Every AgenShield rollout starts with an install campaign. A campaign is a
named enrollment channel: it mints a token, and everything a device needs to
join your fleet — the install command, the configuration profile, the installer
package — is generated from that token.
A campaign is the first of five things you set up. The whole Frontegg Portal journey
is: campaign → devices → rules → telemetry → agent resources. Each page
below links to the next.
Create one
In the Frontegg Portal, open AgenShield → Devices (https://portal.frontegg.com/<environment>/agen/shielded/devices),
then New campaign. There are only two fields:
Pin a version when you are validating an upgrade on a small group, or when
change control requires a fixed build. Everyone else should leave it empty.
Use more than one campaign
Campaigns are free, and they are how you segment a rollout. A campaign is the unit you can revoke, pin to a version, and — with a connected MDM — map to its own device group. Split them the way you would split a rollout wave:
A device belongs to exactly one campaign. With a connected MDM, that is enforced
for you — see Microsoft Intune.
What a campaign gives you
Once created, the campaign detail view carries everything a rollout needs.
The campaign detail view — the install command, install URL, and enrollment token, ready to copy.
For a single Mac, or a scripted rollout
For a managed fleet
The campaign’s MDM artifacts section carries per-campaign download URLs. The configuration-profile URL is generated from the campaign token, so the profile you download already contains your campaign token and backend URL — there is nothing to hand-edit:
Push the profile and one of the two packages, and the rollout is done. See
MDM enrollment for what each payload does, and the
per-MDM pages for the exact clicks.
Is the token a credential?
No — and this matters, because you will be pasting it into an MDM console and possibly an onboarding document.- It authorizes enrollment only. It cannot read policy, read telemetry, or change anything in the Frontegg Portal.
- It is revocable at any time.
- The device’s real, long-lived identity is a keypair generated on the device during enrollment. The token is not that identity, and does not grant it.
Watch a campaign work
The campaign detail view has an events timeline that tells you where a rollout is:
Seeing
Script fetched but never Registration is the classic MDM symptom: the
package reached the device but the profile did not, so there was no token to
enroll with. MDM enrollment covers how to confirm.
Revoke a campaign
Revoking invalidates the token. Precisely:- New devices can no longer enroll through it. The install script returns an error.
- Already-enrolled devices are unaffected — they keep their own identity, keep receiving policy, and keep reporting.
Next
MDM enrollment
Push the campaign’s profile and package to a managed fleet — no user interaction.
Quickstart
Use the install command on a single Mac instead.
Enrolled devices
What appears once devices start reporting, and how to read fleet health.
Rollout playbook
The phased path from pilot to enforcement.