Microsoft Intune

Intune Remediations runs the installer daily, so devices stay onboarded and re-apply if their setup drifts.

Before you begin

Remediations needs Windows Enterprise E3/E5, Education A3/A5, or Windows VDA per user. Without one, use the scheduled task below.
Push Python 3 as a Win32 app first, with InstallAllUsers=1 PrependPath=1 Include_launcher=1.
Allow HTTPS to getunbound.ai, backend.getunbound.ai, api.getunbound.ai, raw.githubusercontent.com and github.com.

1. Get your API key

Sign in to Unbound as an admin and open Configure. Under Choose scope select My org (MDM), then under Run the install command select the Windows tab and copy the command. Your key is the value after -ApiKey. It is masked on screen and copied in full. If your command also carries -BackendUrl, -GatewayUrl or -FrontendUrl (a dedicated deployment), add the same switches after -ApiKey in both scripts below. Drop -Backfill if Seed events from past activity is off in Configure.

2. Save the two scripts

Detect_Unbound.ps1 — tells Intune whether the device needs a run:

$base = 'C:\Program Files\Unbound'
$marker = Join-Path $base 'last-success.txt'
$owned = (Test-Path $marker) -and
    ((Get-Acl $base).GetOwner([Security.Principal.SecurityIdentifier]).Value -in @('S-1-5-18', 'S-1-5-32-544'))
if ($owned -and ((Get-Date) - (Get-Item $marker).LastWriteTime).TotalHours -lt 20) {
    Write-Output "Unbound: ran $((Get-Item $marker).LastWriteTime)"; exit 0
}
Write-Output "Unbound: needs a run"; exit 1

Remediate_Unbound.ps1 — runs the installer and records the result, replacing YOUR_ADMIN_API_KEY with your key:

$base = 'C:\Program Files\Unbound'
New-Item -ItemType Directory -Force -Path $base | Out-Null
icacls $base /setowner '*S-1-5-32-544' /T /C | Out-Null
icacls $base /reset /T /C | Out-Null
icacls $base /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
$acl = Get-Acl $base
$allowed = @('S-1-5-18', 'S-1-5-32-544')
if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed -or
    ($acl.Access | Where-Object {
        $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -notin $allowed })) {
    throw "Could not secure $base. Refusing to continue."
}
Remove-Item (Join-Path $base '*') -Force -Recurse -ErrorAction SilentlyContinue

$installer = Join-Path $base 'onboard.ps1'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri 'https://getunbound.ai/setup/mdm/windows/onboard' -OutFile $installer -UseBasicParsing -ErrorAction Stop

& $installer -ApiKey 'YOUR_ADMIN_API_KEY' -Backfill
$code = $LASTEXITCODE

if ($code -eq 0) {
    try { Set-Content -Path (Join-Path $base 'last-success.txt') -Value (Get-Date -Format 'o') -ErrorAction Stop }
    catch { Write-Output "Installed, but could not write the marker. $_"; $code = 1 }
}
Remove-Item $installer -Force -ErrorAction SilentlyContinue
exit $code

Replace YOUR_ADMIN_API_KEY with the key from step 1, and save both files as UTF-8 without a BOM.

3. Create the package

Devices → Manage devices → Scripts and remediations → Create script package

Basics

Name it Unbound daily onboard.

Settings

Upload both scripts. Set Run this script using the logged-on credentials: No, Enforce script signature check: No, Run script in 64-bit PowerShell: Yes — a 32-bit host redirects C:\Program Files to C:\Program Files (x86).

Assignments

Select your developer device group, then the ellipsis beside it → Edit → Schedule: Daily → Apply. Finish with Review + create.

To run it on one device now: Devices → By platform → Windows → the device → … → Run remediation (preview). Otherwise it runs at the next check-in — after a restart, after a sign-in, or within 8 hours.

4. Verify

Intune

Scripts and remediations → Unbound daily onboard → Device status shows Without issues.

Device

C:\Program Files\Unbound\last-success.txt updates daily.

Unbound

Devices appear on Settings → Devices, and show a recent Last Sync on AI Tools Discovery.

Troubleshooting

Symptom	Fix
`Python 3 is required but not found in PATH`	Re-deploy Python with `InstallAllUsers=1 PrependPath=1 Include_launcher=1`, then reboot.
`Could not download` or a `404`/`403` on `raw.githubusercontent.com`	The installer fetches its Python stage from GitHub. Allow `raw.githubusercontent.com` through your proxy, including TLS inspection.
Remediation shows Failed	Open the device under Device status and read the output. It names the step that failed.
Copilot rows show `auto`	Allow one daily cycle. Sessions VS Code has already rotated cannot be read.

Command switches

Switch	Purpose	Default
`-ApiKey <key>`	Your admin API key. Required unless `-Clear`	—
`-BackendUrl <url>`	Where setup results and scans are reported	`https://backend.getunbound.ai`
`-GatewayUrl <url>`	The AI gateway the installed tools point at	`https://api.getunbound.ai`
`-FrontendUrl <url>`	Your dashboard host, written into each user’s config	`https://gateway.getunbound.ai`
`-Backfill`	Import past Claude Code, Codex and GitHub Copilot sessions	off
`-SkipManagedSettings`	Claude Code only: install the hook, leave its managed settings to you. See Tamper Resistance	off
`-Clear`	Remove the configuration for every tool	off

No Remediations licence

A Platform script runs once per device, so deploy this script instead and let it create a daily scheduled task. Devices → Scripts and remediations → Platform scripts → Add → Windows 10 and later, with logged on credentials: No, signature check: No, 64-bit PowerShell host: Yes.

Scheduled task script

$base = 'C:\Program Files\Unbound'
New-Item -ItemType Directory -Force -Path $base | Out-Null
icacls $base /setowner '*S-1-5-32-544' /T /C | Out-Null
icacls $base /reset /T /C | Out-Null
icacls $base /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
$acl = Get-Acl $base
$allowed = @('S-1-5-18', 'S-1-5-32-544')
if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed -or
    ($acl.Access | Where-Object {
        $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -notin $allowed })) {
    throw "Could not secure $base. Refusing to write the API key."
}
Remove-Item (Join-Path $base '*') -Force -Recurse -ErrorAction SilentlyContinue
$runner = Join-Path $base 'run-unbound.ps1'

@'
$installer = 'C:\Program Files\Unbound\onboard.ps1'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri 'https://getunbound.ai/setup/mdm/windows/onboard' -OutFile $installer -UseBasicParsing -ErrorAction Stop
& $installer -ApiKey 'YOUR_ADMIN_API_KEY' -Backfill
$code = $LASTEXITCODE
if ($code -eq 0) {
    try { Set-Content -Path 'C:\Program Files\Unbound\last-success.txt' -Value (Get-Date -Format 'o') -ErrorAction Stop }
    catch { Write-Output "Installed, but could not write the marker. $_"; $code = 1 }
}
Remove-Item $installer -Force -ErrorAction SilentlyContinue
exit $code
'@ | Set-Content -Path $runner -Encoding UTF8

$action    = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$runner`""
$trigger   = New-ScheduledTaskTrigger -Daily -At 9:00am
$settings  = New-ScheduledTaskSettingsSet -StartWhenAvailable -RunOnlyIfNetworkAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Hours 5)
$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName 'Unbound Daily Onboard' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force -ErrorAction Stop | Out-Null
Start-ScheduledTask -TaskName 'Unbound Daily Onboard' -ErrorAction Stop

Confirm the Platform script’s Device status reads Success, Task Scheduler lists Unbound Daily Onboard with Last Run Result 0x0, and the device appears in Unbound.

Remove Unbound

Remove the Intune assignment first, or the next check-in reinstalls. Then, in an elevated PowerShell on the device:

Invoke-WebRequest -Uri 'https://getunbound.ai/setup/mdm/windows/onboard' -OutFile onboard.ps1 -UseBasicParsing; .\onboard.ps1 -Clear
Remove-Item 'C:\Program Files\Unbound' -Recurse -Force

If you used the scheduled task, also run:

Unregister-ScheduledTask -TaskName 'Unbound Daily Onboard' -Confirm:$false

Tamper Resistance

Keeping Unbound active on every device with managed settings.

Getting Started

CLI

Policies

Analytics

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Before you begin

1. Get your API key

2. Save the two scripts

3. Create the package

4. Verify

Intune

Device

Unbound

Troubleshooting

Command switches

No Remediations licence

Remove Unbound

Tamper Resistance

​Before you begin

​1. Get your API key

​2. Save the two scripts

​3. Create the package

​4. Verify

Intune

Device

Unbound

​Troubleshooting

​Command switches

​No Remediations licence

​Remove Unbound

Tamper Resistance

Before you begin

1. Get your API key

2. Save the two scripts

3. Create the package

4. Verify

Troubleshooting

Command switches

No Remediations licence

Remove Unbound