Enrol a device — Harriet Desktop first

Recommended install order for Endpoint AI — secret enrollment link, Harriet Desktop download, link the device, then optional Claude Desktop for organizations that use it.

When someone receives an enrollment invite email, the intended path is:

Open the secret enrollment link — it expires (typically 24 hours) and does not require signing in to Harriet first. The page shows the one-time token and, where your tenant publishes builds, a Harriet Desktop download.
Install Harriet Desktop from that page when available — this is the primary experience: your organization’s tools and workspace, with the background agent set up as part of rollout.
Link the device — after the agent runs, open the device link page and enter the 9-character code shown on the machine.
Onboard in chat — in Harriet Desktop, try /onboard or a short prompt to connect integrations and load your workspace rules.

Advanced paths

Agent only (terminal) — on the enrollment page, expand Advanced for Mac (curl … | bash) or Windows PowerShell one-liners. Use when IT deploys the agent without the Desktop app bundle, or for automation.
Claude Desktop — if your organization standardizes on Claude Desktop instead of (or alongside) Harriet Desktop, install Claude first where required, then ensure the Harriet agent is running so skills and MCP sync into Claude. The Help tab in Endpoint AI lists Windows install commands for Claude.

Signing in to Harriet is optional before opening the enrollment link; it can still help users confirm they are on the correct organization account before or after linking.

For rollout sequencing with Endpoint AI, see Rolling out Harriet with Endpoint AI. For what Endpoint AI governs at a high level, see What is Endpoint AI and when should we use it?.