Skip to main content

Prerequisites

Common requirements that apply to every Quilr Endpoint Agent rollout — Windows or macOS, Intune / Jamf / Kandji / ManageEngine / manual. Each deployment guide additionally lists a short platform-specific prereq table.

Pick your platform

Selecting macOS or Windows in the tabs below filters this page to that platform only — and it syncs with the sidebar Filter widget. So if you've already picked Windows in the sidebar, the Windows tab opens automatically (via the ?platform=… query string).

What you need before starting​

RequirementDetails
Quilr environmentKnow which Quilr tenant your bundle was built against (e.g. quilr-saas-usa-prod, quilr-saas-japan, quilr-saas-ind-prod). The environment determines which backplane hosts you allowlist below. Confirm with Quilr support if unsure.
Install bundleWindows: …/windows/installer/quilr-endpoint-agent-win-install-bundle.zip · macOS: …/mac/installer/quilr-endpoint-agent-install-bundle.zip. Verify the checksum before extracting. Bundle contents differ by platform — Windows: quilr-endpoint-agent.msi + 2 CA .crts. macOS: quilr-endpoint-agent-installer.pkg + 2 CA .cers + Configuration Profile templates.
MDM accessAdmin rights on your MDM platform: Microsoft Intune (Intune Administrator), Jamf Pro (Site or Cloud admin), Kandji (admin), ManageEngine Endpoint Central (admin). For macOS the device must be MDM-supervised (DEP / Automated Device Enrollment is preferred so System / Network Extensions are auto-approved).
Endpoint OSWindows: 10 1809+ or 11, x64 only. macOS: 12 Monterey or later, Apple Silicon or Intel. Older OS versions are not supported by the agent's WinDivert driver / System Extension.
Network egress (TCP 443)Endpoints must reach the Quilr backplane hosts on TCP 443. The full allowlist (shared hosts + per-tenant Base URL / DLP) is in § Firewall and Network Allowlist below.
TLS-intercepting SWG (if used)Zscaler / Netskope / Symantec WSS / Forcepoint / iboss must SSL-bypass every Quilr backplane host. The agent pins TLS against Quilr's internal CA chain (deployed in Part 2 of each guide) — SWG re-signing breaks the handshake.
Pilot groupA small group of devices (suggested naming Quilr-Pilot) to validate against before broad rollout. Promote to Quilr-Production after validation.
CA trust deploymentThe agent's leaf cert chains to a Quilr root + intermediate that must land in the system trust store before the agent service starts. Each deployment guide's Part 2 covers this. (Optional on Windows — the MSI installs the chain itself.)

Platform-specific add-ons​

Each guide lists the tools / preconditions unique to that MDM. Quick pointer to where the platform-specific prereqs live:

MDM / pathPlatform-specific prereqs in
Microsoft Intune (Windows)Intune — Windows guide § Prerequisites
Microsoft Intune (macOS)Intune — macOS guide § Prerequisites
Jamf ProJamf Pro guide § Prerequisites
KandjiKandji guide § Prerequisites
ManageEngine Endpoint CentralManageEngine guide § Prerequisites
Manual macOS installManual install guide § Prerequisites

Firewall and Network Allowlist​

The Quilr Endpoint Agent makes outbound HTTPS (TCP 443) to a small set of Quilr backplane hosts. Where the perimeter is enforced — corporate firewall, egress proxy, or TLS-intercepting Secure Web Gateway (Zscaler, Netskope, Symantec, Forcepoint, etc.) — these hosts must be allowed before the agent installer is deployed.

Pick the row that matches your tenant

The host set depends on which Quilr environment your bundle was built against (bff, dlpPrefix, updateUrlPrefix). Confirm with Quilr support if you are unsure which environment applies.

Step A. Quilr control-plane hosts​

Shared across all environments — allowlist these regardless of tenant:

HostPurpose
discover.quilrai.devTenant / endpoint discovery
log.quilrai.devDiagnostic log shipping (enabled when diagnostics are turned on)
quilr-extensions.quilr.aiBrowser-extension / agent update distribution (default CDN)

Per-environment — pick the row that matches your tenant:

EnvironmentBase URLDLP Host
Quartzhttps://quartz.quilr.aihttps://dlpone.quilr.ai
Securehttps://secure.quilr.aihttps://dlpone.quilr.ai
US POChttps://app.quilr.aihttps://dlpone.quilr.ai
IND POChttps://platform.quilr.aihttps://dlp-platform.quilr.ai
US Prodhttps://app.quilrai.comhttps://dlpone.quilrai.com
IND Prodhttps://platform.quilrai.comhttps://dlp-platform.quilrai.com
JP POChttps://app-jp.quilr.aihttps://dlpone-jp-1.quilr.ai
UAE POChttps://trust.quilr.aihttps://dlp-platform.quilr.ai
Dedicated PaaS / on-prem deployments

If your tenant runs on a customer-owned domain (your own DNS / on-prem control plane), the shared hosts above still apply — Quilr support provides the tailored Base URL + DLP allowlist for your specific deployment. Contact support@quilr.ai.

Step B. Additional update / artifact CDN (env-specific)​

Most environments use the default quilr-extensions.quilr.ai (already in Step A). A few environments use an additional CDN — allowlist the matching row in addition to Step A:

HostUsed by environments
quilr-extensions.quilrai.comquilr-saas-ind-prod, quilr-saas-usa-prod
quilr-hub.quilr.aiquilr-poc2

If your environment is not listed above, Step A alone covers update distribution.

Step C. TLS-intercepting proxies — SSL-bypass​

If your egress sits behind Zscaler / Netskope / Symantec WSS / Forcepoint / iboss / etc., add every host from Steps A and B to the SSL-bypass (no TLS inspection) list. The agent pins TLS to Quilr's internal CA chain (deployed in Part 2 of each deployment guide) — re-signing through the SWG's CA breaks the handshake and the agent will fail to connect.

For the upstream SWG rules covering monitored AI hosts (ChatGPT, Claude, Gemini, etc.), see the companion URL Exception List — AI Apps and URL Exception List — Non-AI Apps — those cover apps the agent inspects, not the Quilr backplane itself.

Step D. Validate egress from a pilot device​

From a pilot endpoint, verify reachability before installing the agent.

Run one of the commands below depending on which OS you're testing from.

Any BLOCKED host means the firewall / SWG / corporate proxy still needs adjustment. Re-run the test after the network team applies the allowlist.

Notes on endpoint firewalls​

On a default install of either Windows or macOS, outbound TCP 443 is unrestricted — per-host outbound rules on the endpoint firewall are normally not required. The standard path is to allowlist Quilr backplane FQDNs at the egress proxy / SWG / corporate firewall, not on the per-endpoint Defender Firewall (Windows) or PF (macOS). Each deployment guide's Section 3 covers the platform-specific path when endpoint-firewall rules are required.

See also​