploy agents">
    <Warning>
      macOS agent deployment requires privacy and security permissions so it is recommended to deploy the agent with an MDM profile. 
    </Warning>

    Click on the `Install agent` → choose `Control agent` and copy the installation command for Windows or macOS. 

    <img alt="Clean Shot 2026 05 27 At 10 46 44@2x" />
  </Step>

  <Step title="View LAPS credentials">
    Navigate to `Devices` table and search for the device agent that you installed, click on `...` and choose `View LAPS credentials`.

    <img alt="Clean Shot 2026 05 27 At 11 21 26@2x" />
  </Step>
</Steps>

### LAPS for Entra ID

In this section we will configure break-glass password rotation for Microsoft Entra ID tenants. We will need to connect Entra ID tenant to idemeum tenant to create accounts and rotate passwords.

<Steps>
  <Step title="Connect Entra ID to idemeum tenant">
    At this step you need to create an application in Entra ID tenant and set up idemeum to connect to M365 tenant using that application.

    Follow these [steps](/jit/jit-for-entra-configuration) to perform this configuration.
  </Step>

  <Step title="Make sure LAPS is enabled">
    At the bottom of the Entra ID application configuration make sure you have LAPS enabled and the account name specified.

    <img alt="Clean Shot 2026 05 27 At 11 51 54@2x" />
  </Step>

  <Step title="View Entra ID LAPS credentials">
    * Navigate to the customer / organization user portal
    * Search for Entra ID application and click on `...`
    * Choose `View LAPS credentials`

      <img alt="Clean Shot 2026 05 27 At 11 52 46@2x" />
  </Step>
</Steps>


# Quickstart - Endpoint Privilege Management
Source: https://docs.idemeum.com/guides/quickstart-endpoint-privilege-management

Set up elevation control on Windows and macOS.

## What is Endpoint Privilege Management?

Endpoint Privilege Management (EPM) is all about implementing least privilege security on your Windows and macOS workstations. It is a cloud solution that allows you to remove local admin rights on your workstations to protect your organization. A user without local admin rights can’t make changes to system folders, kill processes, remove security software, and more. This makes your organization more secure, but the weakness is that users still need admin rights from time to time to install, update, or use business software. With idemeum EPM you can apply rules to automatically elevate certain apps or system actions without giving users permanent admin permissions.

<Card title="Endpoint Privilege Management overview" icon="page" href="/endpoint-privilege-management-overview">
  Full documentation section for EPM.
</Card>

## Get started with EPM

In this guide we will install idemeum agent, enable EPM, and test the elevation approval flow.

<Steps>
  <Step title="Sign up for idemeum tenant">
    Sign up for free idemeum IT or MSP tenant on our website → [idemeum.com](https://idemeum.com)
  </Step>

  <Step title="(MSP) - Create child tenant">
    If you are an MSP, please create a child tenant / organization. 

    * Login to your MSP admin portal
    * Navigate to `Tenants` → click `Add tenant` and choose manually
    * Provide subdomain and display names and save the configuration

      <img alt="Clean Shot 2026 05 27 At 10 40 29@2x" />
  </Step>

  <Step title="Enable EPM for your tenant">
    * Navigate to your idemeum tenant admin portal
    * Click `Control settings` → `EPM`
    * Make sure EPM is enabled for your tenant

      <img alt="Clean Shot 2026 05 27 At 12 07 50@2x" />
  </Step>

  <Step title="Grab installation command to deploy agents">
    <Warning>
      macOS agent deployment requires privacy and security permissions so it is recommended to deploy the agent with an MDM profile. 
    </Warning>

    Click on the `Install agent` → choose `Control agent` and copy the installation command for Windows or macOS. 

    <img alt="Clean Shot 2026 05 27 At 10 46 44@2x" />
  </Step>

  <Step title="Turn elevation mode to rules">
    Once the agent is installed it will appear in the `Devices` table and the default mode for elevation will be turned off. Click on `...` and turn the elevation mode to `Rules`.

    <img alt="Clean Shot 2026 05 27 At 12 13 41@2x" />
  </Step>

  <Step title="Test request elevation flow">
    <Tip>
      Make sure you login to your workstation with a `standard` account to test elevation flow.
    </Tip>

    * Login to your workstation with a standard account

    * Launch some application the requires admin privileges

    * You will see the idemeum request window. When there are no rules present, the default behavior is to offer the request option to the user.

      <img alt="Clean Shot 2026 05 27 At 12 17 07@2x" />

    * In idemeum portal navigate to `Activity` → `Requests` and approve the elevation request

      <img alt="Clean Shot 2026 05 27 At 12 19 05@2x" />

    * You can now relaunch the application on your workstation, and it will be automatically elevated.
  </Step>

  <Step title="Create elevation rules">
    If you want to create rules to automatically elevate or deny applications, please follow the steps [here](https://docs.idemeum.com/epm/elevation-rules).
  </Step>
</Steps>

<Tip>
  Endpoint Privilege Management has many more features that we can cover in this guide. Please consult our [documentation](https://docs.idemeum.com/endpoint-privilege-management-overview) to learn about all features EPM has to offer.
</Tip>


# Quickstart - JIT for computers
Source: https://docs.idemeum.com/guides/quickstart-jit-for-computers

Set up passwordless on-demand access to servers and workstations.

## What is JIT for computers?

JIT for computers is all about eliminating shared credentials and standing privileges when accessing Windows, macOS workstations, and servers. Idemeum will automatically generate unique named admin accounts for your technicians, enable these accounts only for the duration of the session, and rotate passwords automatically after every login. Every login is protected with Passwordless MFA, and every session is tracked in the audit trail.

<Card title="JIT for computers overview" icon="page" href="/jit/jit-for-computers-overview">
  Full documentation section for JIT for computers.
</Card>

## Get started with JIT for computers

In this guide we will install idemeum agent on one workstation (macOS or Windows) and perform a passwordless login with a local admin account. If you want to set up more advanced flows and use cases, please browse through [JIT for computers](https://docs.idemeum.com/jit/jit-for-computers-overview) documentation.

<Steps>
  <Step title="Sign up for idemeum tenant">
    Sign up for free idemeum IT or MSP tenant on our website → [idemeum.com](https://idemeum.com)
  </Step>

  <Step title="(MSP) - Create child tenant">
    If you are an MSP, please create a child tenant / organization. 

    * Login to your MSP admin portal
    * Navigate to `Tenants` → click `Add tenant` and choose manually
    * Provide subdomain and display names and save the configuration

      <img alt="Clean Shot 2026 05 27 At 10 40 29@2x" />
  </Step>

  <Step title="(Optional) - Configure JIT settings">
    <Info>
      If you want to try default configuration with `local admin` accounts, then skip this step. 

      If you want to use JIT `domain accounts`you need to install idemeum agent on Domain Controllers as well as domain workstations. And you need to enable JIT login with domain accounts.
    </Info>

    * In case of MSP login to your child tenant admin portal
    * Access `Control settings` → `JIT access`
    * If you want to use `domain accounts` choose that option in the `domain login mode`
    * Make any other settings changes that you need

      <img alt="Clean Shot 2026 05 27 At 10 45 03@2x" />
  </Step>

  <Step title="Grab installation command to deploy agents">
    <Warning>
      macOS agent deployment requires privacy and security permissions so it is recommended to deploy the agent with an MDM profile. 
    </Warning>

    Click on the `Install agent` → choose `Control agent` and copy the installation command for Windows or macOS. 

    <img alt="Clean Shot 2026 05 27 At 10 46 44@2x" />
  </Step>

  <Step title="Perform test JIT login">
    Now you can log out from the workstation and perform passwordless JIT login by scanning a QR-code. Click on the QR-code at the bottom left of the screen, open your idemeum mobile application, choose `Login`, scan the code and approve with biometrics.

    <img alt="Clean Shot 2026 05 27 At 10 46 44@2x" />
  </Step>
</Steps>


# Quickstart - JIT for Entra ID
Source: https://docs.idemeum.com/guides/quickstart-jit-for-entra-id

Set up on-demand access to Microsoft Entra ID tenants.

## What is JIT for Entra ID?

When you have multiple Entra ID tenants your technicians need to access, you can leverage idemeum to automatically manage individual on-demand admin accounts. Technicians request admin accounts, login to do their business, and then after some time the accounts will be disabled and passwords rotated. You can request Entra JIT accounts from idemeum portal, or you can integrate our platform with your ticketing system, so that you request Entra JIT accounts right from customer support tickets.

<Card title="JIT for Entra overview" icon="page" href="/jit/jit-for-entra-overview">
  Full documentation section for JIT for Entra ID.
</Card>

## Get started with JIT for Entra ID

In this guide we will set up Entra ID connection with an idemeum tenant and will request just-in-time admin account.

<Steps>
  <Step title="Sign up for idemeum tenant">
    Sign up for free idemeum IT or MSP tenant on our website → [idemeum.com](https://idemeum.com)
  </Step>

  <Step title="(MSP) - Create child tenant">
    If you are an MSP, please create a child tenant / organization. 

    * Login to your MSP admin portal
    * Navigate to `Tenants` → click `Add tenant` and choose manually
    * Provide subdomain and display names and save the configuration

      <img alt="Clean Shot 2026 05 27 At 10 40 29@2x" />
  </Step>

  <Step title="Connect Entra ID to idemeum tenant">
    At this step you need to create an application in Entra ID tenant and set up idemeum to connect to M365 tenant using that application.

    Follow these [steps](https://docs.idemeum.com/jit/jit-for-entra-configuration) to perform this configuration.
  </Step>

  <Step title="Test Entra JIT login flow">
    * Navigate to the customer / organization admin portal
    * Search for Entra ID application and click on `...`
    * Now you can request JIT account and view provisioned credentials

      <img alt="Clean Shot 2026 05 27 At 11 03 46@2x" />
  </Step>
</Steps>


# Idemeum documentation
Source: https://docs.idemeum.com/index



## AI agents for IT

Resolve user tickets, automate IT flows, and operate your IT stack.

<Columns>
  <Column>
    <Card title="Assist" icon="hands-helping">
      Desktop AI agent that resolves end user IT requests.
    </Card>
  </Column>

  <Column>
    <Card title="Automate" icon="user-robot">
      Headless cloud AI agent that automates cloud IT workflows.
    </Card>
  </Column>
</Columns>

<Columns>
  <Column>
    <Card title="Operate" icon="truck-container">
      AI agent that investigates and acts across your entire IT stack.
    </Card>
  </Column>

  <Column />
</Columns>

## Endpoint Control

Manage applications, privileges, and admin access on your endpoints.

<Card title="Endpoint Control" icon="computer" href="/endpoint-control-overview">
  Govern apps, privileges, and admin accounts on your workstations
</Card>

## Resources

<Columns>
  <Column>
    <Card title="Quickstart" icon="rocket-launch" href="/guides" />
  </Column>

  <Column>
    <Card title="API" icon="code" href="https://api.idemeum.com" />
  </Column>
</Columns>

<Columns>
  <Column>
    <Card title="YouTube" icon="youtube" href="https://www.youtube.com/@idemeum" />
  </Column>

  <Column>
    <Card title="Integrations" icon="plug" href="/integrations" />
  </Column>
</Columns>

## Support

<Columns>
  <Column>
    <Card title="Discord" type="tip" icon="discord" href="https://link.idemeum.com/discord" />
  </Column>

  <Column>
    <Card title="Support" type="note" icon="headset" href="/support" />
  </Column>
</Columns>


# Installation
Source: https://docs.idemeum.com/installation

Install care agent for Windows and macOS.



# Integrations
Source: https://docs.idemeum.com/integrations

Explore idemeum integrations with other products.

<Columns>
  <Card title="Atera RMM" icon="plug" href="/integrations/atera-rmm">
    Control agent deployment with Atera
  </Card>

  <Card title="Syncro RMM" icon="plug" href="/integrations/syncro-rmm">
    Control agent deployment with Syncro
  </Card>
</Columns>

<Columns>
  <Card title="Immy bot" icon="plug" href="/integrations/immy-bot">
    Control agent deployment with Immy
  </Card>

  <Card title="Level RMM" icon="plug" href="/integrations/level-rmm">
    Control agent deployment with Level
  </Card>
</Columns>

<Columns>
  <Card title="SuperOps" icon="plug" href="/integrations/super-ops-rmm">
    Control agent deployment with SuperOps RMM
  </Card>

  <Card title="Connectwise PSA" icon="plug" href="/integrations/connect-wise-psa">
    Ticketing integration with ConnectWise PSA
  </Card>
</Columns>

<Columns>
  <Card title="Hudu" icon="plug" href="/integrations/hudu">
    Hudu LAPS integration for break-glass accounts
  </Card>

  <Card title="HaloPSA" icon="plug" href="/integrations/halo-psa">
    Halo PSA integration for various use cases
  </Card>
</Columns>

<Columns>
  <Card title="Microsoft Intune" icon="plug" href="/integrations/microsoft-intune">
    Deploy Windows and macOS agent with Intune
  </Card>

  <Card title="Ninja One" icon="plug" href="/integrations/ninja-one">
    Unified idemeum agent deployment with Ninja One RMM
  </Card>
</Columns>


# Atera RMM
Source: https://docs.idemeum.com/integrations/atera-rmm

Control agent deployment with Atera RMM.

In this guide we will take a look at how you can deploy control agent to Atera managed workstations with unified deployment script. We will create a script and leverage a placeholder variable, so that when the script is deployed, you can dynamically pass the customer name to idemeum script. This way the idemeum agent will be associated with the appropriate organization in idemeum, and if the organization does not exist, it will be automatically created.

## **Obtain unified install script**

* Navigate to the admin portal of your `Main MSP dashboard`
* Click on `Bulk install agent` then choose `Control agent`
* Choose the operating system and copy the unified install script command
* Save this command somewhere as we will need to use it in Atera

<img alt="Clean Shot 2026 05 25 At 17 33 29@2x" />

## **Create script in Atera**

* Access the Atera management dashboard
* Click on `New` at the top left and choose `Script`

<img alt="Atera2" />

* Specify the following parameters for the script
  * Provide script name and description
  * File type `ps1`
  * Max run minutes `10`
  * Run as `System`
* In the script editor window paste the idemeum command that you obtained in the previous section
* Scroll to the `-customerName` attribute and reference a dynamic variable using `""`. In this care we are using variable `{[customerName]}`.
* Create the script

<img alt="Atera3" />

## **Deploy Atera script**

* Access the workstation where you would like to deploy idemeum
* Click `Manage` and choose `Run script`

<img alt="Atera4" />

* Choose the idemeum script you created before and click `Run` next to it
* You will be prompted to enter the customer name. You can provide the organization name for which you are deploying idemeum agent. If the organization does not exist in idemeum, the customer tenant will be automatically created.
* Run the script for idemeum agent to be installed and configured

<img alt="Atera5" />


# ConnectWise PSA
Source: https://docs.idemeum.com/integrations/connect-wise-psa

Ticketing integration with ConnectWise PSA.

## **ConnectWise configuration**

In order to allow 3rd party applications (like idemeum) to make calls on behalf of a user we need to create a `Member API` and an `API key` in ConnectWise.

### **Create custom role for idemeum API**

We need to create a custom role that would allow all the operation that idemeum has to perform.

* In ConnectWise admin console navigate to: `System` → `Security Roles`
* Click the `+` sign to create a new security role and give a role a name (e.g: `Idemeum Role`)

<img alt="Cw1" />

* Then add the following permissions
  * **Companies**
    * Company Maintenance:  Inquire - All
    * Configurations: Inquire - All
  * **Service Desk**
    * Close Service Tickets:  Edit - All; Inquire - All
    * Resource Scheduling: Add - All; Edit - All; Inquire - All
    * Service Tickets: Add - My; Edit - All - Inquire - All
  * **System**
    * Member Maintenance:  Inquire - All
    * My Company:  Inquire - All
    * Table Setup: Add - All; Inquire - All
  * **Time and expense**
    * Time Entry:  Add - All; Edit - All; Inquire - All
    * Tim Entry Billable Option:  Add - All; Inquire - All

### **Add an API member**

* From the ConnectWise admin console navigate to: `System` → `Members` → `API Members`

<img alt="Cw2" />

* Click the `+` sign and add a new API member. In the example below I have named it: `nikpot-api`.
* For the Role ID select `Idemeum Role` that we created. Fill out the rest of the required fields and click Save icon.

<img alt="Cw3" />

### **Add API key**

* After you have added the API member you can select it from the list and select API Keys tab and click the + sign to add a new API key.

<img alt="Cw4" />

* In the example below I have named the key `nikpot-key`. Click Save.
* Make sure you save the `Private Key` somewhere safe as it is only displayed once when you create the API key. We will need both the `Public` and `Private` Keys to be configured in idemeum Admin portal.

<img alt="Cw6" />

## **Idemeum configuration**

* Login to your idemeum admin portal
* Navigate to `Integrations` section
* Click `Add integration` → `Outbound integration`

<img alt="Clean Shot 2026 05 26 At 14 05 18@2x" />

* From the list of connectors select `ConnectWise`.
* Fill out the following information for the ConnectWise configuration:
  * **API server URL** - needs to be one of the value from the list below

```text theme={null}
https://api-au.myconnectwise.net
https://api-eu.myconnectwise.net
https://api-na.myconnectwise.net
https://api-staging.connectwisedev.com
```

* **ConnectWise Company Name** - this is your company name in ConnectWise (the same one that you use to login to the Manage console for ConnectWise)
* **API public key** - the public key that you have created in ConnectWise
* **API private key** - the private key that you have created in ConnectWise
* You can also change the default values for ticket severity, ticket impact, board, closed status id, and time entry value.

<img alt="Clean Shot 2026 05 26 At 14 07 56@2x" />

* Once you have added all the information click Save. During saving we will check if the information provided is correct by trying to make a call to the URL provided using the API public/private key.
* If the test passes, then the ConnectWise configuration will be saved.

## **Link idemeum and ConnectWise tenants**

When elevation events are created for one of your idemeum customers we need to know in which of your ConnectWise company to create the ticket.

* When saving the ConnectWise configuration, idemeum triggers an asynchronous request to match each of your idemeum customer names with your companies in ConnectWise. We will match first by `Customer Display Name` then by `Customer name`.
* If your idemeum customers are different than your ConnectWise companies then you can manually link them in the Customers tab in idemeum admin portal.
* Navigate to `Tenants` section, you will see the `ConnectWise` column where you can link the customers

## **Managing elevation requests**

In the example below we will show how a user requests access to the Microsoft Edge browse as an admin. As the elevation request is created in idemeum, a ticket is also created in ConnectWise.

* User tries to launch Edge browser on a Windows desktop with admin privileges.
* Since this requires admin privileges on the computer the user is asked if a request for approval to be sent to the system administrator.
* Upon clicking yes, an elevation request will be send to the system administrator.
* If we go to ConnectWise console for this Company we can see that a ticket was created in New state:

<img alt="Cw12" />

* If we drill down into the ticket we can see more information about the ticket severity/impact. The summary of the ticket will contain the user that requested the elevation, on what device and which application

<img alt="Cw13" />

* We can also see a description with more information about the elevation request. You can see that the user that created the description is `nikpot-api` (this is the name of the API member that we configured in the first step in ConnectWise).

<img alt="Cw14" />

* There are also 2 links in the description that the user in ConnectWise can use to approve / deny the elevation request in either MSP tenant or customer tenant in idemeum.
* In case we find the device in one of the configurations in the ConnectWise company, we will also associated that configuration with the ticket created. When looking for the configuration we will search the configuration name or the tagNumber attributes.
* When clicking on the link to approve in the MSP tenant a new window will be opened and the user will be taken to that specific elevation request in idemeum so an approve/deny action can be taken.
* In this example we will Deny the elevation request just for this user. If we go back to the ticket in ConnectWise we will see that the ticket is in closed state and that a new resolution note was added on what action was taken for this elevation request.

<img alt="Cw16" />


# HaloPSA
Source: https://docs.idemeum.com/integrations/halo-psa

Integrate idemeum with HaloPSA to create tickets for elevation requests, requests JIT accounts, and more.

## **Integration use cases with Halo PSA**

There are several integrations that we support with HaloPSA today:

1. Create tickets for elevation requests
2. Approve elevation requests from tickets
3. Request JIT accounts from tickets
4. Disable JIT accounts from HaloPSA

## **Create tickets for elevation requests**

With this integration when users request elevations, the ticket will be automatically created in HaloPSA. When the elevation is approved (let's say with mobile device), the ticket will be automatically closed. Inside the ticket there will be a link to navigate to idemeum and approve the request. If you want to approve the elevation request with a button click, please also read through the next section.

<Card title="Create tickets in Halo PSA for elevation requests" icon="youtube" href="https://www.youtube.com/watch?v=B-A6k9fcDS8">
  Demo of how tickets integration works with Halo PSA
</Card>

### **Create custom fields in Halo**

These fields are used to associate the request ID as well as the idemeum customer name in the ticket. These fields are mandatory if you want to use the approval from tickets with custom integration.

* We need to create two custom fields - `CFidemeumCustomerName` and `CFidemeumElevationRequestId`
* Navigate to `Configuration` → `Custom objects` → `Custom fields`
* Click `New`

<img alt="Halo1" />

* For `Field Name` use `idemeumCustomerName`
* For `Field Label` use `idemeum_customer_name`

<img alt="Halo2" />

* Keep the rest as defaults and save the configuration
* Repeat the same steps for creating the second field `idemeumElevationRequestId`

<img alt="Halo3" />

### **Configure HaloPSA agent**

In this step we will create an API-only agent to use with HaloPSA application.

* Navigate to `Configuration` → `Teams and agents` → `Agents` and add a new agent by clicking `New` button

<img alt="Halo4" />

* Provide the agent username
* Make sure you check the box for `Is an API-only Agent`

<img alt="Halo5" />

* Assign agent to the `Default team` of your choice and add the working hours
* `Save` the configuration

Now we will need to configure the proper permissions:

* Click `Edit` to configure the agent
* Navigate to `Departments and teams` tab
* If you are using teams, make sure the team you have chosen has the following permissions:
  * Can be assigned to
  * Can see unassigned tickets for this Team
  * Can see Tickets assigned to other Agents in this Team

<img alt="Halo6" />

* If you are using departments, make sure the permission `Modify all` is added
* Now click on `Permissions` tab and do the following:
  * For `Feature access` choose the following:
    * Tickets Access Level to Read and Modify
    * Clients Access Level to Read Only
    * Users Access Level to Read Only
    * Assets Access Level to Read Only

<img alt="Halo7" />

* For `Ticket permission` choose the following:
  * Can add new Tickets
  * Can edit closed Tickets
  * Can view Unassigned Tickets
  * Can view Tickets that are assigned to other Agents
  * Can Re-assign Tickets
  * Can Edit Tickets Which Are Not Assigned To Them
  * Can always update Ticket Statuses and re-assign Tickets outside of actions
* For `Asset type restrictions` choose the following:
  * Allow use of all Asset Types

<img alt="Halo8" />

* Save the agent configuration

### **Configure HaloPSA application**

The way HaloPSA allows other systems to make calls into their system is by creating an application.

* Navigate to HaloPSA admin portal
* Access `Configurations` → `Integrations` → `HaloPSA API` and click `View applications`

<img alt="Halo9" />

* Now click `New` to create a new application
* Provide application name
* Choose `Client ID and Secret` for Authentication method. Save the `Client ID` and `Client Secret` as you will need this information for idemeum configuration.
* For the agent drop down choose the agent that we created in the previous step

<img alt="Halo10" />

* Click on the `Permissions` tab and add the following permissions:
  * read:tickets
  * edit:tickets
  * read:customers
  * read:assets
* `Save` the configuration

<img alt="Halo11" />

### **Configure idemeum connector**

* Access your parent tenant admin portal
* Navigate to `Integrations`
* Click `Add integration` and then choose `Outbound integration`
* Choose `Halo PSA` from the connector dropdown
* Now enter the URL of your HaloPSA instance and provide the `Client ID` and `Client secret` that we created in the previous step
* You can also set the values for category, urgency, and ticket type id

<img alt="Clean Shot 2026 05 26 At 14 16 34@2x" />

* `Save` the configuration

### **Customers mapping**

Once the integration with HaloPSA is added, you will see the new `HaloPSA` column in the `Tenants` section.

**Automatic mapping**

As a first step idemeum will try to `automatically` map the customers in idemeum to tenants in HaloPSA. Here is how we will try to do that:

1. Use the `Display Name` of the customer in idemeum to search for a customer in HaloPSA
2. If no match was found using the `Display Name`, then we would use the `Name` of the customer in idemeum to search for a customer in HaloPSA
3. If no match was found using the `Name`, then the admin will have to manually link the customers

**Manual mapping**

The admin can manually link a tenant from idemeum with one in HaloPSA by providing the name of the customer from HaloPSA.

* Navigate to idemeum admin portal and access `Tenants` section
* Search for the customer name
* Click on the `Link` button
* Enter the HaloPSA customer name to map this idemeum customer to
* Once found we will display the customer name from HaloPSA in the PSA column.

<Note>
  The name matching will be using case-insensitive equality.
</Note>

### **Ticket creation**

Here is how idemeum will create the tickets in HaloPSA:

* Idemeum will create a ticket of type `Incident`
* We will use these default values for the ticket:
  1. `category` - **Business Applications**
  2. `urgency` - **Medium**
  3. `impact` - **Single User Affected**
* In the ticket there will be information about the user that requested access to which application from which device.

<img alt="H1" />

* idemeum knows from which desktop name the elevation was initiated from so will lookup that name in your assets list. If found then we will associate that asset with the HaloPSA ticket.

<img alt="H2" />

* There is also a link to navigate to idemeum portal and respond to the request
* Once the ticket is approved or denied the HaloPSA ticket will be updated with the status `Closed`. If we can find an agent in HaloPSA with the email address of the idemeum user that approved/denied the elevation request then we will assign that agent to the ticket. 

<img alt="H4" />

* When a ticket is closed we will add some information on how the ticket was closed in the closure notes: who closed it, was the elevation approved or not, for this user or at a tenant level, etc.
* We will also add a closure time of 5 mins. If you want to use other value rather than 5 mins contact idemeum support.

<img alt="H6" />

## **Approve elevation requests from tickets**

By default there is a link in the ticket details that allows you to approve the elevation request. The new tab will open and you will be redirected to idemeum to approve the request. You can simplify this process by configuring an API-based integration to approve / deny the elevation request with a single click.

<Warning>
  Make sure you first create the two custom fields as described in the previous section - `CFidemeumCustomerName` and `CFidemeumElevationRequestId`
</Warning>

### **Create custom integration in HaloPSA**

* Navigate to `Configurations` → `Custom integrations`

<img alt="M1" />

* Click `New`
* Provide the integration name `Idemeum API integration`
* For base resource URL enter the URL of your parent tenant. i.e. `https://nikmsp.idemeum.com`
* For `Authorization` choose `API key`
  * For `Key` enter `X-Idemeum-Api-Key`
  * For value obtain the API key from idemeum (navigate to `Global Settings` → `Integrations` and view the API key there)
* Add the API key to `header`

<img alt="M2" />

* Save the configuration

### **Create custom methods in Halo PSA**

* Navigate to `Configurations` → `Custom integrations` → `Custom methods`
* Click `New` to add the custom `approve` method
  * Provide the method name `idemeum - approve elevation request`
  * For integration dropdown choose `Idemeum API integration`
  * For method choose `POST`
  * For method URL add `/api/integrations/elevation/request/approve`

<img alt="M5" />

* For `Authorization` choose `Inherit from integration settings`
* Add the following to `Headers`
  * Key `Content-Type`
  * Value `application/vnd.dvmi.sdk.elevation.request.approval+json`

<img alt="M6" />

* Add the following to JSON `Body`. Here we will use the custom variables that we created before.

```json theme={null}
{
    "idemeumElevationRequestId": <<CFidemeumElevationRequestId>>,
    "idemeumCustomerName": <<CFidemeumCustomerName>>,
    "userElevationMode": "USER"
}
```

<img alt="M8" />

* Save the `approve` method
* Now we will create the `deny` method
  * Click `New` to create second method
  * Provide the method name `idemeum - deny elevation request`
  * For integration dropdown choose `Idemeum API integration`
  * For method choose `POST`
  * For method URL add `/api/integrations/elevation/request/deny`

<img alt="P1" />

* For `Authorization` choose `Inherit from integration settings`
* Add the following to `Headers`
  * Key `Content-Type`
  * Value `application/vnd.dvmi.sdk.elevation.request.approval+json`

<img alt="P2" />

* Add the following to JSON `Body`. Here we will use the custom variables that we created before.

```json theme={null}
{
    "idemeumElevationRequestId": <<CFidemeumElevationRequestId>>,
    "idemeumCustomerName": <<CFidemeumCustomerName>>
}
```

<img alt="P3" />

* Save the `deny` method

### **Create ticket actions in HaloPSA**

Now we will create two custom ticket actions that will call these `approve` and `deny` methods.

* Navigate to `Configuration` → `Tickets` → `Actions`
* Create `New` to create the first method
  * Provide the name `Idemeum - approve elevation request`
  * Choose the sequence you desire
  * Assign the icon, color and button name
  * Action type is `Generic action`

<img alt="T1" />

* For `System use` choose `Execute an Integration Method`
* For method choose the idemeum `approve` method that we created
* Check `Allow users to use this action`
* Choose `Is a quick action`
* Choose the status to `Closed` after the action is executed

<img alt="T2" />

* Save the configuration
* Now we will create the second `Deny` action.
  * Provide the name `Idemeum - deny elevation request`
  * Choose the sequence you desire
  * Assign the icon, color and button name
  * Action type is `Generic action`

<img alt="T3" />

* For `System use` choose `Execute an Integration Method`
* For method choose the idemeum `approve` method that we created
* Check `Allow users to use this action`
* Choose `Is a quick action`
* Choose the status to `Closed` after the action is executed

<img alt="T4" />

* Save the configuration

### **Assign these methods to your workflow**

This will depend on your HaloPSA configuration and what workflow you are using. We are using a standard incident workflow for our demo.

* Access `Configuration` → `Tickets` → `Workflows`
* Choose the workflow where you will enable these actions
* Edit the workflow and make sure methods are assigned to it

<img alt="L1" />

Now these methods will start showing up on your elevation request tickets and you can approve / deny requests with a single button click.

<img alt="L3" />

## **Request JIT accounts from tickets**

MSP technicians can request Entra ID JIT accounts right from HaloPSA tickets. HaloPSA and idemeum integration leverages embedded [**<u>iFrame</u>**](https://en.wikipedia.org/wiki/HTML_element?ref=docs.idemeum.com#Frames) sections.

<Info>
  By default idemeum security does not allow cross-domain requests. Therefore, to enable this integration, request idemeum team to allow embedded iFrames for your idemeum tenant.
</Info>

<Card title="Halo PSA and JIT Entra integration" icon="video" href="https://www.youtube.com/watch?v=4BeWwMPesvM">
  Request Entra JIT accounts right from your Halo PSA tickets.
</Card>

### **Configure session length**

This step is optional, but will improve technician experience when accessing just-in-time accounts. By default the idemeum session length is set to `8 hours`, meaning you have to re-authenticate with mobile every 8 hours. You can extend this session to `30 days` so that you can seamlessly access JIT accounts for any customer tenant right from HaloPSA and you will stay authenticated for 30 days.

* Navigate to your MSP tenant admin portal
* Access `Settings` → `Global` and then define the `Session expiration` duration

### **Configure HaloPSA**

In HaloPSA you can create a `Custom tab` that will point to your idemeum tenant. When managing PSA ticket you can click on that tab and get immediate access to your idemeum portal.

You have 2 options for navigation:

* **Navigate to parent MSP idemeum tenant** - you can simply specify the URL for your MSP tenant, i.e. `<msp name>.idemeum.com`. In this case technicians will access custom tab, MSP idemeum tenant will be loaded, then technician will search for customer tenant, access it, and will request JIT account.
* **Navigate directly to idemeum customer tenant** - you can leverage HaloPSA variables to navigate directly to customer idemeum tenant.

To support the second option you need to set up variables.

* Say we have an idemeum tenant with the display name `Demo PAM tenant` and the URL `demo-nikpot.idemeum.com`.
  * We can route based on `Demo PAM tenant` with the following URL `https://<tenant name>.idemeum.com?customerDisplayName=<value>`
  * Or we can router based on `demo` URL with the following `https://<tenant name>.idemeum.com?customerName=<value>`
  * In this guide we will use display name
* In HaloPSA we will use default variable `Client reference` and assign the value `Demo PAM tenant` to this variable

<img alt="V1" />

* We populate this variable with `Demo PAM tenant` value in the customer section by simply editing a customer in HaloPSA

<img alt="V4" />

* We can tag all our customers in the same way in HaloPSA so they are mapped to a customer tenant in idemeum with the display name that is used.

Now we will set up a custom tab.

* Navigate to `Configuration` → `Custom objects` → `Custom tabs` in HaloPSA
* Create a custom tab like in the image below. As you can see for URL we are using the URL of MSP idemeum tenant, and we are passing a parameter from the variable `$CLIENT_REFERENCE`. You can specify the variable that you have chosen for integration.

<img alt="V5" />

### **Test integration**

* Open any ticket in Halo PSA
* Click on `idemeum` tab
* You will be presented with the idemeum user portal for that customer. You can see all workstation and Entra apps to request JIT accounts and view credentials

<img alt="V6" />

## **Disable JIT accounts from HaloPSA**

### **Overview**

Technicians can request Entra ID JIT accounts right from HaloPSA with our existing iFrame integration.

However, requested JIT accounts will be disabled after a certain period of time, by default it is `4 hours`. If you want to immediately disable these requested JIT accounts, you can leverage idemeum APIs.

### **Obtain API key**

* Access your MSP portal admin dashboard
* Navigate to`Integrations` and make sure the API key is present
* Copy the API key
  <img alt="Clean Shot 2026 05 26 At 14 19 04@2x" />

### **Configure HaloPSA**

* In HaloPSA navigate to `Configuration` → `Integrations` → `Custom integrations`
* Click `New`

<img alt="O2" />

* Create an integration and provide the following details:
  * Base resource: `https://<yout_tenant>.idemeum.com/api/integrations`
  * Authorization: `API key`
  * Key: `X-Idemeum-Api-Key`
  * Value: `<SDK_API_KEY that you obtained in the idemeum admin portal>`
  * Add to: `Header`

<img alt="O3" />

* Save the configuration
* Now in the same tab click on `Methods` to create an HTTP POST method
* Configure the following:
  * Provide method name
  * HTTP method → `POST`
  * Path → `/entrajitaccounts`
  * Headers:
    * `Content-Type: application/vnd.dvmi.entra.app.user.disable+json`
  * Body provided below

```json theme={null}
{
    "customerDisplayName" : "<your_customer_display_name>",
    "technicianEmailAddress" : "<user's email address>"
}
```

As an example here is what we used:

```json theme={null}
{
    "customerDisplayName" : "Demo PAM tenant",
    "technicianEmailAddress" : "nik@nikpot.com"
}
```

<img alt="O5" />

* Once you `Save` the configuration you can test the API call for this integration. You should see the success response.
* Now you can navigate to `Integrations` → `Custom integrations` → `Integration runbooks` and create a run-book to call idemeum API when the ticket is closed.


# Hudu
Source: https://docs.idemeum.com/integrations/hudu

Hudu LAPS integration for break-glass account management.

You can connect your idemeum tenant to Hudu documentation platform and push all LAPS credentials there. Here is what is supported:

* Push computer LAPS credentials to Hudu
* Push Entra ID LAPS credentials to Hudu
* Automatically map customer names in idemeum to customer names in Hudu
* Manually map customer names in idemeum to customer names in Hudu

<Card title="Push LAPS credentials to Hudu" icon="youtube" href="https://www.youtube.com/watch?v=jK5S-rxztm8">
  Push LAPS break-glass credentials for all computers and Entra ID tenants to Hudu documentation platform.
</Card>

## **Create Hudu API key**

* Navigate to `Admin` → `API keys` and choose `+ New API key`

<img alt="Hudu1" />

* Provide the key name and allow access permissions

<img alt="Hudu2" />

* Copy the key as you will need to use it for idemeum configuration

## **Configure idemeum**

* Access your idemeum tenant admin portal and navigate to `Integrations`
* Choose `Add new integration` and then `Outbound integration`
* From the dropdown choose `Hudu`
* Add your Hudu URL and the API key that we generated in the previous step
* Save the configuration

<img alt="Clean Shot 2026 05 26 At 14 12 53@2x" />

## **Customers mapping**

Once the integration with Hudu is added, you will see the new `Hudu` column in the `Tenants` section.

### **Automatic mapping**

As a first step idemeum will try to `automatically` map the customers in idemeum to customers in Hudu. Here is how we will try to do that:

1. Use the `Display Name` of the customer in idemeum to search for a customer in Hudu
2. If no match was found using the `Display Name`, then we would use the `Name` of the customer in idemeum to search for a customer in Hudu
3. If no match was found using the `Name`, then the admin will have to manually link the customers

For example, in the image below, one of my customers was automatically mapped, however, others still show the `Link` button to manually map the customer in Hudu.

### **Manual mapping**

The admin can manually link a customer from idemeum with one in Hudu by providing the name of the customer from Hudu.

* Enter the Hudu customer name to map this idemeum customer to
* Once found we will display the customer name from Hudu in the idemeum customer table

## **LAPS credentials**

<Warning>
  It can take up to 24 hours for LAPS password to start showing up in Hudu. Next time desktops or Entra ID tenants will be rotating LAPS credentials (happens every 24 hours) these credentials will be pushed to Hudu.
</Warning>

* Navigate to any company in Hudu and access `Passwords`.
* You will now be able to see all LAPS credentials

<img alt="Hudu7" />


# Immy bot
Source: https://docs.idemeum.com/integrations/immy-bot

Control agent deployment with Immy bot.

With Immy there are two integration types that we support:

* `Manual` - with this integration you can simply grab the idemeum unified deployment script, create a deployment package, and push to your customers in Immy. With this integration there is no need to create customer tenants in idemeum, as they will be created automatically leveraging the `$TenantName` variable in Immy.
* `Catalog` - with this integration you can leverage integration catalog in Immy in select pre-configured idemeum integration. With this integration you will need to create customers in idemeum before hand, so that they can be mapped in Immy.

## Manual integration

With this integration idemeum customer tenants will be auto created - grab the unified install command in idemeum, create deployment in Immy, and deploy.

### **Obtain unified install script**

* Navigate to the admin portal of your `Main MSP dashboard`
* Click on the `Bulk install agent` and then choose `Control agent`
* Copy and save the unified command for Windows

<img alt="Clean Shot 2026 05 25 At 17 35 18@2x" />

### **Create software package in Immy**

* Access your [Immy.bot](http://Immy.bot) management dashboard
* Navigate to `Library` → `Software` and click `New`

<img alt="Immy2" />

* For Installer Type choose `None` and click `Next`

<img alt="Immy3" />

* Choose `Add version to new software`
* Provide the name of the software
* Upload the icon

<img alt="Immy4" />

* For licensing choose `None`
* For `Version detection` choose `Custom Detection Script` and add the following script below
  * For script type use `Software detection`
  * Language is `Powershell`
  * Execution context `System`

```powershell theme={null}
# Step 1: retrive the registry key to identify that idemeum is installed
$key = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, [Microsoft.Win32.RegistryView]::Registry64)
$installed =  $key.OpenSubKey("SOFTWARE\Idemeum Inc\Idemeum Desktop Client")

#Step 2: if the agent is installed, retrive the version that is installed
if($installed) {
    $key = [Microsoft.Win32.RegistryKey]::OpenBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, [Microsoft.Win32.RegistryView]::Registry64)
    $subKey =  $key.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71216D26-573B-402B-A3F5-A7CB9F950CFF}")
    $installedVersion = $subKey.GetValue("DisplayVersion")
    Write-Host "Idemeum desktop agent is installed"
	return $installedVersion
    exit 0
} else {
    Write-Host "Idemeum desktop agent is not installed"
	exit -1
}
```

<img alt="Immy6" />

* For installation we will use the command that you obtained in the previous section. Click `New` in the installation section to create new installation script.
* For script type choose `Software version action`, language is `Powershell` and execution context is `System`.
* Paste the command that you obtained from idemeum in the script editor window
* Scroll to `-customerName` variable and enter `$TenantName` inside `""`. This way we will automatically pass the organization name to idemeum script.

<img alt="Immy7" />

* Save the installation script and return to the previous menu

<img alt="Immy8" />

* For `Uninstallation` section create new script and enter the script as below
  * Type is `Software version action`, execution context is `System` and language is `PowerShell`

```powershell theme={null}
Start-Process -FilePath "msiexec.exe" -ArgumentList "/x {93B9CC98-6004-411E-A8BF-88F7C3BC5541} /qn /norestart" -Wait
Start-Process -FilePath "msiexec.exe" -ArgumentList "/x {71216D26-573B-402B-A3F5-A7CB9F950CFF} /qn /norestart" -Wait
```

* For `Upgrade strategy` choose `Install over` as our installation script will handle all necessary actions. What is more idemeum offers the feature to automatically update agents when the new version is released. This feature is automatically enabled for your MSP tenant.

<img alt="Immy10" />

* Expand the `Advanced settings` and enable `Use dynamic versions`
* Add the new script for version detection
  * Type is `Dynamic versions`
  * Language is `PowerShell`
* Paste the following script for version detection

```powershell theme={null}
# Step 1: Identify latest Windows version from API response
$apiUrl = "https://dvmi.idemeum.com/api/system/info"
$response = Invoke-RestMethod -Uri $apiUrl -Method Get -ErrorAction Stop 
$desktopAppVersion = ($response.clientApplicationVersions | Where-Object { $_.applicationName -eq "DESKTOP_LOGIN_APP_WINDOWS" }).version

# Step 2: Construct the link for latest MSI installer download
$fileUrl = "https://asset.idemeum.com/desktoplogin/Idemeum_Desktop_Client_Main_v${desktopAppVersion}.msi"

# Step 3: Get dynamic version from installer
Get-DynamicVersionFromInstallerURL $fileUrl
```

* Save the dynamic version detection script

<img alt="Immy11" />

* Now click `Next` and finish creating of idemeum software

### **Deploy software**

<Note>
  With this integration there is no need to create idemeum tenants manually. Simply deploy the agent in Immy and the idemeum customer tenant will be automatically created.
</Note>

Now you can create a deployment in [Immy.bot](http://Immy.bot) and idemeum agent will be installed and the software versions will be tracked and updated.

<img alt="Immy21" />

<img alt="Immy13" />

## **Catalog integration**

### **Create idemeum customer tenants**

<Warning>
  With this integration you first need to create idemeum customer tenants. There are various ways you can do this: manually, with CSV upload, or using idemeum API.
</Warning>

### **Enable idemeum integration in Immy**

* Access Immy admin dashboard
* Navigate to `Show more` → `Integrations` → `Add integration` and add Idemeum integration

<img alt="Immy20" />

* In the settings type your idemeum MSP tenant URL (i.e. `nikmsp.idemeum.com`)
* For the `ClientSecret` you need to paste the idemeum API key
  * Access idemeum admin portal
  * Go to `Global settings` → `Integrations`
  * If `Inbound` integration is already enabled, click on `...` and copy the API key
  * If `Inbound` integration is not enabled, simply create one by clicking on `Add integrations`
* Click `Update` to apply the changes to integration in Immy

### **Map customer tenants**

* In the Idemeum Immy integration click on `Clients` tab
* You can now map the customers in idemeum to customers in Immy

<img alt="Immy21" />

* Customer list on the left comes from idemeum, then you need to click on the `Link` next to the customer you want to map, and then choose the customer in Immy

### **Deploy idemeum in Immy**

* Now you can start deploying idemeum agents to Immy managed endpoints
* Create a deployment, choose `Idemeum Global Software` and apply for the customer that was mapped with idemeum customer

<img alt="Immy22" />

* Once the agents are deployed each machine will have the idemeum logo attached to it


# Level RMM
Source: https://docs.idemeum.com/integrations/level-rmm

Control agent deployment with Level RMM.

In this guide we will deploy idemeum control agent with Level RMM. We will take a unified script that takes `customer name` as an input variable. And when deploying to a workstation or a set of workstations in Level, we will be prompted to enter the customer name. If the customer organization does not exist in idemeum, it will be automatically created.

## **Obtain unified install script**

* Navigate to the admin portal of your `Main MSP dashboard`
* Click on the `Bulk install agent` then choose `Control agent`
* Choose the operating system and copy the unified install script command
* Save this command somewhere as we will need to use it in Level

<img alt="Clean Shot 2026 05 25 At 17 42 59@2x" />

## **Create installation script**

There are several ways you can deploy scripts in Level - you can use automations, you can define custom variables and take them as an input, etc. We will simply create a script with an input variable, and when this script is deployed, we will be prompted to provide the customer name that needs to be used in idemeum.

* Access your Level dashboard
* Navigate to `Automations` → `Scripts` → `Create script`

<img alt="Level2" />

* Enter the name for your script
* First we will create an input variable. Click on the `Variables` submenu and then `Add new variable`

<img alt="Level3" />

* Provide the variable name and keep the default value empty

<img alt="Level5" />

* Add variable
* Now go back to the script configuration submenu `Details`
* Paste the unified installation command that you obtained in the previous step
* Choose `Powershell` for Windows and run script as `Local system`
* Scroll down to the `-customerName` attribute and reference the input variable in `""` quotes. To reference the variable we created you can click on the variables button at the bottom right.

<Warning>
  Make sure the variable is passed in double quotes.
</Warning>

<img alt="Level6" />

* Save the configuration

## **Deploy script**

You can deploy script to workstations manually, or deploy to all workstations with a certain tag. Here we will deploy to one workstation for demonstration purposes.

* Navigate to the workstation that you need to deploy idemeum to
* Click on `...` and choose `Run saved script`
* Choose idemeum deployment script
* Now you can input the customer name that you want to associate idemeum agent with. If customer does not exist in idemeum, it will be automatically created.

<img alt="Level11" />


# Microsoft Intune
Source: https://docs.idemeum.com/integrations/microsoft-intune

Deploy idemeum desktop agent to a fleet of Windows or macOS workstations with Microsoft Intune.

## Instal Windows agent with Intune

* Navigate to your idemeum tenant and access admin portal
* Click `Install new agent`
* Copy the command for Windows and save it on your desktop as `ps1` file
* Access your Intune admin dashboard
* Navigate to `Devices` → `Windows` → `Scripts` → `Platform scripts` and then click `Add`
* Give script a name
* Upload the installation script file that you created
* Configure the settings as shown below

<img alt="I1" />

* For assignments add the workstations or groups to which you would like to deploy idemeum client

<img alt="I2" />

* Save the script configuration

Once complete you can manually trigger the deployment by navigating to `Devices`, choosing the workstation, and then triggering manual sync by clicking on `Sync` button. Or you can wait until the Intune agent will pick up the configuration and perform an installation within an hour.

## Instal macOS agent with Intune

### Obtain macOS profile and install script

* Navigate to your idemeum tenant and access admin portal
* Click `Install new agent`
* Copy the command for macOS and save it as `.sh` file
* Also download the macOS deployment MDM profile

<Tip>
  For macOS pelase also download the MDM deployment profile. This profile will be used to silently enable all required permission on macOS workstations.
</Tip>

### Deploy macOS idemeum profile

* In Intune admin dashboard navigate to `Devices` → `macOS` → `Configuration`
* Click `Create` → `New policy`
* Select `Templates` for `Profile type`
* Then choose `Custom`

<img alt="B1" />

* Give profile a name
* Provide the name that will be displayed to users
* Choose `Device channel` and upload the profile that you downloaded in the steps above

<img alt="B2" />

* Choose the groups of devices or users that you want to deploy this profile to
* Deploy the profile to target macOS workstations

### Deploy macOS idemeum agent

* In Intune navigate to `Devices` → `MacOS` → `Scripts`
* Create a new script and give it a name
* Upload the script that you created before
* For the `Run script as signed-in user` choose `No` to make sure script runs as `root`

<img alt="K1" />

* Click next and choose the devices where you need to install idemeum
* Review the configuration and save the script
* Now idemeum client will be installed to a list of target devices


# Ninja One
Source: https://docs.idemeum.com/integrations/ninja-one

Control agent deployment with NinjaOne RMM.

In this guide we will take a look at how you can simply deploy idemeum agent to all your Ninja managed workstations with a unified deployment script. We will take one command and leverage Ninja variable `$env:NINJA_ORGANIZATION_NAME` to automatically pass the customer name to idemeum script. If customer does not exist in idemeum, it will be automatically created and the agent will be associated with that customer.

## **Obtain idemeum install script**

* Navigate to the admin portal your idemeum tenant
* Click on the `Bulk install agent` and then `Control agent`
* Choose the operating system and copy the unified install script command
* Save this command somewhere as we will need to use it in Ninja

## **Create installation script in Ninja**

* Access your Ninja management dashboard
* Navigate to `Administration` → `Library` → `Automation`
* Click `Add` and then choose `New script`

<img alt="Ninja1" />

* Provide the script name to use
* Choose `Powershell` for Windows installation
* For operating system choose `Windows`
* Architecture `All` and run as `System`
* Paste the installation command that you obtained in the previous step into the script editor window
* Scroll to the `-customerName` attribute in the command and paste the `$env:NINJA_ORGANIZATION_NAME` value inside `""`. This way we will automatically pass the customer name into installation script.
* Save the script configuration

<img alt="Ninja2" />

## **Deploy script**

Now you can deploy script to a set of workstations. The customer name will be passed automatically. If the organization exists in idemeum, idemeum agent will be paired with that organization, if not, then new customer will be created automatically in idemeum.

* Locate the workstation where you would like to deploy idemeum
* Choose `Run automation` → `Script` and choose idemeum script that we created in the previous step
* Confirm the execution of the script

<img alt="Ninja3" />


# SuperOps RMM
Source: https://docs.idemeum.com/integrations/super-ops-rmm

Control agent deployment with SuperOps RMM.

In this guide we will take a look at how to deploy idemeum control agent with a unified script to SuperOps customers. We take one script, create one deployment in SuperOps, automatically grab the `Client name` in SuperOps and associate idemeum agent with that customer. If the customer tenant with this name does not exist in idemeum, it will be automatically created.

## **Obtain unified install script**

* Navigate to the admin portal of your `Main MSP dashboard`
* Click on the `Bulk install agent` and then `Control agent`
* Choose the operating system you want to use and grab the installation command
* Save this installation command in the text editor, as we will need to use it when creating deployment in SuperOps

<img alt="Clean Shot 2026 05 25 At 17 42 59@2x" />

## **Create SuperOPS deployment**

* Access your SuperOps admin console
* Navigate to `Scripts` section and click `+ Script`

<img alt="Super1" />

* Give script a name
* Paste the command that we obtained in the previous section in the script editor Window
* For Windows choose `PowerShell` as language
* Choose run as `System user`
* Script duration set to be `10` minutes.
* Add a `Placeholder variable` and choose the variable `Client name` and give it a name `clientName`

<img alt="Super3" />

* Now edit the script to specify that we are passing `clientName` variable as `-customerName` attribute to idemeum. Use the `$` sign, and you do not need to use `""`

<img alt="Super5" />

* Save script configuration

## **Trigger deployment**

Now you can trigger deployment for any of your customers. Idemeum will automatically create a customer tenant in idemeum if it does not exist.

* Access any of your assets in SuperOps
* Choose `Run script` → `Run immediately` and choose the script that we created

<img alt="Super6" />


# Syncro RMM
Source: https://docs.idemeum.com/integrations/syncro-rmm

Control agent deployment with Syncro RMM.

In this guide we will take a look at how you can simply deploy idemeum control agent to your Syncro managed workstations. We will use one unified script and will automatically pass the customer name leveraging Syncro platform variable `{{customer_business_name}}`. If the organization exists in idemeum, then agent will be automatically associated, and if not, the new organization will be automatically created in idemeum.

## **Obtain unified install script**

* Navigate to the admin portal of your `Main MSP dashboard`
* Click on `Bulk install agent` then choose `Control agent`
* Choose the operating system and copy the unified install script command
* Save this command somewhere as we will need to use it in Atera

<img alt="Clean Shot 2026 05 25 At 17 35 18@2x" />

## **Create script in Syncro**

* Access you Syncro management dashboard
* Navigate to `Scripts` and then choose `+ New script`
* Provide the name of the script to use
* Click `Add Script Variable`
  * Name `customerName`
  * Type `Platform`
  * Value `{{customer_business_name}}`

<img alt="Syncro1" />

* Now paste the idemeum command that you obtained in the previous step in the script editor window
* Scroll to the attribute `-customerName` and reference the variable that we just created using `""`. In our case we will use the variable `$customerName` that we created above.
* Save the script configuration

<img alt="Syncro2" />

## **Deploy Syncro script**

* Access the workstation where you would like to deploy idemeum
* Choose `Scripts` → `Add to queue`
* Select the idemeum script that we created
* Choose to `Run as system`

<img alt="Syncro3" />


# JIT admin access overview
Source: https://docs.idemeum.com/jit-admin-access-overview

Privileged Access Management (PAM) to eliminate shared credentials, implement on-demand admin accounts, and secure critical accounts with auto password rotation. 

## What is Just-in-time Admin Access (JIT)

Idemeum offers unified, multi-tenant solution to secure privileged access to your critical resources. You can meet the compliance requirements by eliminating shared credentials and accessing resources with on-demand admin accounts. Moreover, you can automate password rotation for your critical break-glass admin accounts.

There are three major components for Just-in-time Admin Access:

<Card title="JIT for computers" icon="computer" href="/jit/jit-for-computers-overview">
  Access computers with on-demand admin accounts
</Card>

<Card title="JIT for Entra ID" icon="cloud-check" href="jit/jit-for-entra-overview">
  Access Microsoft tenants with on-demand admin accounts
</Card>

<Card title="Cloud LAPS" icon="rotate" href="jit/cloud-laps-overview">
  Automatic password rotation for break-glass accounts
</Card>


# JIT for Entra browser extension
Source: https://docs.idemeum.com/jit/browser-extension

Request Entra credentials from idemeum browser extension.

## Entra JIT Chrome extension

Idemeum offers chrome browser extension that you can use to request Entra JIT account, view credentials, and autofill the credentials in a new incognito window.

* When account is disabled, the icon that is shown in the portal and extension is greyed out. You can click on `...` and then request an account to be initially provisioned or re-enabled by clicking on `Request access`.

* When account is active you can use browser extension to view credentials. Click on `...` and then choose `View credentials`.

* Idemeum browser extension also facilitates credential auto-fill, so that technicians do not have to manually copy paste credentials. All you need to do it to launch Entra ID application either from the portal or the extension itself. When the application launches, the credentials will be automatically filled.


# Cloud LAPS configuration
Source: https://docs.idemeum.com/jit/cloud-laps-configuration

Configure idemeum Cloud LAPS to rotate credentials for computers or Entra ID tenants.

## Configure Cloud LAPS for computers

Before you configure idemeum Cloud LAPS, make sure you have idemeum control agent [installed](/control-agent/agent-install) on all computers where password rotation needs to be enabled.

* Login to your idemeum admin portal
* Navigate to `Control settings` → `JIT access` and then scroll to `LAPS for computers` section
* You have two options:
  * LAPS for local admin accounts (for computers that are NON domain controllers)
  * LAPS for domain accounts (for domain controllers)
* Toggle the options for the `local` or `domain` admin accounts password rotation
* Specify the account you want us to rotate
  * If the account exists, idemeum agent will take over that account and start the rotation
  * If the account does not exist, idemeum will create it on all workstations

<img alt="Clean Shot 2026 05 26 At 14 24 50@2x" />

* If you want to control what groups of technicians have access to LAPS credentials you can use `LAPS access control` section. By default every admin who has access to the tenant can view LAPS credentials.

## Configure Cloud LAPS for Entra

First you need to set up [JIT for Entra ID connection](/jit/jit-for-entra-configuration) with idemeum tenant. At the end of configuration you can specify if you want to enable LAPS for Entra ID.

* Scroll to the end of configuration section `LAPS accounts`
* Click `+` to add up to two LAPS accounts
* Specify the account names to use. The accounts will be created with the domain chosen for Entra JIT accounts

<img alt="Clean Shot 2026 05 26 At 14 26 27@2x" />


# Cloud LAPS overview
Source: https://docs.idemeum.com/jit/cloud-laps-overview

Automatic password rotation for critical admin accounts.

## What is Cloud LAPS

Idemeum Cloud LAPS is the solution that allows you to set up automatic password rotation for your computer or Entra ID break-glass credentials. The best practice is two have two set up of emergency credentials:

* One set of credentials is stored in your password management / vault
* Second set is configured for automated password rotation and is dynamically updated

Idemeum allows you to rotate break-glass admin credentials on each of your computers as well as for each Microsoft Entra ID tenant you manage. When idemeum desktop agent is installed and Cloud LAPS is enabled, idemeum rotates designated admin account every `24 hours` and uploads credential to the cloud. You can view these credentials in idemeum cloud portal or idemeum mobile application.


# Cloud LAPS view credentials
Source: https://docs.idemeum.com/jit/cloud-laps-view-credentials

View break-glass credentials that idemeum auto rotates.

## View LAPS credential for computers

* Login to your idemeum admin portal
* Navigate to `Devices`, choose the device, click on `...` and then `View LAPS credentials`

<img alt="Clean Shot 2026 05 25 At 16 46 26@2x" />

## View LAPS credentials for Entra

* Login to your idemeum user portal
* Search for Entra application, click on `...` and choose `View LAPS credentials`

<img alt="Clean Shot 2026 05 25 At 16 47 41@2x" />


# JIT access auditing
Source: https://docs.idemeum.com/jit/jit-access-auditing

Every Entra or computer just-in-time access is captured in idemeum audit trail.

## How to access audit trail

* Login to your idemeum admin portal
* Navigate to `Activity` → `Audit trail`

<img alt="Clean Shot 2026 05 25 At 16 12 17@2x" />

### JIT for computers audit trail

The following events are captured for computer access.

`Computer access` - this event provides technician email address, desktop name, and the account that was used for login.

```text wrap theme={null}
alex@nikpot.com logged into the Desktop W11-L-ELEVATED with account MSP-ALEX.
```

`Log off or lock` - this event provides technician email, desktop name, and account that was used.

```text wrap theme={null}
alex@nikpot.com has logged off the Desktop W11-L-ELEVATED with account MSP-ALEX.
```

`Offline code retrieval` - when a technician accesses offline code on a mobile device for a workstation, mobile application captures the event.

```text wrap theme={null}
alex@nikpot.com accessed offline code for Desktop machine W11-L-ELEVATED.
```

### JIT for Entra audit trail

The following events are captured for Entra ID access.

`Entra account request` - when technician navigates to idemeum portal and requests Entra ID account to be enabled or provisioned, we capture an event along with technician email address and the account name that will be provisioned.

```text wrap theme={null}
alex@nikpot.com requested access to application Entra 365 onmicrosoft. User account msptech6913@NETORGFT11060369.onmicrosoft.com created.
```

`Entra account disabled` - we capture audit events when technician Entra ID accounts are disabled. This happens when configured time for which account needs to stay active passed (default 4 hours).

```text wrap theme={null}
System disabled user account msptech6913@NETORGFT11060369.onmicrosoft.com in application Entra 365 onmicrosoft.
```

`Entra account credentials access` - audit event is captured when technicians view credentials for Entra ID accounts.

```text wrap theme={null}
alex@nikpot.com accessed Entra 365 onmicrosoft credentials.
```


# JIT for computers accounts
Source: https://docs.idemeum.com/jit/jit-for-computers-accounts

Choose the account types to use when technicians access customer workstations.

## Named vs. shared accounts

<Warning>
  All compliance frameworks require administrative access to be performed with individual admin accounts that can be audited.
</Warning>

<AccordionGroup>
  <Accordion title="Named admin accounts" icon="user-check">
    <Info>
      Named accounts is the default option.
    </Info>

    When technicians login, an individual account for their assigned username is create on the workstation (or domain controller). Each account is enabled only for the duration of the session and the password is rotated to a random value after each log out. In the audit logs you will see information about who logged in where and what individual account was used.
  </Accordion>

  <Accordion title="Shared admin account" icon="share">
    We offer this option to reduce the number of accounts created, however this option does not pass security and compliance requirements. One individual account is used to login all technicians. This account is enabled only for the duration of the session, and password is rotated behind the scenes for after every log out. Agent automatically generates in the account in the form msp-XXXX (i.e msp-1234) for each customer / organization. In the logs you still have visibility into show logged in where with the shared account.
  </Accordion>
</AccordionGroup>

## Domain vs. local admin accounts

<AccordionGroup>
  <Accordion title="Local admin accounts" icon="credit-card-blank">
    <Info>
      Local admin account is the default option.
    </Info>

    Regardless of the computer state (local, domain, or Entra joined) idemeum will create local admin account for each technician. For the case there is no need to install idemeum agent on domain controller. Simply install on user workstations.
  </Accordion>

  <Accordion title="Domain admin accounts" icon="star">
    <Note>
      You need to install idemeum agent on all domain controllers to be able to create and use JIT domain accounts.
    </Note>

    When technician tries to login by scanning a QR-code on user workstation, idemeum agent reaches out to DC to provision and enable domain account. After the session domain account is disabled and the password is rotated.
  </Accordion>
</AccordionGroup>


# JIT for computers configuration
Source: https://docs.idemeum.com/jit/jit-for-computers-confiruation

Configure how you want JIT for computer access to work.

## JIT for computers settings

Navigate to `Care settings` → `JIT access` to configure how you want JIT accounts to be managed for your customer / organization.

<img alt="Clean Shot 2026 05 25 At 13 55 35@2x" />

<ParamField type="individual | shared">
  Choose how you want technicians to login into workstations - with `individual accounts` or one `shared account` per organization / customer tenant. Default is individual accounts as that is required by security frameworks.
</ParamField>

<ParamField type="local | domain | prompt to choose">
  Choose how technicians login to domain computers. By default local admin account is used.

  * `Local` - create local admin account on the workstation
  * `Domain` - create domain account on DC. For this case you need to install idemeum agent on domain controller
  * `Prompt to choose` - when you scan idemeum QR-code you will be presented with option to choose what account to use - domain or local. For this option you need to install idemeum agent on domain controller.
</ParamField>

<ParamField type="OU string">
  For domain JIT computer accounts you can choose the Organization Unit (OU) container where these accounts will be created.

  * The default location for each tenant is `<your domain>/Users`
  * You can choose to create any OU or a set of nested OUs for your JIT accounts, i.e `<your domain>/JIT accounts` or `<your domain>/JIT/MSP accounts` etc. You just need to specify the path.
  * If OU path does not exist, idemeum will create the corresponding OU containers.
  * The nested containers under `Users` are NOT supported. For instance, `<your domain>/Users/JIT accounts` is not supported
  * If you used the `path 1` for your JIT accounts and they were already created, and then you change the path to `path 2`, next time when JIT login is performed, JIT account will be moved to the new location
</ParamField>

<ParamField type="12 | 16 | 24">
  Chose the password length for created JIT admin accounts.
</ParamField>

<ParamField type="on | off">
  By default technicians login by scanning a QR-code with idemeum mobile app. You can also provide on option to login with OTP even when computer is not offline. Technicians retrieve the OTP from mobile app and enter it into the login screen.
</ParamField>

<ParamField type="on | off">
  Enable the option to send a push notification to a mobile app instead of scanning a login QR-code. Technicians enter their email address and then approve a notification on their mobile app.
</ParamField>

<ParamField type="Set time (1 hour, etc.)">
  When you are logged in with a JIT account and the session is active, you can specify the time when the account will be automatically logged out. All new tenants come with this feature enabled and set at 1 hour.
</ParamField>


# JIT for computers features
Source: https://docs.idemeum.com/jit/jit-for-computers-features

Major features that you can use with JIT for computer access.

## JIT computer elevation

When you login as technician with mobile device, you might need to perform certain actions that require elevation. When the elevation screen comes up, you can simply scan the QR-code to elevate the application. For instance, on Windows simply click `More options`, then enlarge idemeum QR-code, and scan with your mobile app. The action will be elevated and UAC will be handled by idemeum agent behind the scenes. Similar experience is offered on macOS workstations.

<img alt="Jit Elevation" />

## JIT for computers login methods

<AccordionGroup>
  <Accordion title="QR-code login">
    Navigate to workstation where idemeum agent is installed, click on the QR-code at the bottom of the screen, and then scan the QR-code with idemeum mobile app.

    <img alt="Qrlogin" />
  </Accordion>

  <Accordion title="Push notification login">
    <Note>
      You need to [enable](/jit/jit-for-computers-confiruation) this option in JIT settings first.
    </Note>

    Navigate to workstation where idemeum agent is installed, click on the QR-code icon at the bottom left to load idemeum login option, click on `Send notification` link. Now you are able to enter your email address (the one you registered with in idemeum) and you will receive a login notification.

    <img alt="Pushlogin" />
  </Accordion>

  <Accordion title="OTP login">
    You can use this method when computer is offline. When computer is offline, idemeum agent can not render a QR-code and automatically switches to OTP login mode. Or you can enable this option to login with OTP even when computer is not offline. Navigate to workstation, click on QR-code at the bottom left to load idemeum login options, click on `Login via OTP`. Now you can retrieve username and OTP for the workstation from your idemeum mobile app.

    <img alt="Otplogin" />
  </Accordion>
</AccordionGroup>

## Offline computer access

When the computer is offline, idemeum credential provider will automatically switch to offline mode. Instead of displaying the QR-code for admin access, it will show the username and offline secret fields.

<img alt="Offline" />

To retrieve username and your offline OTP code, open idemeum mobile application, switch to appropriate organization / customer, then search for workstation, click on `...` and retrieve username and OTP code.

<img alt="Offlinecode" title="Offlinecode" />

## Selective computer JIT login

<Note>
  You need to enable this feature for the tenant. More about configuration [here](/jit/jit-for-computers-confiruation).
</Note>

For domain-joined workstations where idemeum desktop client is installed, you can choose what account to use for technician login on the fly at login time. When you scan the QR-code you will be presented with the option to use domain account or local. This feature is useful if you want to control on which workstations you want to expose your domain admin account.

<img alt="Select" />

## RDP with JIT accounts

<Warning>
  RDP with JIT accounts works between domain-joined workstations. You need to make sure idemeum agent is installed on domain controller, source, and destination Windows workstation.
</Warning>

<Card title="RDP access with JIT accounts" icon="youtube" href="https://www.youtube.com/watch?v=OrDygvIN-B4">
  Quick demo for how to RDP with JIT accounts.
</Card>

When idemeum desktop agent is installed on domain-joined workstations, technicians can RDP from one machine to the other without the need to use any passwords - simply scan the QR-code and approve with biometrics. Just-in-time accounts will be used behind the scenes, accounts will be enabled / disabled on-demand, and passwords will be rotated after each login.

### RDP JIT prerequisites

* Supported on domain-joined workstations only
* Desktop agent installed on `source` and `target` machine
* Domain accounts login enabled for the customer tenant
* Domain controller is reachable from the RDP `source` workstation
* Agent is installed on domain controller

### How to RDP with JIT account

* Login to `source` domain-joined workstation
* Open Windows Remote Desktop Client and connect to the `target` domain-joined machine
* You will then be prompted to authenticate. Click `More options` and then select `idemeum credential provider` to scan the QR-code.
* You can enlarge the QR-code so that it is easier to scan by clicking on `Click here to expand QR code`
* Scan the QR-code with idemeum mobile application and approve with biometrics
* You will be logged in to the `target` workstation

<img alt="Enlarge" />

## Computer access control

You can control what technicians have access to what workstations. Important to note that if technician is a `Global admin`, she can access and edit everything everywhere. If you want to apply access control you first need to delegate technician access to certain customer / organization with `read-only` permissions, and then edit workstation access control settings.

* Navigate to admin portal of customer / organization
* Access `Devices`, then click on `...` for the device you want to edit, and choose `Share device`
* By default `All admins` and `All users` will be there
* To control technician access, remove `All admins` role and only add technicians that need to access this workstation

<img alt="Clean Shot 2026 05 25 At 15 32 29@2x" />

## JIT domain account auto removal

When technicians use JIT access for computers in domain environments, individual domain admin accounts are created every time new technician logs in for the first time. When these accounts are not in use, they are in disabled state.

In order to make the number of accounts manageable, idemeum agent that is installed on domain controller will periodically inventory all technicain JIT accounts. And if the account has not been used for the last 30 days, it will be deleted.

<Note>
  Let's look at the example. Technician `alex` logs into the domain controller and the account `msp-alex` is created. Once `alex` logs out, the JIT account is disabled. For 30 days `alex` does not login to this domain environment. As a result, the account is deleted after 30 days. If `alex` tries to login after a period of 30 days the account `msp-alex` will be recreated.
</Note>


# JIT for computers overview
Source: https://docs.idemeum.com/jit/jit-for-computers-overview

Eliminate shared credentials when accessing customer workstations and servers.

## What is JIT for computers

<Card title="Demo - JIT access to computers" icon="youtube" href="https://www.youtube.com/watch?v=KnX_RYfY7oE">
  See how you can eliminate shared credentials when accessing customer workstations and servers
</Card>

JIT for computers is all about eliminating shared credentials and standing privileges when accessing Windows and macOS workstations and servers. Idemeum will automatically generate unique named admin accounts for your technicians, enable these accounts only for the duration of the session, and rotate passwords automatically after every login. Every login is protected with Passwordless FIDO2 compliant MFA, and every session is tracked in the audit trail.

Every cyber security framework requires individual secure accounts for admin access. If you need to maintain security compliance, it is a big pain - say you have 100 customers and 15 technicians, then you need to manage 1500 unique accounts, creating them, disabling, rotating passwords, and distributing credentials. Idemeum solves all these problems with JIT Admin Access product.

## JIT for computers primary features

<AccordionGroup>
  <Accordion title="Passwordless login">
    Instead of looking for passwords, copy pasting credentials, and sharing MFA codes, technicians simply scan login QR-code with idemeum mobile app and login with biometrics.
  </Accordion>

  <Accordion title="Login with MFA">
    Every login is multi-factor that is based on secure FIDO2 protocol that uses certificates and biometrics.
  </Accordion>

  <Accordion title="Zero-standing privilege">
    Idemeum will automatically enable admin accounts when they are needed, and will automatically disable them when not in use. This way you maintain highest level of security with zero-standing privilege.
  </Accordion>

  <Accordion title="Automatic password rotation">
    Idemeum will rotate admin accounts passwords after each technician login, or daily rotate passwords for break-glass accounts.
  </Accordion>

  <Accordion title="Auditing">
    Detailed audit logs are captured and maintained in the cloud (computer log in, log off, lock and offline code access).
  </Accordion>

  <Accordion title="Offline computer access">
    When the workstation is offline, technicians can login with one-time codes that can be retrieved from the idemeum mobile application.
  </Accordion>

  <Accordion title="Granular configuration">
    Very flexible configurations to choose if you want to use shared / individual accounts, or domain / local accounts with domain environments. You can set up various login methods, branding options, OU for domain account creation  and more.
  </Accordion>
</AccordionGroup>


# JIT for Entra configuration
Source: https://docs.idemeum.com/jit/jit-for-entra-configuration

Configure JIT admin access to Entra ID tenants

## JIT for Entra configuration

For this integration to work you need to connect Entra ID customer tenant to idemeum, so that we can provision admin accounts and manage their lifecycle.

<AccordionGroup>
  <Accordion title="1. Create application in Entra ID customer tenant">
    * Login to `portal.azure.com` with `Global Admin` account
    * Navigate to Entra ID directory
    * Go to `Manage` → `App registrations`
    * Click `New registration` <img alt="Newreg" />
    * Provide the application name
    * Keep `Accounts in this organizational directory only`
    * Enter redirect URL - `https://dvmi.idemeumlab.com/hrms/oauth2/authorize/callback`
    * Click `Register`

      <img alt="Clean Shot 2026 06 24 At 17 24 11@2x" />
  </Accordion>

  <Accordion title="2. Save integration parameters">
    <Note>
      We will need to obtain 3 things for integration: `Application (client) ID`, `Directory (tenant) ID`, and `Client secret`
    </Note>

    * First we will grab `Application (client) ID` and `Directory (tenant) ID`

      <img alt="Appid" />

    * Navigate to `Certificates and secrets` section

    * Click `New client secret`

      <img alt="Secret" />

    * Give secret a name and set the expiration time of 24 months

      <img alt="24month" />

    * Now click `Add`

    * Now you can copy the remaining parameter - `secret value`

      <img alt="Value" />
  </Accordion>

  <Accordion title="3. Create API permissions">
    Now we will need to assign API permissions to idemeum application.

    * Navigate to `API permissions` and click `Add a permission`

      <img alt="Perm" />

    * Choose `Microsoft Graph` and then `Application permissions`

      <img alt="Apiperm" />

    * Now click on `Application permissions` and add the following:
      * `Organization.Read.All`
      * `User.Read.All`
      * `User.ReadWrite.All`
      * `User.Invite.All`
      * `Group.Read.All`
      * `RoleManagement.Read.All`
      * `RoleManagement.ReadWrite.Directory`
      * `User.EnableDisableAccount.All`
      * `User.ManageIdentities.All`
      * `Domain.ReadWrite.All`
      * `Directory.ReadWrite.All`
      * `User-PasswordProfile.ReadWrite.All`
      * `AuditLog.Read.All`

    <Warning>
      Once you add permissions make sure you click `Grant admin consent`
    </Warning>

    <img alt="Perm1" />
  </Accordion>

  <Accordion title="4. Configure Entra JIT in idemeum">
    * Navigate to your idemeum admin portal

    * Choose `Applications` section and click `Add app`

    * Choose `Managed password app`

    * Provide application name

    * For application type choose `Web application`

    * For credentials choose `Entra ID OIDC credentials`

    * Now we will enter `Directory (tenant) ID`, `Application (client) ID`, and `client secret value` parameters that we obtained in the previous section

      <img alt="Clean Shot 2026 05 25 At 15 48 35@2x" />

    * Now click the `Validate` button

    * Once the validation is successful you can configure the additional values below
      * Choose how quickly you want Entra JIT account to be disabled
      * Choose the domain name where you want to provision Entra accounts
      * For group mapping choose what groups you want to assign to JIT accounts
      * Also specify LAPS account if you want idemeum to create and manage one for the Entra tenant

    * Save the configuration
  </Accordion>
</AccordionGroup>


# JIT for Entra login flow
Source: https://docs.idemeum.com/jit/jit-for-entra-login-flow

Request your on-demand Entra credentials from idemeum admin portal.

## How to request Entra JIT account

* Navigate to the customer / organization admin portal
* Search for Entra ID application and click on `...`
* Now you can request JIT account and view provisioned credentials

<img alt="Clean Shot 2026 05 25 At 16 06 34@2x" />


# JIT for Entra overview
Source: https://docs.idemeum.com/jit/jit-for-entra-overview

Eliminate shared credentials and access Entra ID tenants with on-demand admin accounts.

## How JIT for Entra ID works

<Card title="Demo - JIT access to Entra ID" icon="youtube" href="https://www.youtube.com/watch?v=rDvegB8IBoE">
  See how you can eliminate shared credentials when accessing customer Entra ID tenants
</Card>

When you have multiple Entra ID tenants your technicians need to access, you can leverage idemeum to automatically manage individual on-demand admin accounts. Technicians request admin accounts, login to do their business, and then after some time the accounts will be disabled and passwords rotated. You can request Entra JIT accounts from idemeum portal, or you can integrate our platform with your ticketing system, so that you request Entra JIT accounts right from customer support tickets.

## JIT for Entra ID primary features

<AccordionGroup>
  <Accordion title="On-demand cloud accounts">
    Technicians access Entra ID tenants with individual on-demand accounts. Idemeum will provision admin accounts, rotate passwords after each use, and disable these JIT accounts when not in use.
  </Accordion>

  <Accordion title="PSA integrations">
    Integrate idemeum into your PSA system. Technicians can access Entra JIT accounts right from your ticketing system. 
  </Accordion>

  <Accordion title="Browser extension">
    Idemeum offers Chrome browser extension to perform an auto-fill of on-demand credentials when technicians need to login to Entra tenants.
  </Accordion>

  <Accordion title="Granular permissions">
    Define what roles technicians need to assume in Entra when idemeum creates JIT accounts, and define the time interval when accounts expire and need to be requested again.
  </Accordion>
</AccordionGroup>


# Operate overview
Source: https://docs.idemeum.com/operate-overview



Operate is currently under development and will be available soon.


# Bulk tenant creation
Source: https://docs.idemeum.com/portals/bulk-tenant-creation

Create multiple customer tenants at once with CSV upload or APIs.

## How bulk tenant creation works

<AccordionGroup>
  <Accordion title="Create tenant over API">
    Leverage idemeum [APIs](https://api.idemeum.com) to create child tenants.
  </Accordion>

  <Accordion title="Upload tenant CSV file">
    Upload the CSV file with your organization / customer data. When you are uploading a CSV you need to make sure the CSV contains the fields that will map to organization `name` (will be used in the URL) and `display name` (friendly tenant description).
  </Accordion>
</AccordionGroup>

## **Upload tenant CSV file**

* Navigate to the admin portal of your parent tenant
* Access `Tenants` section, click `Add tenant` and then `Import CSV`

<img alt="Clean Shot 2026 05 25 At 16 57 58@2x" />

* Upload the CSV file with your tenant data
* Map the values that will be used for `subdomain` and `display name` using the dropdown fields on the right.
* Once you click next, idemeum will process the creation request, and it will create the tenants. Once completed, you will be presented with information for how many tenants were created and what errors were present if any.


# Co-managed JIT login
Source: https://docs.idemeum.com/portals/comanaged-jit-login

Onboard your customer co-managed admins so that they can leverage JIT access and elevation approvals.

## How co-managed JIT login works

<Note>
  Co-managed user will have full admin rights to the tenant. She will be able to JIT login to all machines, approve all elevation requests, and access the admin portal.
</Note>

* You need to onboard co-managed admin into a customer tenant, not into your MSP tenant
* Once onboarded, you need to promote the user to admin, and that user will automatically assume the role of `co-managed` user
* We automatically generate the username for co-managed user and prefix it with `co-`. For instance, for user `nik@company.com` the username will be `co-nik`. You can change this username to whatever you like when creating the user.

## Configure co-managed JIT login

* Navigate to your customer tenant admin portal where you would like to onboard co-managed user
* Click on `Tenant users` and choose `Add user`
* Create the user record by providing first name, last name, and the email address. We will automatically generate the username.
* Now the user installs idemeum mobile app, verifies the email address that was used when creating the user record, navigates to the customer tenant URL and scans the QR-code.
* After the user is successfully onboarded, you click on `...` next to that user record and choose `Make admin.`
* Once you promote the user to admin, the user record will be assigned the `co-managed` status.
* The user can now access workstations with JIT login and will be able to approve elevation requests.

<img alt="Clean Shot 2026 05 25 At 15 37 21@2x" />


# Delegate access to tenants
Source: https://docs.idemeum.com/portals/delegate-access-to-tenants

Delegate admin access to customer child tenants.

## Roles overview

There are several roles that define how admins can access tenants:

* `Global administrator` - full admin access to everything
* `Administrator` - full access but only to designated tenants
* `Read-only administrator` - read only access to designated tenants

### Global administrator role

* Access admin portal of your parent tenant
* Navigate to your `Users` section
* Click on `...` and choose `Make admin`

### Administrator role

* Access admin portal of your parent tenant
* Navigate to your `Tenants` section
* Click on `...` for a chosen organization and choose `Delegate admin`
* From the dropdown search for technician email address and assign the `Administrator` role

### Read-only administrator role

* Access admin portal of your parent tenant
* Navigate to your `Tenants` section
* Click on `...` for a chosen tenant and choose `Delegate admin`
* From the dropdown search for technician email address and assign the `Read-only administrator` role

## How to delegate access to customer tenant

* Login to your parent MSP tenant admin portal
* Access `Tenants` on the left menu, find the tenant that you need, click on `...` and then choose `Delegate admin access`
* You can now choose users from the dropdown along with the role they will assume
* At the bottom you will have a list of all `Global admins` who have access to all tenants by default

<img alt="Clean Shot 2026 05 25 At 17 01 20@2x" />


# Multi-tenant portal (MSP) overview
Source: https://docs.idemeum.com/portals/multi-tenant-portal-overview

Idemeum offers multi-tenant architecture to manage multiple customers from a singe dashboard.

## How multi-tenant portal works

Idemeum is designed based on multi-tenant architecture, and it allows you to create multiple tenants / organizations. As an IT team, you can create separate tenants for various organizations, apply access controls, enable different products per organization, and more. As an MSP you can create separate tenants for each customer you manage. There are two types of tenants in idemeum:

<AccordionGroup>
  <Accordion title="Parent tenant">
    This is your main tenant residing on your primary domain - `<company-name>.idemeum.com`\*\*. \*\*Parent tenant is used to create child tenant and manage global settings that apply to all organizations.
  </Accordion>

  <Accordion title="Child tenant">
    This is a tenant you create for each customer / organization that you manage, and it is accessible at `org1-<company-name>.idemeum.com`, `org2-<company-name>.idemeum.com`, etc. When you install desktop agents, they are associated with child tenants.
  </Accordion>
</AccordionGroup>

## Create child tenant

* Navigate to the admin portal of your parent idemeum tenant
* Access `Tenants` on the left
* Click `Add tenant` and then choose `Add manually`
* Specify the organization `name` (will go into the URL) and the `display name` (friendly description)

<Info>
  Say my parent tenant is `company.idemeum.com`. If `name` → `bank` and `display name` → `banking organization`, then the child tenant → `bank-company.idemeum.com`***.***
</Info>

* Save the configuration

<img alt="Clean Shot 2026 05 25 At 16 54 08@2x" />

## Access child tenant

<AccordionGroup>
  <Accordion title="Tenant switcher">
    At the top left side of the screen you can leverage the tenant dropdown to navigate between various organizations.

    <img alt="Clean Shot 2026 05 25 At 16 55 02@2x" />
  </Accordion>

  <Accordion title="Parent tenant app portal">
    When you switch to the app portal of your parent tenant, you will be presented with all organizations.

    <img alt="Clean Shot 2026 05 25 At 16 55 38@2x" />
  </Accordion>

  <Accordion title="Tenants table">
    If you access the admin portal of your parent, then navigate to `Tenants` section, you will then be able to click on the link for any customer / organization that you created.

    <img alt="Clean Shot 2026 05 25 At 16 55 59@2x" />
  </Accordion>
</AccordionGroup>

## **Delete child tenant**

* Access your parent tenant admin portal
* Navigate to `Tenants` section
* Search for the organization you want to delete, click on `...` and then choose `Delete`


# Portal settings
Source: https://docs.idemeum.com/portals/portal-settings

Configure general idemeum portals settings.

## General portal settings

Navigate to `Control settings` → `General` to configure basic portal settings.

<img alt="Clean Shot 2026 05 26 At 16 14 19@2x" />

<ParamField>
  Set up the time interval before users will need to re-authenticate to access idemeum admin portal.

  <ParamField>
    Configure your idemeum tenant display name. `$, [, ], ",\r, \n, \t `are not allowed.
  </ParamField>
</ParamField>


# User and admin portals
Source: https://docs.idemeum.com/portals/user-and-admin-portal

Idemeum offers user and admin portals to view resources and manage settings.

## User portal

User portal is used to quickly access the resources for child tenant / organization - request Entra ID JIT account, view LAPS credentials, etc. Use the switch button at the top right to switch between user and admin portals.

<img alt="Clean Shot 2026 05 25 At 17 02 54@2x" />

## Admin portal

Admin portal is used to change various settings and configurations for your organizations - set up RFID SSO, change JIT settings, manage allowlisting and more. Use the switch button at the top right to switch between user and admin portals.

<img alt="Clean Shot 2026 05 25 At 17 03 19@2x" />


# Privacy policy
Source: https://docs.idemeum.com/privacy-policy

Idemeum privacy policy document.

***Last Updated: Apr 5, 2024***

idemeum, Inc. (“idemeum”, “we”, “us”, “our”) provides an all-in-one Passwordless Application Management platform for Small to Medium Businesses to allow our customers to manage workspace applications, simply, securely, and cost effectively while also introducing new concepts such as self-onboarding and end-to-end password elimination. This Privacy Policy is designed to help you understand how we collect, use, and share your personal information and to help you understand and exercise your privacy rights.

## **1. Scope**

This Privacy Policy applies to personal information processed by us, including on our websites, mobile applications, and other online or offline offerings. To make this Privacy Policy easier to read, our websites, mobile applications, and other offerings are collectively called “**Services**”.

This Privacy Policy does not apply to any of the personal information that our customers may collect and process using idemeum’s Services (“**Customer Data**”). Our customers’ respective privacy policies govern their collection and use of Customer Data. Our processing of Customer Data is governed by the contracts that we have in place with our customers, not this Privacy Policy. Any questions or requests relating to Customer Data should be directed to our customer. idemeum is the controller (“Controller”) for the personal information we process, unless otherwise stated. For information on how to contact us, please refer to “[**<u>Contact Us</u>**](https://docs.idemeum.com/privacy-policy.html#_13-contact-us)” below.

## **2. Personal Information We Collect**

The categories of personal information we collect depend on how you interact with us, our Services, and the requirements of applicable law. We collect information that you provide to us, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organizations, as described below.

### **A. Information You Provide to Us Directly**

We may collect the following personal information that you provide to us.

* **Account Creation**. We may collect information when you create an account, such as your name, email address, phone number, and driver’s license information.
* **Purchases**: We may collect personal information and details associated with your purchases, including payment information. Any payments made via our Services are processed by third-party payment processors. We do not directly collect or store any payment card information entered through our Services, but we may receive information associated with your payment card information (e.g., your billing details).
* **Your Communications with Us**. We may collect personal information, such as email address, phone number, or mailing address when you request information about our Services, register for our newsletter program, request customer or technical support, apply for a job, or otherwise communicate with us.
* **Surveys**. We may contact you to participate in surveys. If you decide to participate, you may be asked to provide certain information which may include personal information.
* **Interactive Features**. We and others who use our Services may collect personal information that you submit or make available through our interactive features (e.g., messaging and chat features, commenting functionalities, forums, blogs, and social media pages). Any information you provide using the public sharing features of the Services (referred to herein as “User Content”) will be considered “public,” unless otherwise required by applicable law, and is not subject to the privacy protections referenced herein.
* **Sweepstakes or Contests**. We may collect personal information you provide for any sweepstakes or contests that we offer. In some jurisdictions, we are required to publicly share information of sweepstakes and contest winners.
* **Conferences, Trade Shows, and Other Events**. We may collect personal information from individuals when we attend conferences, trade shows, and other events.
* **Business Development and Strategic Partnerships**. We may collect personal information from individuals and third parties to assess and pursue potential business opportunities.
* **Job Applications**. We may post job openings and opportunities on our Services. If you reply to one of these postings by submitting your application, CV and/or cover letter to us, we will collect and use your information to assess your qualifications.

### **B. Information Collected Automatically**

We may collect personal information automatically when you use our Services:

* **Biometric Information is Not Collected by idemeum**: Our Services may be used with a device (for example, an iPhone or an Android phone) that uses the device’s native applications to authenticate user identify through biometrics that are stored on the device itself (such as facial recognition or fingerprints). While we leverage the authentication provided by the device biometrics, we do not have access to this biometric information and it is not possible for us to collect this biometric information. Please refer to your device’s manufacturer or operating system developer for their privacy policies concerning the use and sharing of your biometric information.
* **Automatic Data Collection**. We may collect certain information automatically when you use our Services, such as your Internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile carrier, mobile advertising and other unique identifiers, browser or device information, location information (including approximate location derived from IP address), and Internet service provider. We may also automatically collect information regarding your use of our Services, such as pages that you visit before, during and after using our Services, information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our Services.

**Cookies, Pixel Tags/Web Beacons, and Other Technologies**. We, as well as third parties that provide content, advertising, or other functionality on our Services, may use cookies, pixel tags, local storage, and other technologies (“Technologies”) to automatically collect information through your use of our Services.

* **Cookies**. Cookies are small text files placed in device browsers that store preferences and facilitate and enhance your experience.
* **Pixel Tags/Web Beacons**. A pixel tag (also known as a web beacon) is a piece of code embedded in our Services that collects information about engagement on our Services. The use of a pixel tag allows us to record, for example, that a user has visited a particular web page or clicked on a particular advertisement. We may also include web beacons in e-mails to understand whether messages have been opened, acted on, or forwarded.

Our uses of these Technologies fall into the following general categories:

* **Operationally Necessary**. This includes Technologies that allow you access to our Services, applications, and tools that are required to identify irregular website behavior, prevent fraudulent activity and improve security or that allow you to make use of our functionality;
* **Performance-Related**. We may use Technologies to assess the performance of our Services, including as part of our analytic practices to help us understand how individuals use our Services (see Analytics below). \[For example, we may track your in-app activity, including recordings of your gameplay and other interactions with the app];
* **Functionality-Related**. We may use Technologies that allow us to offer you enhanced functionality when accessing or using our Services. This may include identifying you when you sign into our Services or keeping track of your specified preferences, interests, or past items viewed;
* **Advertising- or Targeting-Related**. We may use first party or third-party Technologies to deliver content, including ads relevant to your interests, on our Services or on third-party websites.

See “**Your Privacy Choices and Rights**” below to understand your choices regarding these Technologies.

* **Analytics**. We may use Technologies and other third-party tools to process analytics information on our Services. Some of our analytics partners include:
* **Google Analytics**. For more information, please visit [**<u>Google Analytics’ Privacy Policyopen in new window</u>**](http://www.google.com/policies/privacy/partners/?ref=docs.idemeum.com). To learn more about how to opt-out of Google Analytics’ use of your information, please click [**<u>hereopen in new window</u>**](http://tools.google.com/dlpage/gaoptout?ref=docs.idemeum.com).
* **Social Media Platforms**. Our Services may contain social media buttons, which might include widgets such as the “share this” button or other interactive mini programs. These features may collect your IP address, which page you are visiting on our Services, and may set a cookie to enable the feature to function properly. Your interactions with these platforms are governed by the privacy policy of the company providing it.

### **C. Information Collected from Other Sources**

We may obtain information about you from other sources, including through third-party services and organizations. For example, if you access our Services through a third-party application, such as an app store, a third-party login service, or a social networking site, we may collect information about you from that third-party application that you have made available via your privacy settings.

idemeum's use and transfer to any other app of information received from Google APIs will adhere to [**<u>Google API Services User Data Policy</u>**](https://developers.google.com/terms/api-services-user-data-policy?ref=docs.idemeum.com#additional_requirements_for_specific_api_scopes), including the Limited Use requirements.

## **3. How We Use Your Information**

We use your information for a variety of business purposes, including to provide our Services, for administrative purposes, and to market our products and Services, as described below.

### **A. Provide Our Services**

We use your information to fulfill our contract with you and provide you with our Services, such as:

* Managing your information and accounts;
* Providing access to certain areas, functionalities, and features of our Services;
* Answering requests for customer or technical support;
* Communicating with you about your account, activities on our Services, and policy changes;
* Processing your financial information and other payment methods for products or Services purchased;
* Processing applications if you apply for a job we post on our Services; and
* Allowing you to register for events.

### **B. Administrative Purposes**

We use your information for various administrative purposes, such as:

* Pursuing our legitimate interests such as direct marketing, research and development (including marketing research), network and information security, and fraud prevention;
* Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity;
* Measuring interest and engagement in our Services;
* Short-term, transient use, such as contextual customization of ads;
* Improving, upgrading or enhancing our Services;
* Developing new products and Services;
* Ensuring internal quality control and safety;
* Authenticating and verifying individual identities, including requests to exercise your rights under this policy;
* Debugging to identify and repair errors with our Services;
* Auditing relating to interactions, transactions and other compliance activities;
* Enforcing our agreements and policies; and
* Complying with our legal obligations.

### **C. Marketing and Advertising our Products and Services**

We may use personal information to tailor and provide you with content and advertisements. We may provide you with these materials as permitted by applicable law.

Some of the ways we market to you include email campaigns, custom audiences advertising, and “interest-based” or “personalized advertising,” including through cross-device tracking.

If you have any questions about our marketing practices, you may contact us at any time as set forth in “**Contact Us**” below.

### **D. Other Purposes**

We also use your information for other purposes as requested by you or as permitted by applicable law.

* **Consent**. We may use personal information for other purposes that are clearly disclosed to you at the time you provide personal information or with your consent.
* **De-identified and Aggregated Information**. We may use personal information and other information about you to create de-identified and/or aggregated information, such as de-identified demographic information, de-identified location information, information about the device from which you access our Services, or other analyses we create.
* **Share Content with Friends or Colleagues**. Our Services may offer various tools and functionalities. For example, we may allow you to provide information about your friends through our referral services. Our referral services may allow you to forward or share certain content with a friend or colleague, such as an email inviting your friend to use our Services. Please only share with us contact information of people with whom you have a relationship (e.g., relative, friend neighbor, or co-worker).

## **4. How We Disclose Your Information**

We disclose your information to third parties for a variety of business purposes, including to provide our Services, to protect us or others, or in the event of a major business transaction such as a merger, sale, or asset transfer, as described below.

### **A. Disclosures to Provide Our Services**

The categories of third parties with whom we may share your information are described below.

* **Service Providers**. We may share your personal information with our third-party service providers who use that information to help us provide our Services. This includes service providers that provide us with IT support, hosting, payment processing, customer service, and related services.
* **Our Customers**. In cases where you use our Services as part of a subscription or other agreement entered into by one of our customers (e.g., if your employer pays for your use of our Services), that customer may access information associated with your use of the Services including usage data associated with your account. Your personal information may also be subject to the customer’s privacy policy. We are not responsible for the customer’s processing of your personal information.
* **Business Partners**. We may share your personal information with business partners to provide you with a product or service you have requested. We may also share your personal information to business partners with whom we jointly offer products or services.
* **APIs/SDKs**. We may use third-party Application Program Interfaces (“APIs”) and Software Development Kits (“SDKs”) as part of the functionality of our Services. For more information about our use of APIs and SDKs, please contact us as set forth in “Contact Us” below.

### **B. Disclosures to Protect Us or Others**

We may access, preserve, and disclose any information we store associated with you to external parties if we, in good faith, believe doing so is required or appropriate to: comply with law enforcement or national security requests and legal process, such as a court order or subpoena; protect your, our, or others’ rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity.

### **C. Disclosure in the Event of Merger, Sale, or Other Asset Transfers**

If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

## **5. Your Privacy Choices and Rights**

**Your Privacy Choices**. The privacy choices you may have about your personal information are determined by applicable law and are described below.

* **Email and Telephone Communications**. If you receive an unwanted email from us, you can use the unsubscribe link found at the bottom of the email to opt out of receiving future emails. Note that you will continue to receive transaction-related emails regarding products or Services you have requested. We may also send you certain non-promotional communications regarding us and our Services, and you will not be able to opt out of those communications (e.g., communications regarding our Services or updates to our Terms or this Privacy Policy).We process requests to be placed on do-not-mail, do-not-phone, and do-not-contact lists as required by applicable law.
* **Text Messages**. You may opt out of receiving text messages from us by following the instructions in the text message you have received from us or by otherwise contacting us.
* **Mobile Devices**. We may send you push notifications through our mobile application. You may opt out from receiving these push notifications by changing the settings on your mobile device. With your consent, we may also collect precise location-based information via our mobile application. You may opt out of this collection by changing the settings on your mobile device.
* “**Do Not Track**.” Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.
* **Cookies and Interest-Based Advertising**. You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits. However, if you adjust your preferences, our Services may not work properly. Please note that cookie-based opt-outs are not effective on mobile applications. However, you may opt-out of personalized advertisements on some mobile applications by following the instructions for [**<u>Androidopen in new window</u>**](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en\&ref=docs.idemeum.com), [**<u>iOSopen in new window</u>**](https://support.apple.com/en-us/HT202074?ref=docs.idemeum.com) and [**<u>othersopen in new window</u>**](https://www.networkadvertising.org/mobile-choice/?ref=docs.idemeum.com).

The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy by visiting the [**<u>Network Advertising Initiativeopen in new window</u>**](http://www.networkadvertising.org/managing/opt_out.asp?ref=docs.idemeum.com), [**<u>the Digital Advertising Allianceopen in new window</u>**](http://www.aboutads.info/choices/?ref=docs.idemeum.com), [**<u>the European Digital Advertising Allianceopen in new window</u>**](https://www.youronlinechoices.eu/?ref=docs.idemeum.com), and [**<u>the Digital Advertising Alliance of Canadaopen in new window</u>**](https://youradchoices.ca/choices/?ref=docs.idemeum.com).

Please note you must separately opt out in each browser and on each device.

**Your Privacy Rights**. In accordance with applicable law, you may have the right to:

* **Access Personal Information** about you, including: (i) confirming whether we are processing your personal information; (ii) obtaining access to or a copy of your personal information in a structured, commonly used, and machine readable format; and (iii) receiving an electronic copy of personal information that you have provided to us, or asking us to send that information to another company in a structured, commonly used, and machine readable format (the “right of data portability”);
* **Request Correction** of your personal information where it is inaccurate or incomplete. In some cases, we may provide self-service tools that enable you to update your personal information;
* **Request Deletion** of your personal information;
* **Request Restriction of or Object to** our processing of your personal information; and
* **Withdraw your Consent** to our processing of your personal information.

If you would like to exercise any of these rights, please contact us as set forth in “[**<u>Contact Us</u>**](https://docs.idemeum.com/privacy-policy.html#_13-contact-us)” below. We will process such requests in accordance with applicable laws.

## **6. Security of Your Information**

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. We have taken appropriate safeguards to require that your personal information will remain protected and require our third-party service providers and partners to have appropriate safeguards as well. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

By using our Services or providing personal information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of our Services. If we learn of a security system’s breach, we may attempt to notify you electronically by posting a notice on our Services, by mail or by sending an email to you.

## **7. International Data Transfers**

All information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.

If we transfer personal information to countries outside the European Economic Area, we will put in place appropriate safeguards to ensure that this transfer complies with the applicable laws and regulations. For more information about these safeguards, please contact us as set forth below.

## **8. Retention of Personal Information**

We store the personal information we collect as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

## **9. Supplemental Notice for California Residents**

This Supplemental California Privacy Notice only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018 (“CCPA”).

The categories of sources from which we collect personal information and our business and commercial purposes for using personal information are set forth in “**Personal Information We Collect**” and “**How We Use Your Personal Information**” above, respectively.

“Sales” of Personal Information under the CCPA

For purposes of the CCPA, idemeum does not “sell” personal information, nor do we have actual knowledge of any “sale” of personal information of minors under 16 years of age.

**Additional Privacy Rights for California Residents**

**Non-Discrimination**. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

**Authorized Agent**. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To designate an authorized agent, please contact us as set forth in “Contact Us” below and provide written authorization signed by you and your designated agent.

**Verification**. To protect your privacy, we will take steps to verify your identity before fulfilling your request. When you make a request, we will ask you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include asking you to answer questions regarding your account and use of our Services.

If you are a California resident and would like to exercise any of your rights under the CCPA, please contact us as set forth in “**Contact Us**” below. We will process such requests in accordance with applicable laws.

## **10. Supplemental Notice for Nevada Residents**

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Information to third parties who intend to license or sell that Personal Information. Please note that we do not currently sell your Personal Information as sales are defined in Nevada Revised Statutes Chapter 603A. If you have any questions, please contact us as set forth below.

## **11. Children's Information**

The Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has uploaded personal information to our site without your consent, you may contact us as described in “[**<u>Contact Us</u>**](https://docs.idemeum.com/privacy-policy.html#_13-contact-us)” below. If we become aware that a child has provided us with personal information in violation of applicable law, we will delete any personal information we have collected, unless we have a legal obligation to keep it, and terminate the child’s account.

## **12. Other Provisions**

**Third-Party Websites/Applications**. The Services may contain links to other websites/applications and other websites/applications may reference or link to our Services. These third-party services are not controlled by us. We encourage our users to read the privacy policies of each website and application with which they interact. We do not endorse, screen or approve, and are not responsible for, the privacy practices or content of such other websites or applications. Providing personal information to third-party websites or applications is at your own risk.

**Supervisory Authority**. If you are located in the European Economic Area, Switzerland, the United Kingdom or Brazil, you have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable law.

**Changes to our Privacy Policy**. We may revise this Privacy Policy from time to time in our sole discretion. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use our Services after the new Privacy Policy takes effect.

## **13. Contact Us**

If you have any questions about our privacy practices or this Privacy Policy, or to exercise your rights as detailed in this Privacy Policy, please contact us at:

idemeum, Inc.\
830 Stewart Dr, Sunnyvale, CA 94085, suite 229\
[**<u>support@idemeum.com</u>**](mailto:support@idemeum.com)


# Run details
Source: https://docs.idemeum.com/run-details

Review the metadata details for each run.

# Review run details

Navigate to the idemeum admin portal, click `Runs` menu, and now you can click any run to open its full record. Run details page is the audit view of a single run: what was asked, what the agent planned and did, what the user approved, and what it cost.

## Header

The header shows the run's goal in the user's own words, who ran it, on which device, and when. Four cards summarize the run:

| **Card** | **Meaning** |
| :- | :- |
| **Run status** | Two signals side by side: **Ticket** (the run's verdict: Resolved, Escalated, or Failed) and **Tools** (how execution went: resolved, partial, unresolved, or cancelled). They can differ, and the difference is informative: Tools *Partial* with Ticket *Resolved* means not every step completed but the issue was still fixed. |
| **Duration** | End-to-end run time. |
| **LLM calls** | Number of model calls the run made. |
| **Cost** | LLM cost of the run, computed from actual token usage. |

## Overview tab

The at-a-glance story of the run.

<img alt="Clean Shot 2026 07 15 At 13 54 10@2x" />

* **Skill matched** — which playbook handled the request, linked to its skill page. Triage runs show Triage instead.
* **AI agent summary** — the plain-language account of what happened: what was found, what the user chose, what changed, and what was handed off. This is the same summary the employee saw, so support and the user are always looking at the same story.
* **Tool counts** — total tool steps, and how they ended: **Approved** (ran), **Denied** (stopped, by the user or by a guardrail), **Skipped** (not needed for this run).

## Tool activity tab

The step-by-step execution record, in order. Read this tab when you need to verify exactly what touched the device, or to understand why a run's Tools signal is *partial*: the denied and failed steps are highlighted with their reasons.

<img alt="Clean Shot 2026 07 15 At 13 59 03@2x" />

Each entry shows:

* **Tool name and status** — Approved or Denied, color-coded.
* **What it was doing** — the step's rationale in plain language ("Scanning your home directory to identify which top-level folders are using the most space").
* **Why, if denied** — the exact denial reason. A step can be denied by the user at a consent gate or blocked by a guardrail; the reason line always says which and why. In the example above, `disk_scan` was blocked by the scope guardrail because the requested path was outside the user's home directory — the run continued safely with other diagnostics.
* **View tool output** — the raw result the tool returned (paths, sizes, counts), expandable per step. This is the evidence behind the summary's claims.

## Context tab

Everything about where and how the run executed:

<img alt="Clean Shot 2026 07 15 At 14 00 13@2x" />

| **Section** | **Fields** |
| :- | :- |
| **Identifiers** | Session ID and Agent ID, copyable — use these when correlating with logs or support requests. |
| **Device context** | Hostname, OS version, platform, user type (standard or admin), MDM enrollment. Captured at run time, so it reflects the machine as it was during the run. |
| **LLM & source** | How the run started (user, quick action, chat, or proactive), which provider and model served it, and token usage: input, output, and cached tokens. Cached tokens are billed at a fraction of input price, which is why cost stays low on long runs. |


# Security
Source: https://docs.idemeum.com/security/security-overview



## Compliance

Idemeum is SOC2 Type 2 certified. Monitored by Vanta.

<img alt="Soc" title="Soc" />

## Endpoint Control security

| Security control | Description |
| - | - |
| Logins with MFA | Every login is multi-factor, using the combination of biometrics and certificates. |
| FIDO2 protocol | Idemeum mobile app implements MFA based on modern [FIDO2 standards](https://fidoalliance.org/fido2/?ref=docs.idemeum.com). |
| Distributed storage | Sensitive data, such as break-glass credentials, can be accessed offline on mobile and can be pushed to external systems. |
| Device recovery | When encryption keys are lost, recovery can be performed using the emergency key, or with approval by other technicians. |
| Device compliance checks | Validate the compliance of devices using Android and iOS built-in security and signing certificates before granting access to idemeum portal. |
| Multiple encryption layers | Transmitted data is encrypted multiple times, authenticated by both transport layer security (TLS) and the user-managed transit symmetric and asymmetric cryptography keys. |
| Hardware backed storage | Mobile crypto keys are stored leveraging [Strongbox](https://developer.android.com/privacy-and-security/keystore?ref=docs.idemeum.com) or [iOS security enclave](https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web?ref=docs.idemeum.com) on Android and iOS. |
| API key encryption | Even when enabling API integrations to perform automated actions on vault data, all encryption is performed with security API key that is not persisted in the cloud. |
| Data security | Idemeum is designed with end-to-end encryption (E2EE) principles. What that means is that when the desktop agent is installed, the encryption key is passed and kept on the desktop. All sensitive information is encrypted with that key, before it goes to the idemeum cloud. Idemeum team is not able to see information such as passwords and sensitive credentials. Even if idemeum cloud is compromised, the sensitive information will not be exposed. |


# Skill updates
Source: https://docs.idemeum.com/skill-updates

How endpoint care skills are updated for agents.

# How are skills updated?

Skills are updated from the cloud automatically. When an admin publishes, changes, or disables a skill in the console, each agent picks up the change on its regular check cycle, about every `10 minutes`. Updates are downloaded over HTTPS, verified for integrity and correct structure, and applied at the agent's next idle moment, never during an active run. If the cloud is unreachable, agents simply keep working with their current skills and update on the next successful check.


# Skills overview
Source: https://docs.idemeum.com/skills-overview

Overview of AI support agent skills.



# Support
Source: https://docs.idemeum.com/support



## Contact us

<Columns>
  <Column>
    <Card title="Email us" icon="at" href="mailto:support@idemeum.com">
      Email [support@idemeum.com](mailto:support@idemeum.com)
    </Card>
  </Column>

  <Column>
    <Card title="Discord server" icon="discord" href="http://link.idemeum.com/discord">
      Join our community chat
    </Card>
  </Column>
</Columns>

<Note>
  Standard support is available between **9am-5pm PT**, Monday-Friday, excluding US holidays.
</Note>

## Support SLA

| Severity | Response | Definition | Example |
| - | - | - | - |
| `Critical` | 4 business hours | Complete outage where majority of customers is impacted | Idemeum cloud is down |
| `High` | 1 business day | Downgrade of services or performance is degraded | Some users can not login with JIT accounts |
| `Normal` | 2 business days | Some feature is not functioning as expected | User can not request account from extension |
| `Low` | 4 business days | Single user problem or info request | A user can not recover mobile identity with a mobile device |


# Support agent overview
Source: https://docs.idemeum.com/support-agent-overview

Resolution engine for Endpoint Care.

# What is support agent?

The Support agent is the resolution engine of Endpoint Care: it takes an employee's problem in plain language and fixes it autonomously on the device, with a guardrail on every action.

## **How it works**

1. The employee describes the problem in the app, or clicks a quick action ("Fix Email", "Clean Disk").
2. The agent matches the request to a `skill`, the playbook for that problem type.
3. It builds an ordered plan of tool calls and passes it through the `guardrails`: intent screening, allowed-tools validation, central policy.
4. Steps execute one at a time on the device. Diagnostics are read-only; risky steps pause for a preview and the user's consent.
5. The agent verifies the outcome, asks the user to confirm, and records the whole run as a ticket with the full trail.

Every run is visible in the console with its plan, per-step results, gate decisions, and cost. See `Runs`.

## **What makes it different**

* **It sees the real machine.** Diagnostics read live system state: processes, disk, network, mail configuration. Not a guess from a ticket.
* **It reasons, within playbooks.** The LLM adapts the fix to the specific situation, but only inside expert-written skills and only through deterministic, code-reviewed tools.
* **The user stays in control.** Nothing risky happens without a preview and consent, and declining never breaks the run.

## **When it can't fix something**

The Support agent never dead-ends. If the fix is out of reach (server-side cause, missing permission, declined consent), it packages what it found and hands off: the run escalates with the diagnostic trail attached, and the Triage agent flow ensures it reaches the right team.


# Terms of service
Source: https://docs.idemeum.com/terms-of-service

Idemeum terms of service document. 

***Last Updated: 9/5/2021***

Please read these Terms of Service (the “**Terms**”) and our Privacy Policy (“**Privacy Policy**”) carefully because they govern your use of the website located at [**<u>https://idemeum.com</u>**](https://idemeum.com) (the “**Site**”) and Passwordless Application Management Platform services accessible via the Site and corresponding mobile application (“**App**”) offered by idemeum, Inc. (“Idemeum”). To make these Terms easier to read, the Site, our services and App are collectively called the “**Services**.”

**IMPORTANT NOTICE REGARDING ARBITRATION FOR U.S. CUSTOMERS: WHEN YOU AGREE TO THESE TERMS YOU ARE AGREEING (WITH LIMITED EXCEPTION) TO RESOLVE ANY DISPUTE BETWEEN YOU AND IDEMEUM THROUGH BINDING, INDIVIDUAL ARBITRATION RATHER THAN IN COURT. PLEASE REVIEW CAREFULLY SECTION 15 “DISPUTE RESOLUTION” BELOW FOR DETAILS REGARDING ARBITRATION.**

1. **Agreement to Terms**. By using our Services, you agree to be bound by these Terms. If you don’t agree to be bound by these Terms, do not use the Services.
2. **Privacy Policy**. Please review our Privacy Policy, which also governs your use of the Services, for information on how we collect, use and share your information.
3. **Changes to these Terms or the Services**. We may update the Terms from time to time in our sole discretion. If we do, we’ll let you know by posting the updated Terms on the Site, to the App and/or may also send other communications. It’s important that you review the Terms whenever we update them or you use the Services. If you continue to use the Services after we have posted updated Terms it means that you accept and agree to the changes. If you don’t agree to be bound by the changes, you may not use the Services anymore. Because our Services are evolving over time we may change or discontinue all or any part of the Services, at any time and without notice, at our sole discretion.
4. **Who May Use the Services?** You may use the Services only if you are 18 years or older and capable of forming a binding contract with Idemeum, and not otherwise barred from using the Services under applicable law. For certain features of the Services you’ll need an account. It’s important that you provide us with accurate, complete and current account information and keep this information up to date. If you don’t, we might have to suspend or terminate your account. To protect your account, keep the account details and password confidential, and notify us right away of any unauthorized use. You’re responsible for all activities that occur under your account.
5. **Feedback**. We appreciate feedback, comments, ideas, proposals and suggestions for improvements to the Services (“**Feedback**”). If you choose to submit Feedback, you agree that we are free to use it without any restriction or compensation to you.

### **Intellectual Property.**

a. **Your Data**. With respect to the content, data or other materials you upload via the functionality of the Services (collectively, “**User Data**”), you represent and warrant that you own all right, title and interest in and to such User Data, including, without limitation, all copyrights and rights of publicity contained therein. By uploading any User Data you hereby grant and will grant us a nonexclusive, worldwide, royalty free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, store, modify and otherwise use your User Data in connection with the operation of the Services in any form, medium or technology now known or later developed.

b. **Idemeum’s Intellectual Property**. We may make available through the Services content that is subject to intellectual property rights. We retain all rights to that content.

### **Rights and Terms for Apps.**

a. **App License**. If you comply with these Terms, Idemeum grants to you a limited non-exclusive, non-transferable license, with no right to sublicense, to download and install the App on your personal computers, mobile handsets, tablets, wearable devices, and/or other devices and to run the App solely for your own personal non-commercial purposes. Except as expressly permitted in these Terms, you may not: (i) copy, modify or create derivative works based on the App; (ii) distribute, transfer, sublicense, lease, lend or rent the App to any third party; (iii) reverse engineer, decompile or disassemble the App (unless applicable law permits, despite this limitation); or (iv) make the functionality of the App available to multiple users through any means.

b. **Additional Information**: Apple App Store. This Section 7(b) applies to any App that you acquire from the Apple App Store or use on an iOS device. Apple has no obligation to furnish any maintenance and support services with respect to the App. In the event of any failure of the App to conform to any applicable warranty, you may notify Apple, and Apple will refund the App purchase price to you (if applicable) and, to the maximum extent permitted by applicable law, Apple will have no other warranty obligation whatsoever with respect to the App. Apple is not responsible for addressing any claims by you or any third party relating to the App or your possession and use of it, including, but not limited to: (i) product liability claims; (ii) any claim that the App fails to conform to any applicable legal or regulatory requirement; and (iii) claims arising under consumer protection or similar legislation. Apple is not responsible for the investigation, defense, settlement and discharge of any third-party claim that your possession and use of the App infringe that third party’s intellectual property rights. Apple and its subsidiaries, are third-party beneficiaries of these Terms, and upon your acceptance of the Terms, Apple will have the right (and will be deemed to have accepted the right) to enforce these Terms against you as a third-party beneficiary thereof. You represent and warrant that (i) you are not located in a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a terrorist-supporting country; and (ii) you are not listed on any U.S. Government list of prohibited or restricted parties. You must also comply with any applicable third-party terms of service when using the App.

**General Prohibitions and Idemeum’s Enforcement Rights**. You agree not to do any of the following:

a. Post, upload, publish, submit or transmit any User Data that: (i) infringes, misappropriates or violates a third party’s patent, copyright, trademark, trade secret, moral rights or other intellectual property rights, or rights of publicity or privacy; (ii) violates, or encourages any conduct that would violate, any applicable law or regulation or would give rise to civil liability; (iii) is fraudulent, false, misleading or deceptive; (iv) is defamatory, obscene, pornographic, vulgar or offensive; (v) promotes discrimination, bigotry, racism, hatred, harassment or harm against any individual or group; (vi) is violent or threatening or promotes violence or actions that are threatening to any person or entity; or (vii) promotes illegal or harmful activities or substances;

b. Use, display, mirror or frame the Services or any individual element within the Services, Idemeum’s name, any Idemeum trademark, logo or other proprietary information, or the layout and design of any page or form contained on a page, without Idemeum’s express written consent;

c. Access, tamper with, or use non-public areas of the Services, Idemeum’s computer systems, or the technical delivery systems of Idemeum’s providers;

d. Attempt to probe, scan or test the vulnerability of any Idemeum system or network or breach any security or authentication measures;

e. Avoid, bypass, remove, deactivate, impair, descramble or otherwise circumvent any technological measure implemented by Idemeum or any of Idemeum’s providers or any other third party (including another user) to protect the Services;

f. Attempt to access or search the Services or download content from the Services using any engine, software, tool, agent, device or mechanism (including spiders, robots, crawlers, data mining tools or the like) other than the software and/or search agents provided by Idemeum or other generally available third-party web browsers;

g. Send any unsolicited or unauthorized advertising, promotional materials, email, junk mail, spam, chain letters or other form of solicitation;

h. Use any meta tags or other hidden text or metadata utilizing a Idemeum trademark, logo URL or product name without Idemeum’s express written consent;

i. Use the Services, or any portion thereof, for any commercial purpose or for the benefit of any third party or in any manner not permitted by these Terms;

j. Forge any TCP/IP packet header or any part of the header information in any email or newsgroup posting, or in any way use the Services to send altered, deceptive or false source-identifying information;

k. Attempt to decipher, decompile, disassemble or reverse engineer any of the software used to provide the Services;

l. Interfere with, or attempt to interfere with, the access of any user, host or network, including, without limitation, sending a virus, overloading, flooding, spamming, or mail-bombing the Services;

m. Collect or store any personally identifiable information from the Services from other users of the Services without their express permission;

n. Impersonate or misrepresent your affiliation with any person or entity;

o. Violate any applicable law or regulation; or

p. Encourage or enable any other individual to do any of the foregoing.

Idemeum is not obligated to monitor access to or use of the Services or to review or edit any content. However, we have the right to do so for the purpose of operating the Services, to ensure compliance with these Terms and to comply with applicable law or other legal requirements. We reserve the right, but are not obligated, to remove or disable access to any content, including User Data, at any time and without notice, including, but not limited to, if we, at our sole discretion, consider it objectionable or in violation of these Terms. We have the right to investigate violations of these Terms or conduct that affects the Services. We may also consult and cooperate with law enforcement authorities to prosecute users who violate the law.

1. **Links to Third Party Websites or Resources**. The Services (including the App) may allow you to access third-party websites or other resources. We provide access only as a convenience and are not responsible for the content, products or services on or available from those resources or links displayed on such websites. You acknowledge sole responsibility for and assume all risk arising from, your use of any third-party resources.
2. **Termination**. We may suspend or terminate your access to and use of the Services, including suspending access to or terminating your account, at our sole discretion, at any time and without notice to you. You may cancel your account at any time by sending us an email at [**<u>support@idemeum.com</u>**](mailto:support@idemeum.com). Upon any termination, discontinuation or cancellation of the Services or your account, the following Sections will survive: 6(a), 6(b), 8, 10, 11, 12, 13, 14, 15 and 16.
3. **Warranty Disclaimers**. THE SERVICES ARE PROVIDED “AS IS,” WITHOUT WARRANTY OF ANY KIND. WITHOUT LIMITING THE FOREGOING, WE EXPLICITLY DISCLAIM ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT AND NON-INFRINGEMENT, AND ANY WARRANTIES ARISING OUT OF COURSE OF DEALING OR USAGE OF TRADE. We make no warranty that the Services will meet your requirements or be available on an uninterrupted, secure, or error-free basis. We make no warranty regarding the quality, accuracy, timeliness, truthfulness, completeness or reliability of any information or content on the Services.
4. **Indemnity**. You will indemnify and hold Idemeum and its officers, directors, employees and agents, harmless from and against any claims, disputes, demands, liabilities, damages, losses, and costs and expenses, including, without limitation, reasonable legal and accounting fees arising out of or in any way connected with (a) your access to or use of the Services, (b) your User Data, or (c) your violation of these Terms.

### **Limitation of Liability.**

a . TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER IDEMEUM NOR ITS SERVICE PROVIDERS INVOLVED IN CREATING, PRODUCING, OR DELIVERING THE SERVICES WILL BE LIABLE FOR ANY INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES, OR DAMAGES FOR LOST PROFITS, LOST REVENUES, LOST SAVINGS, LOST BUSINESS OPPORTUNITY, LOSS OF DATA OR GOODWILL, SERVICE INTERRUPTION, COMPUTER DAMAGE OR SYSTEM FAILURE OR THE COST OF SUBSTITUTE SERVICES OF ANY KIND ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR FROM THE USE OF OR INABILITY TO USE THE SERVICES, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT IDEMEUM OR ITS SERVICE PROVIDERS HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE, EVEN IF A LIMITED REMEDY SET FORTH HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.

b. TO THE MAXIMUM EXTENT PERMITTED BY THE LAW OF THE APPLICABLE JURISDICTION, IN NO EVENT WILL IDEMEUM’S TOTAL LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OR FROM THE USE OF OR INABILITY TO USE THE SERVICES EXCEED THE AMOUNTS YOU HAVE PAID OR ARE PAYABLE BY YOU TO IDEMEUM FOR USE OF THE SERVICES OR ONE HUNDRED DOLLARS (\$100), IF YOU HAVE NOT HAD ANY PAYMENT OBLIGATIONS TO IDEMEUM, AS APPLICABLE.

c. THE EXCLUSIONS AND LIMITATIONS OF DAMAGES SET FORTH ABOVE ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN IDEMEUM AND YOU.

1. **Governing Law and Forum Choice**. These Terms and any action related thereto will be governed by the Federal Arbitration Act, federal arbitration law, and the laws of the State of California, without regard to its conflict of laws provisions. Except as otherwise expressly set forth in Section 15 “Dispute Resolution,” the exclusive jurisdiction for all Disputes (defined below) that you and Idemeum are not required to arbitrate will be the state and federal courts located in the San Francisco County, and you and Idemeum each waive any objection to jurisdiction and venue in such courts.

### **Dispute Resolution.**

a. **Mandatory Arbitration of Disputes**. We each agree that any dispute, claim or controversy arising out of or relating to these Terms or the breach, termination, enforcement, interpretation or validity thereof or the use of the Services (collectively, “**Disputes**”) will be resolved **solely by binding, individual arbitration and not in a class, representative or consolidated action or proceeding**. You and Idemeum agree that the U.S. Federal Arbitration Act governs the interpretation and enforcement of these Terms, and that you and Idemeum are each waiving the right to a trial by jury or to participate in a class action. This arbitration provision shall survive termination of these Terms.

b. **Exceptions**. As limited exceptions to Section 15(a) above: (i) we both may seek to resolve a Dispute in small claims court if it qualifies; and (ii) we each retain the right to seek injunctive or other equitable relief from a court to prevent (or enjoin) the infringement or misappropriation of our intellectual property rights.

c. **Conducting Arbitration and Arbitration Rules**. The arbitration will be conducted by the American Arbitration Association (“**AAA**”) under its Consumer Arbitration Rules (the “**AAA Rules**”) then in effect, except as modified by these Terms. The AAA Rules are available at [**<u>www.adr.orgopen in new window</u>**](http://www.adr.org/?ref=docs.idemeum.com) or by calling 1-800-778-7879. A party who wishes to start arbitration must submit a written Demand for Arbitration to AAA and give notice to the other party as specified in the AAA Rules. The AAA provides a form Demand for Arbitration at [**<u>www.adr.orgopen in new window</u>**](http://www.adr.org/aaa/ShowPDF?doc=ADRSTG_004175\&ref=docs.idemeum.com).

Any arbitration hearings will take place in the county (or parish) where you live, unless we both agree to a different location. The parties agree that the arbitrator shall have exclusive authority to decide all issues relating to the interpretation, applicability, enforceability and scope of this arbitration agreement.

d. **Arbitration Costs**. Payment of all filing, administration and arbitrator fees will be governed by the AAA Rules, and we won’t seek to recover the administration and arbitrator fees we are responsible for paying, unless the arbitrator finds your Dispute frivolous. If we prevail in arbitration we’ll pay all of our attorneys’ fees and costs and won’t seek to recover them from you. If you prevail in arbitration you will be entitled to an award of attorneys’ fees and expenses to the extent provided under applicable law.

e. **Injunctive and Declaratory Relief**. Except as provided in Section 15(b) above, the arbitrator shall determine all issues of liability on the merits of any claim asserted by either party and may award declaratory or injunctive relief only in favor of the individual party seeking relief and only to the extent necessary to provide relief warranted by that party’s individual claim. To the extent that you or we prevail on a claim and seek public injunctive relief (that is, injunctive relief that has the primary purpose and effect of prohibiting unlawful acts that threaten future injury to the public), the entitlement to and extent of such relief must be litigated in a civil court of competent jurisdiction and not in arbitration. The parties agree that litigation of any issues of public injunctive relief shall be stayed pending the outcome of the merits of any individual claims in arbitration.

f. **Class Action Waiver**. **YOU AND** Idemeum **AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY, AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING**. Further, if the parties’ Dispute is resolved through arbitration, the arbitrator may not consolidate another person’s claims with your claims, and may not otherwise preside over any form of a representative or class proceeding. If this specific provision is found to be unenforceable, then the entirety of this Dispute Resolution section shall be null and void.

g. **Severability**. With the exception of any of the provisions in Section 15(f) of these Terms (“Class Action Waiver”), if an arbitrator or court of competent jurisdiction decides that any part of these Terms is invalid or unenforceable, the other parts of these Terms will still apply.

### **General Terms.**

a. **Reservation of Rights**. Idemeum and its licensors exclusively own all right, title and interest in and to the Services, including all associated intellectual property rights. You acknowledge that the Services are protected by copyright, trademark, and other laws of the United States and foreign countries. You agree not to remove, alter or obscure any copyright, trademark, service mark or other proprietary rights notices incorporated in or accompanying the Services.

b. **Entire Agreement**. These Terms constitute the entire and exclusive understanding and agreement between Idemeum and you regarding the Services, and these Terms supersede and replace all prior oral or written understandings or agreements between Idemeum and you regarding the Services. If any provision of these Terms is held invalid or unenforceable by an arbitrator or a court of competent jurisdiction, that provision will be enforced to the maximum extent permissible and the other provisions of these Terms will remain in full force and effect. You may not assign or transfer these Terms, by operation of law or otherwise, without Idemeum’s prior written consent. Any attempt by you to assign or transfer these Terms, without such consent, will be null. Idemeum may freely assign or transfer these Terms without restriction. Subject to the foregoing, these Terms will bind and inure to the benefit of the parties, their successors and permitted assigns.

c. **Notices**. Any notices or other communications provided by Idemeum under these Terms will be given: (i) via email; or (ii) by posting to the Services. For notices made by email, the date of receipt will be deemed the date on which such notice is transmitted.

d. **Waiver of Rights**. Idemeum’s failure to enforce any right or provision of these Terms will not be considered a waiver of such right or provision. The waiver of any such right or provision will be effective only if in writing and signed by a duly authorized representative of Idemeum. Except as expressly set forth in these Terms, the exercise by either party of any of its remedies under these Terms will be without prejudice to its other remedies under these Terms or otherwise.

**Contact Information**. If you have any questions about these Terms or the Services, please contact Idemeum at [**<u>support@idemeum.com</u>**](mailto:support@idemeum.com).


# Tools overview
Source: https://docs.idemeum.com/tools-overview

Deterministic, code-reviewed functions that perform support actions.

# What are tools?

Tools are the hands of Endpoint Care: deterministic, code-reviewed functions that perform one action each on the device. Scanning a disk, listing processes, flushing a DNS cache, repairing a keychain, reconnecting a VPN. Everything the agent does on a machine, it does through a tool.

The division of labor is strict. `Skills` decide *what* to do and *when*; tools do the actual work. The AI chooses which tool to call and with what parameters, but it cannot write commands, compose scripts, or act outside the tool set. A tool does the same thing, the same way, every time it runs.

Two conventions worth knowing:

* **Read-only counterparts.** Destructive tools ship alongside read-only siblings (`get_*_info`, `get_*_size`) that report the same diagnostics without changing anything, so skills can diagnose freely and only reach for a mutating tool when a fix is actually needed.
* **Interaction gates are tools too.** The pauses where the agent asks the user something (confirm, choose, fill a short form) are implemented as tools, which means they appear in plans, pass through the same validation, and show up in the audit trail like every other step.

The full library, with each tool's source and metadata, is published at [**github.com/idemeum/skills**](https://github.com/idemeum/skills).

# Tool metadata

Each tool carries metadata that the `guardrails` enforce automatically:

| **Property** | **What it declares** |
| :- | :- |
| **Risk level** | low, medium, or high; drives how strongly the step is gated |
| **Destructive** | whether it changes or removes anything |
| **Requires consent** | whether the user must approve before it runs |
| **Supports preview** | whether it can show exactly what would change before changing it |
| **Scope** | what it may touch (the user's own account, network settings, system) |
| **Audited** | whether its execution is recorded in the audit trail |

For example, `kill_process` is medium risk, destructive, preview-capable, and consent-required, so every plan that includes it automatically pauses for a preview and the user's approval. A skill author cannot forget to add the gate and the model cannot skip it; the tool's own metadata forces it.

Tool inputs are validated against a strict schema before execution, and protected targets (system-critical processes, paths outside the user's scope) are refused by the tool itself, whatever the plan says.

# Why deterministic tools?

Many AI agents act by generating a script and running it. We deliberately don't, and the difference is:

* **Reviewable once, trusted always -** every tool is code-reviewed and tested before it ships. A generated script is new, unreviewed code every single time.
* **No path from prompt to shell -** because the model's entire vocabulary is the tool list, a manipulated or hallucinating model still cannot produce arbitrary execution. With script generation, prompt injection is code injection.
* **Gating you can automate -** risk metadata only means something when the action is known in advance. You cannot pre-declare the blast radius of code that didn't exist a second ago.
* **Same input, same result -** deterministic tools make runs reproducible, debuggable, and honestly auditable: the audit trail names exactly what ran, not a blob of one-off script to reverse-engineer.
* **Predictable failure -** tools fail with structured, expected errors that skills know how to handle, instead of a stack trace from novel code.


# Triage agent overview
Source: https://docs.idemeum.com/triage-agent-overview

Categorize and properly route user issues that do not match any skills.

# What is triage agent?

The Triage agent is the guaranteed floor of Endpoint Care: when no skill can resolve a request, the issue is still understood, classified, diagnosed, and delivered to IT as a structured, evidence-rich ticket. No request is turned away.

Under the hood, triage is itself a `skill` — the same format, the same guardrails, entirely read-only (it observes and documents; it never changes the device).

# When it activates

Triage is deliberately never matched by phrasing; it's the fallback, not a competitor to the resolution skills.

* **Automatically**, when the agent can't match the request to any resolution skill after asking its clarifying questions.
* **Directly**, when the employee clicks the **Report Issue** quick action to file something with IT.

# How triage run works

1. **The agent classifies the request.** From the conversation, it extracts a category, urgency, a technician-ready summary, the affected system, and the symptoms.
2. **The employee reviews an intake form** pre-filled with those fields. Everything is editable except the category, which is set by the agent's classification (the next step depends on it). No twenty-field questionnaire; the agent did the filling, the user just corrects.
3. **A category-specific diagnostic runs** — one read-only check matched to the problem type: connectivity for Network, installed apps for Software, mail configuration for Email, top resource consumers for Performance, and so on.
4. **The ticket is created and routed**, carrying the structured fields, the diagnostic result, and the conversation. The employee sees what was found and what happens next.

# Updating triage skill

Our default triage skill is located [here](https://github.com/idemeum/skills/blob/main/triage/SKILL.md).

If you need to edit the skill, simply change the .md file, upload it to idemeum portal, and make sure the name is `triage`. As a result the updated skill will replace the default triage skill.


# Uninstall care agent
Source: https://docs.idemeum.com/uninstall-care-agent

Uninstall idemeum care agent.



# Demote / disable / delete user
Source: https://docs.idemeum.com/user-management/disable-demote-delete-user

Remove permissions from admin users or completely delete user records from idemeum cloud.

## Demote user

To `demote` a user means to remove full admin rights or remove delegation to customer tenants (MSP setup). We do not support `demote` operation, so please proceed with disabling user instead.

## Disable user

To `disable` a user means to temporarily block access to all resources. User access will be revoked, but the user record will still be kept in the cloud, so that you can re-enable it back or delete it later.

* Access you idemeum admin portal (or MSP parent tenant in case of MSP setup)
* Navigate to `Users` → `User management`
* Select the user you want to disable → click on `...` and choose `Disable`

The user will transition into a `disabled` state, all access will be blocked.

<Note>
  If you want to demote the user simply `disable` and then `enable` the user back. This way admin rights or delegated tenant access will be revoked. Once the user is re-enabled, she needs to login to the portal so that you can then promote back to admin or restore certain delegated access.
</Note>

## Delete user

To `delete` a user means to cut all access and permanently remove the record from the cloud. You first need to `disable` the user and then `delete`.

* Access you idemeum admin portal (or MSP parent tenant in case of MSP setup)
* Navigate to `Users` → `User management`
* Click on `...` and then choose `Disable user`
* Click on `...` and choose `Delete user` to permanently remove the user record


# Mobile app recovery
Source: https://docs.idemeum.com/user-management/mobile-app-recovery

When you reinstall idemeum app, you need to follow recovery process.

## How mobile app recovery works

Your idemeum mobile application is the key to idemeum platform - it has the crypto keys that represent your identity and are used to decrypt all the passwords and sensitive information that you see. When you need to reinstall idemeum app, you need to follow the recovery process.

There are two ways you can recover:

<AccordionGroup>
  <Accordion title="Approval recovery" icon="badge-check">
    This process applies when there are multiple admins onboarded into your idemeum tenant. When you initiate the recovery, another admin will need to login into idemeum portal and approve your request.
  </Accordion>

  <Accordion title="Emergency QR-code recovery" icon="qrcode">
    This process applies when there is only one admin user in idemeum tenant. When you get promoted to admin, we will send the email to you containing your emergency recovery code. You will need to use this emergency QR-code to recover from a new device.
  </Accordion>
</AccordionGroup>

## Approval recovery

Let's follow the process of how this recovery will work, it applies when there are `multiple admins` in the idemeum tenant:

1. You get the new mobile phone and install new instance of idemeum mobile app
2. You need to verify the same email address as you did before

<Warning>
  It is important to verify the same email address or mobile phone as previously. Otherwise you will get the error message `Employee is not found in the company directory.`
</Warning>

3. You navigate to you idemeum tenant URL (i.e. `it.idemeum.com`) and scan the login QR-code with your idemeum application
4. Idemeum portal will check how many admins there are in the system, and if there are multiple, it will automatically initiate the `approval recovery` process and you will get the message that recovery request is initiated.
5. Now another admin will need to login to idemeum cloud portal, navigate to `Users` → `User management` find your user record, click on `...` and choose `Approve recovery`
6. You are all set and can login into the idemeum tenant now

## Emergency QR-code recovery

Let's follow the process of how this recovery will work, it only applies when there is a `single admin` in the idemeum tenant:

1. You get the new mobile phone and install new instance of idemeum mobile app
2. You need to verify the same email address

<Warning>
  It is important to verify the same email address or mobile phone as previously. Otherwise you will get the error message `Employee is not found in the company directory.`
</Warning>

3. You navigate to you idemeum tenant URL (i.e. `msp.idemeum.com`) and scan the login QR-code with your idemeum application
4. Idemeum portal will check how many admins there are in the system, and if there is only one admin, it will automatically initiate the `emergency QR-code approval`
5. In the mobile application you will be prompted to scan the emergency QR-code. You can find this emergency QR-code in your email (we automatically send it to every admin)

<img alt="Emergency" />

6. Scan this QR-code in your email with idemeum mobile application
7. You are all set and can now login to your idemeum portal


# User groups
Source: https://docs.idemeum.com/user-management/user-groups

Add idemeum admins to user groups.

## What are user groups for?

You can create user groups in idemeum and add technicians to those groups. Groups are helpful when you need to perform customer tenant delegation in bulk, control what groups of users have access to LAPS credentials, etc.

## Create user group

* Login to your idemeum admin portal (MSP parent tenant in case on MSP setup)
* Navigate to `Users` → `Groups`
* Click `Add group`
* Provide a group name and then choose the users that should be assigned to a group
* Save the configuration

<img alt="Clean Shot 2026 05 26 At 15 56 05@2x" />


# User onboarding
Source: https://docs.idemeum.com/user-management/user-onboarding

Add new admin users to your idemeum portal.

## How user onboarding works

With idemeum every new admin user is onboarded with a mobile app. Think about the mobile app as a hardware key - it is used to authenticate a user with MFA and handle all encryption / decryption with a key that resides in the mobile app.

## Add new admin user

<Steps>
  <Step title="Add new user record in admin portal">
    * Access your idemeum admin portal (in case of MSP tenant this is an MSP parent portal)
    * Navigate to `Users` → `User management` and then click `Add user`
    * All you need to do is to provide `First name`, `Last name`, and the `Email address`
    * Save new user record

    <Note>
      Now the user is in the `invited` state. User will receive a welcome email to the specified email address.
    </Note>

    <img alt="Clean Shot 2026 05 21 At 15 59 42@2x" />
  </Step>

  <Step title="User installs idemeum mobile app">
    Now new user downloads idemeum mobile app from Play Store or App Store, installs the app and verifies the same email address in the mobile application.
  </Step>

  <Step title="User scans the QR code at the idemeum portal">
    User navigates to your idemeum cloud portal URL, scans the QR-code with idemeum mobile application, and approves login with biometrics.
  </Step>

  <Step title="Promote user to administrator">
    You can now promote user to administrator by locating the user record in the portal, clicking on `...` and choosing `Make admin`. Optionally you can delegate access only to certain customer tenants (MSP delegation feature). 
  </Step>
</Steps>

## Delete or disable admin user

All you need to do to remove user access to idemeum is to disable or delete user.

* `Disable user` - block access but keep user record in the cloud.
* `Delete user` - remove user record from the cloud. You need to disable the user before deleting.

To proceed with deletion follow the steps below:

<script />

<script />


# User source
Source: https://docs.idemeum.com/user-management/user-source

Configure external user source for mobile admin onboarding.

## What is external user source

<Warning>
  External user source does NOT sync users to idemeum. idemeum uses external source to simply verify emails for onboarding. Please do not use external user source if you have fewer than 30-50 admins. It is much simpler to use local user directory.
</Warning>

Instead of manually creating admin users in idemeum, you can configure the external user source (O365 and Google Workspace). When users install idemeum mobile application and verify company email address, then they scan the QR-code to login, idemeum looks up the email in the external user source (instead of doing local lookup). If the email exists, then user is onboarded and the local record is created.

## Configure external user source

It is possible to change the user source only when you have one user record in idemeum. Navigate to `Users` → `User source` , then change the user source from local to your desired integration and set up the connection.