Enrollment via Microsoft Azure

Zecurit supports seamless deployment of its agent to Azure AD-joined Windows devices, enabling IT admins to manage endpoints across cloud and hybrid environments efficiently. Using Azure-native tools, you can automate and scale agent installation across hundreds or thousands of devices.

This guide provides step-by-step instructions for enrolling Windows devices into Zecurit using Microsoft Azure. You can deploy the Zecurit Agent using one of the following methods:

• Method 1: Microsoft Intune Service with Storage Account
• Method 2: Automation Account with Hybrid Runbook Worker

Why Use Azure for Enrollment?

• Ideal for cloud-first or hybrid organizations
• Supports both cloud-only and on-premises devices
• No user interaction needed
• Centralized, policy-driven agent deployment
• Scalable to large device fleets

Method 1: Microsoft Intune with Azure Storage Account

This method uses Microsoft Intune (Endpoint Manager) to deploy the agent script and binaries hosted in a Azure Storage Account.

Prerequisites

• Azure AD tenant with Intune licensing
• Sufficient permissions to deploy applications via Intune
• Azure Storage Account (Blob storage)

Steps for Method 1

Step 1: Download & Extract Agent Files

1. Download ZecuritAgentStartupScript.zip from the Zecurit portal.
2. Extract the contents to a local folder.

Step 2: Create an Azure Storage Account & Blob

1. Log in to the Azure Portal.
2. Navigate to Storage Accounts > Create.
3. Configure the storage account with:
   • Subscription: Select your Azure subscription.
   • Resource Group: Create new or select existing.
   • Storage Account Name: Enter a unique name (e.g., zecuritagentstorage).
   • Region: Select the closest Azure region.
   • Performance: Standard.
   • Redundancy: LRS (Locally Redundant Storage).
4. Click Review + Create > Create.
5. Once deployed, go to Storage Account > Containers > + Container.
6. Name the container (e.g., zecurit-agent) and set access level to Private.

Step 3: Upload Agent Files to Blob Storage

1. Navigate to the container and click Upload.
2. Select all extracted files from ZecuritAgentStartupScript.zip and upload them.

Step 4: Generate a Shared Access Signature (SAS) Token

1. Go to Storage Account > Shared Access Signature.
2. Configure permissions:
   • Allowed services: Blob
   • Allowed resource types: Container, Object
   • Permissions: Read, List
   • Start & expiry date: Set a reasonable validity period.
3. Click Generate SAS and connection string.
4. Copy the Blob SAS URL (e.g., https://[storageaccount].blob.core.windows.net/[container]?[SAS-token]).

Step 5: Deploy via Microsoft Intune

1. Go to Microsoft Intune Admin Center.
2. Navigate to Apps > Windows > Add > Windows app (Win32).
3. Upload the ZecuritAgentInstaller.exe file.
4. Configure App Information:
   • Name: Zecurit Agent
   • Description: (Optional)
   • Publisher: Zecurit
5. Configure Program Settings:
   • Install command: ZecuritAgentInstaller.exe /silent
   • Uninstall command: ZecuritAgentInstaller.exe /uninstall
6. Configure Requirements:
   • OS Architecture: 64-bit
   • Minimum OS: Windows 10 1809+
7. Configure Detection Rules:
   • Rule type: File
   • Path: %ProgramFiles%\\Zecurit\\Agent
   • File: ZecuritAgent.exe
8. Assign the app to Required groups (e.g., All Devices or a specific Azure AD group).
9. Click Review + Create > Create.

The agent will now deploy to the selected devices.

Verify Deployment

• Once deployed, the Zecurit agent will install silently.
• The device will appear in the Zecurit Dashboard after successful enrollment.

???? Use Intune logging and Zecurit’s activity log to verify successful deployment.

Method 2: Automation Account with Hybrid Runbook Worker

This method uses Azure Automation and a Runbook for scalable deployment, including Hybrid Runbook Workers for on-premises or cloud devices.

Prerequisites

• Azure Automation Account
• Hybrid Runbook Worker configured
• Azure Storage Account

Steps for Method 2

Step 1: Download & Extract Agent Files

1. Download ZecuritAgentStartupScript.zip from the Zecurit portal.
2. Extract the contents to a local folder.

Step 2: Create an Automation Account

1. Go to Azure Portal > Automation Accounts > Create.
2. Configure:
   • Name: ZecuritAutomation
   • Subscription: Select your subscription.
   • Resource Group: Create new or select existing.
   • Region: Select a supported Azure region.
3. Click Review + Create > Create.

Step 3: Set Up Hybrid Runbook Worker Group

1. In the Automation Account, go to Hybrid Worker Groups > Add.
2. Select Existing Azure VM or On-Premises Server to install the Hybrid Worker.
3. Follow Microsoft’s guide to install the Hybrid Runbook Worker.

Step 4: Upload Agent Files to Blob Storage

Follow Steps 2 & 3 from Method 1 to create a Storage Account and upload agent files.

Step 5: Modify & Deploy the Runbook

1. In the Automation Account, go to Runbooks > Create a Runbook.
2. Name: Deploy-ZecuritAgent
3. Type: PowerShell
4. Paste the modified script (from ZecuritAgentStartupScript.zip) and update:
   • Storage Blob URL (with SAS token)
   • Target device groups
5. Click Publish.
6. Run the Runbook on the Hybrid Worker Group to deploy the agent.

Verification & Troubleshooting

• Check Installation:
  • On a target device, verify C:\\Program Files\\Zecurit\\Agent exists.
  • Check Windows Services for ZecuritAgent.
• Logs:
  • Agent logs: C:\\ProgramData\\Zecurit\\Agent\\Logs
  • Intune logs: C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs
• Common Issues:
  • 403 Forbidden: Ensure SAS token is valid.
  • Hybrid Worker Offline: Restart the HybridService on the worker machine.

Summary: Method Comparison

Criteria	Method 1: Intune + Storage	Method 2: Automation + Runbook
Suitable For	Azure AD devices	Cloud/on-prem hybrid environments
User Interaction	None	None
Scalability	High	High
Requires Hybrid Workers	❌ No	✅ Yes
Admin Complexity	Moderate	Advanced
Use Case	Corporate laptops, workstations	Servers, VM fleets, data center assets

Related Articles

• Self-Enrollment via Link
• Enrollment via Intune