How to Deploy SentinelOne Windows Agent Using Microsoft Intune (Win32)

Overview

This guide provides step-by-step instructions to deploy the SentinelOne Windows Agent using Microsoft Intune as a Win32 application. It covers the full deployment workflow — from obtaining your Site Token and creating a silent install script, to packaging the installer, uploading it to Intune, configuring detection rules, and assigning it to device groups — so the agent installs automatically on every enrolled Windows endpoint without any manual intervention.

Prerequisites

Ensure all of the following are in place before starting. Missing any of these will cause the deployment to fail partway through.

• Microsoft Intune Administrator access

• Windows endpoints enrolled in Intune

• SentinelOne Management Console access

• SentinelOne Site Token or Group Token

• Latest SentinelOne Windows Agent installer (.MSI or .EXE)

• Intune Win32 Content Prep Tool (IntuneWinAppUtil.exe)

Step 1: Obtain SentinelOne Site Token

The Site Token registers endpoints with your SentinelOne console. Without it, the agent installs but never appears in your Sentinels view.

Procedure:

1. Log in to the SentinelOne Management Console

2. Navigate to: Sentinels → Packages

3. Download the latest Windows 64-bit Agent Installer

4. Copy the Site Token or Group Token

Security Note: Store this token in a secrets manager (AWS Secrets Manager, Azure Key Vault, or your password manager) before use. Never commit it to a repository or share it in plain text. Anyone with this token can register devices to your SentinelOne console.

Step 2: Create Installation Script

The installation script runs the silent deployment — no UI, no prompts, no user interruption.

Option 1: MSI Installer (Recommended)

Create a file named install.cmd and add the following:

cmd

msiexec /i "SentinelInstaller_windows_64bit_vXX_X_X.msi" SITE_TOKEN="YOUR_SITE_TOKEN" /q /NORESTART

Parameters:

Option 2: EXE Installer

cmd

SentinelOneInstaller_windows_64bit.exe -t YOUR_SITE_TOKEN -q

Step 3: Prepare Intune Package Folder

Intune's Win32 packaging tool requires all deployment files in a single source folder.

Create a folder — for example: E:\Intune\S1_Agent — and copy both files into it:

S1_Agent
 ├── SentinelInstaller_windows_64bit.msi
 └── install.cmd

Note: The folder path can be anything. Both files must be in the same directory before running the packaging tool.

Step 4: Create .intunewin Package

Microsoft Intune requires applications in .intunewin format. The IntuneWinAppUtil.exe tool handles this conversion.

Procedure:

1. Open Command Prompt as Administrator

2. Run: IntuneWinAppUtil.exe

3. Enter the following values when prompted:

Expected output: The tool generates install.intunewin in your Output folder. This is the file you upload to Intune in Step 5.

Step 5: Upload Package to Microsoft Intune

1. Log in to https://endpoint.microsoft.com/

2. Go to Apps → Windows → + Add

3. Select Windows app (Win32)

4. Click Select app package file → select install.intunewin → click Open

App Information tab:

Click Next.

Program tab:

Note: SentinelOne cannot be silently uninstalled without a management console passphrase or console approval — a deliberate tamper-protection feature. Set the uninstall command identical to the install command to prevent Intune from triggering a failed removal flow.

Click Next.

Requirements tab:

• Operating system architecture: 32-bit, 64-bit, or both — match your fleet

• Minimum operating system: Select the minimum Windows version your devices run

Click Next.

Detection Rules tab:

1. Select Manually configure detection rules

2. Click + Add and configure the rule as follows:

3. Click OK

Assignments tab:

• Add the required device groups

• Click Select → Create

Expected outcome: The app deploys silently to all assigned device groups. Enrolled devices should appear in the SentinelOne console under Sentinels within 15–30 minutes of the agent installing.

Common Issues and Troubleshooting

Agent installs but device does not appear in SentinelOne console

The Site Token in install.cmd is invalid, belongs to a different site, or contains accidental whitespace. Verify the exact token value in the SentinelOne console, repackage with the correct token, and redeploy to the affected group.

Deployment showing as "Failed" in Intune

Check the Intune Management Extension log on the affected device: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log

Look for errors related to the install command path or script execution. Re-confirm that install.cmd and the .msi file were in the same folder before packaging.

Detection rule not triggering — app shows "Not installed" after a successful install

Verify the actual SentinelOne installation path on a test machine. The detection rule uses C:\Program Files\SentinelOne — if the agent installed to a different path on your OS version, update the rule path before redeploying.

High CPU usage on developer machines after deployment

SentinelOne's behavioural engine can conflict with compilers, build runners, and package managers. See the guide on fixing SentinelOne high CPU usage on developer machines for exclusion policy configuration that resolves this without reducing protection.

Agent not deploying to newly enrolled devices

Confirm the Intune assignment covers the device group new devices are added to automatically. A static group will miss newly enrolled devices — switch to a dynamic group based on device OS or Entra ID attributes to ensure automatic coverage.

Deployment succeeds but agent version is outdated

SentinelOne agent updates are managed from the SentinelOne Management Console under Settings → Updates — not through Intune. If you are also tracking OS patch status across your Windows fleet, see the guide on pulling a Windows Update report via PowerShell to audit patch compliance alongside EDR coverage.

Need help deploying or managing SentinelOne across your Windows fleet? Talk to NetNXT →

FAQs

1) How do I deploy SentinelOne using Microsoft Intune Win32?

Package the MSI with install.cmd using IntuneWinAppUtil, upload as a Win32 app in Intune with System install behavior, set a file-based detection rule, and assign to device groups.

2) Where do I find the SentinelOne Site Token for Intune deployment?

In the SentinelOne Management Console, go to Sentinels → Packages, download the Windows agent installer, and copy the Site Token or Group Token shown on that page.

3) Why must the SentinelOne uninstall command in Intune match the install command?

SentinelOne blocks silent uninstallation without console approval — a tamper-protection feature. Matching both commands prevents Intune from attempting a removal that will always fail.

4) How do I configure detection rules in Intune for SentinelOne?

Select manually configure detection rules, add a File rule, set path to C:\Program Files\, folder to SentinelOne, and detection method to File or folder exists.