How to Deploy RMM Agents at Scale: Silent Install, Intune and GPO

What's in the demo

• Settings → Enrollment Keys for Lakeshore Legal: the pilot key "Pilot laptops (hand installs)" reads Exhausted at 11 / 11, and "Lakeshore trial (2025)" reads Expired
• Create Key: "Lakeshore HQ rollout", organization Lakeshore Legal, site Lakeshore HQ ("Devices enrolled with this key are assigned to this site."), Max Usage 55, expiring in two weeks. Left blank, a key allows 50 devices and lasts 30 days
• The key is shown once in a "Save this enrollment key now" banner (blurred here), copied, then the new row reads Active, 0 / 55
• Windows silent install: msiexec /i breeze-agent.msi /qn with SERVER_URL and ENROLLMENT_KEY, deployed as a Win32 app in Intune or a computer startup script in Group Policy. There is no site setting on the MSI
• Add New Device → Download Installer: site Lakeshore HQ, Windows (.msi) or Mac (.zip), 50 devices, link expires in 30 days, and Generate Link for a no-login download link. Linux goes through the CLI Commands tab
• CLI Commands: site Lakeshore HQ, 50 devices, Generate token → "Valid for 50 device enrollments", one command for Windows and one line for Linux/macOS
• Devices & Assets: the Lakeshore machines sit in site Lakeshore HQ under Lakeshore Legal
• The Usage column as rollout progress, and the default limit of 10 enrollments a minute from one public IP
• Deleting the CLI token's "Onboarding token (2026-10-22)" key: "Agents will no longer be able to enroll using this key."

Questions this video answers

How do I silently install the Breeze agent with Intune or Group Policy?

Create an enrollment key under Settings → Enrollment Keys, then run msiexec /i breeze-agent.msi /qn SERVER_URL=https://your-server ENROLLMENT_KEY=your-key. The Breeze docs (Migration → Mass Deployment) package it as a Win32 app in Intune and run it from a computer startup script in Group Policy, not a software installation policy, because the MSI enrolls during the install and needs to reach your server.

How do I make sure new devices land in the right client and site?

Every enrollment key is bound to one organization and one site, and the device lands there when it enrolls. The MSI has no site property, so make one key per site.

How many devices can one enrollment key enroll, and for how long?

You set Max Usage and Expires At when you create the key. Left blank, it allows 50 devices and expires after 30 days by default. The key's status reads Exhausted when it is used up and Expired after its date.

Can I push the Breeze agent from my old RMM?

Yes. Devices & Assets → Add → Install agent… → CLI Commands builds a one-line install for Windows or Linux/macOS with a multi-use token. It runs as SYSTEM, so any RMM or MDM script runner can push it.

Why did some machines fail to enroll during a big push?

By default Breeze accepts 10 enrollments a minute from one public IP, so an office behind one connection should push in waves of ten. Self-hosters can raise AGENT_ENROLL_RATE_LIMIT. Deleting a key afterwards only stops new enrollments; enrolled devices keep their own credentials.