# Primo Documentation: English Documentation ## Documentation ### Welcome to Primo - [Welcome to Primo](https://docs.getprimo.com/index.md): Everything you need to manage your company's IT, all in one place. ### Platform configuration - [Manage administrator access](https://docs.getprimo.com/get-started/grant-admin-access.md): Invite administrators, assign them a role, and revoke their access from Settings > Security & Access. - [Custom fields](https://docs.getprimo.com/mdm/custom-fields.md): Add your own attributes to devices, employees, orders, and accessories to track company-specific data and power Device Group rules. - [Set up HR sync](https://docs.getprimo.com/employees/set-up-hr-sync.md): Connect your HR system to sync employee data automatically and let it drive onboardings, offboardings, and your employee directory. ### Onboardings & Offboardings - [Onboardings & offboardings overview](https://docs.getprimo.com/employees/overview.md): Sync employees from your HR system and let their start and departure dates drive IT onboardings and offboardings. #### Onboardings - [Understand onboarding settings](https://docs.getprimo.com/employees/onboarding-settings.md): Set the ticket defaults, steps, and step controls that every onboarding uses. - [Automate your onboardings](https://docs.getprimo.com/employees/automate-onboardings.md): Configure each onboarding step — the ticket, information confirmation, email, SaaS access, and equipment — so every new hire starts on day one with everything they need. - [Equipment Agent](https://docs.getprimo.com/employees/purchase-equipment-at-onboarding.md): Let Primo AI pick, agree, and order a new hire's device from your policies, with your approval on the onboarding ticket. #### Offboardings - [Understand offboarding settings](https://docs.getprimo.com/employees/offboarding-settings.md): Set how far back past leavers are offboarded and when each offboarding step runs relative to an employee's last day. - [Automate your offboardings](https://docs.getprimo.com/employees/automated-offboardings.md): Configure when Primo revokes SaaS access and runs device offboarding actions, triggered by departure dates from your HR system. ### AI Agents - [AI Agents overview](https://docs.getprimo.com/ai/overview.md): Chat with Primo AI, turn on the built-in agents, and build your own agents for the jobs specific to your team. - [Primo AI](https://docs.getprimo.com/ai/primo-ai.md): Chat with Primo AI, a context-aware assistant that helps you search, understand, and act across the platform. - [Built-in agents](https://docs.getprimo.com/ai/agents.md): The agents Primo ships with: what each one does, where you turn it on, and the article that covers its setup. - [Knowledge base items](https://docs.getprimo.com/ai/knowledge-base-items.md): Teach Primo AI your company's knowledge, policies, and reusable tasks by creating and publishing knowledge base items. - [Connectors](https://docs.getprimo.com/ai/connectors.md): Connect external tools to Primo AI by registering Model Context Protocol (MCP) servers. #### Custom agents - [Custom agents](https://docs.getprimo.com/ai/custom-agents.md): Build an agent for a job of your own: choose what starts it, write its instructions, give it knowledge and connectors, and follow every run. - [Agent templates](https://docs.getprimo.com/ai/agent-templates.md): Start a custom agent from a ready-made template: pick one from the catalog, review what it pre-fills, adapt it, and create it. ### Helpdesk - [Helpdesk overview](https://docs.getprimo.com/tickets/overview.md): Collect IT tickets from Slack, email, and Microsoft Teams, and let the Helpdesk Agent answer them. - [Helpdesk Agent](https://docs.getprimo.com/tickets/helpdesk-agent.md): Let Primo AI answer and work your IT tickets, one at a time or every ticket employees raise, with approval before it changes anything beyond the ticket. #### Ticket channels - [Slack](https://docs.getprimo.com/tickets/slack.md): Connect your Slack workspace to create tickets from Slack and keep a ticket and its Slack thread in sync. - [Email](https://docs.getprimo.com/tickets/email.md): Turn emails sent or forwarded to your inbound address into tickets, and keep each ticket in sync with its email thread. - [Microsoft Teams](https://docs.getprimo.com/tickets/teams.md): Connect your Microsoft 365 tenant to create tickets from Teams channels and chats, and keep each ticket in sync with its Teams thread. ### Device Management - [Device Management overview](https://docs.getprimo.com/mdm/overview.md): Set up each platform, enroll your devices, apply controls, deploy software, and monitor compliance across your fleet. - [Platform support](https://docs.getprimo.com/mdm/get-started/supported-platforms.md): Check which device management features each platform supports, from macOS, Windows, and Linux to iOS, Android, and ChromeOS. - [Script library](https://docs.getprimo.com/mdm/scripts/script-library.md): Add, edit, download, and delete shell, Python, and PowerShell scripts you can run on macOS, Linux, and Windows devices. - [Device groups](https://docs.getprimo.com/mdm/device-groups.md): Organize your fleet into device groups to apply MDM profiles and controls to specific sets of devices. - [Audit logs](https://docs.getprimo.com/mdm/audit-logs.md): Track every administrative action taken on devices and MDM settings, including policy changes, remote commands, and enrollment events. - [Network whitelisting](https://docs.getprimo.com/mdm/network-requirements.md): Which Primo MDM and Apple endpoints must be reachable for enrollment, policy delivery, and push notifications to work when devices are behind a firewall or proxy. #### Per platform setup - [Apple](https://docs.getprimo.com/mdm/get-started/set-up-apn-certificate.md): Create the Apple Push Notification service (APNs) certificate that lets Primo manage your Apple devices. - [Windows](https://docs.getprimo.com/mdm/get-started/initial-setup-windows.md): Check which Windows editions are supported — Windows needs no extra setup before devices enroll. - [Linux](https://docs.getprimo.com/mdm/get-started/initial-setup-linux.md): Check which Linux distributions are supported — Linux needs no extra setup before devices enroll. - [Android](https://docs.getprimo.com/mdm/get-started/initial-setup-android.md): Connect Android Enterprise so Primo can manage your Android devices and deploy apps from Google Play. #### Enrollment - [Enrollment overview](https://docs.getprimo.com/mdm/rollout/enrollment-methods.md): Choose the right enrollment method for each platform based on your existing setup and whether admins or employees drive the process. - [Zero-touch for Apple](https://docs.getprimo.com/mdm/zero-touch/zero-touch-macs.md): Connect Apple Business to automatically enroll, preconfigure, and secure Apple devices purchased through authorized resellers. - [Zero-touch for Windows](https://docs.getprimo.com/mdm/zero-touch/zero-touch-windows.md): Set up Windows Autopilot so new Windows devices apply your company apps, settings, and security policies as soon as employees sign in with their Microsoft credentials. - [Migrate Macs using Apple Business](https://docs.getprimo.com/mdm/rollout/migrating-macs-using-abm.md): Reassign Macs from a previous MDM to Primo via Apple Business — no device wipe, no data loss. - [Silent agent deployment](https://docs.getprimo.com/mdm/rollout/silent-agent-deployment.md): Deploy the Primo MDM agent centrally and silently — using an existing MDM, Active Directory with GPO, or any package deployment system. - [Account-driven device enrollment](https://docs.getprimo.com/mdm/rollout/account-driven-enrollment.md): Enroll iOS, iPadOS, and macOS devices using Account-driven Device Enrollment — a privacy-preserving method where employees sign in with their Managed Apple Account to enroll their device. - [Employee enrollment](https://docs.getprimo.com/mdm/rollout/invite-employees.md): Have employees install the Primo MDM agent themselves, the default enrollment method that works on every supported platform with no prior infrastructure. - [Device assignment](https://docs.getprimo.com/mdm/rollout/device-assignment.md): Understand how devices are assigned automatically at enrollment, and unassign or reassign them to keep your inventory accurate. #### Devices - [Import your equipment](https://docs.getprimo.com/get-started/import-your-equipment.md): Add the devices, accessories, and employees you already have, with Primo AI or from a CSV file. - [Wiping devices](https://docs.getprimo.com/mdm/guides/wiping-devices.md): Remotely erase a lost, stolen, or reassigned device from the cockpit, and choose the right wipe option for each platform. - [Disenroll devices](https://docs.getprimo.com/mdm/guides/remove-mdm-manually.md): Remove device management from a device, from the cockpit when it's online or manually on the device when it's offline. - [Resolve enrollment issues](https://docs.getprimo.com/mdm/guides/resolve-enrollment-issues.md): Diagnose why a device is partially enrolled, missing its agent or MDM profile, or offline, and bring it back to a fully enrolled state. - [Locking devices](https://docs.getprimo.com/mdm/guides/locking-devices.md): Remotely lock a managed Mac, Windows, Linux, iOS, iPadOS, or Android device from the cockpit to prevent unauthorized access when a device is lost or an employee is offboarded. - [Clear passcode](https://docs.getprimo.com/mdm/guides/clear-passcode.md): Remotely remove the lock screen passcode on a managed Android device so an employee who forgot their PIN, pattern, or password can regain access and set a new one. - [Activation Lock bypass code escrow](https://docs.getprimo.com/mdm/guides/activation-lock-bypass.md): Make sure Activation Lock bypass codes are escrowed via MDM so you can recover devices after a wipe or reassignment. #### Controls - [Controls overview](https://docs.getprimo.com/mdm/policies/overview.md): Apply security, restriction, login, and configuration controls to your managed devices, and see which platforms each control supports. - [Enforce minimum OS version](https://docs.getprimo.com/mdm/policies/enforce-minimum-os-version.md): Require devices to run a minimum operating system version to ensure security patches and app compatibility are maintained across your fleet. - [Automatic app and OS updates](https://docs.getprimo.com/mdm/policies/automatic-updates.md): Configure automatic update settings for macOS devices to keep apps and the operating system up to date in the background. - [Disk encryption](https://docs.getprimo.com/mdm/policies/disk-encryption.md): Enforce full-disk encryption across your fleet and automatically escrow recovery keys so IT can always regain access without relying on employee credentials. - [Admin management](https://docs.getprimo.com/mdm/policies/manage-admin-accounts.md): Deploy local administrator accounts on your devices with per-device random passwords and privilege management. - [Admin password rotation](https://docs.getprimo.com/mdm/policies/admin-password-rotation.md): Rotate local administrator passwords on a schedule and back them up securely to limit credential reuse and unauthorized access. - [Generate settings via AI](https://docs.getprimo.com/mdm/policies/generate-settings-via-ai.md): Create MDM configuration profiles for Apple devices by describing the settings you need in plain language. - [Custom file](https://docs.getprimo.com/mdm/policies/custom-file.md): Import a custom configuration profile to apply settings not covered by Primo's built-in controls, with support for native profile formats on macOS, iOS/iPadOS, Windows, and Android. - [App blocking](https://docs.getprimo.com/mdm/policies/app-blocking.md): Control which applications run on macOS devices with Santa-powered Monitor, Lockdown, or Standalone enforcement. - [AirDrop restriction](https://docs.getprimo.com/mdm/policies/airdrop-restriction.md): Control AirDrop discoverability on macOS devices to prevent unauthorized file sharing. - [Device naming](https://docs.getprimo.com/mdm/policies/device-naming.md): Enforce consistent device names on macOS, Windows, and Linux, generated by AI from employee and device attributes. - [Firewall](https://docs.getprimo.com/mdm/policies/firewall.md): Enable the built-in operating system firewall on macOS and Windows devices to block unauthorized inbound network connections. - [Google Chrome](https://docs.getprimo.com/mdm/policies/google-chrome.md): Deploy managed Chrome settings, extensions, and homepage across macOS and Windows devices. - [Lock MDM profiles pane](https://docs.getprimo.com/mdm/policies/lock-mdm-profiles-pane.md): Block employees from modifying the Profiles section in macOS System Settings, preventing them from viewing or removing MDM profiles. - [Screen capture blocking](https://docs.getprimo.com/mdm/policies/screen-capture-blocking.md): Block screenshots and screen recording on macOS devices to protect sensitive content. - [Mac login with Entra](https://docs.getprimo.com/mdm/policies/mac-login-entra.md): Let employees unlock their Mac with their Microsoft Entra ID credentials through Platform SSO. - [Mac login with Primo](https://docs.getprimo.com/mdm/policies/mac-login-primo.md): Let employees sign in to their Mac with their Primo account through Apple Platform Single Sign-On (Platform SSO), with the login methods you choose. - [Mac login with Okta](https://docs.getprimo.com/mdm/policies/set-up-okta.md): Let employees log in to their Mac with their Okta credentials through Apple Platform SSO, with SSO to Okta-connected apps. - [Windows login with Okta](https://docs.getprimo.com/mdm/policies/okta-windows.md): Let employees sign in to Windows with Okta Verify and reach Okta-connected apps through SSO without signing in again. - [Password and screenlock](https://docs.getprimo.com/mdm/policies/password-policy.md): Set password rules and screen lock preferences to keep devices secure. - [recoveryOS protection](https://docs.getprimo.com/mdm/policies/recoveros-protection.md): Set a recovery lock password on Apple Silicon Macs to prevent unauthorized access to recoveryOS. - [Remote access](https://docs.getprimo.com/mdm/policies/remote-management.md): Deploy RustDesk to enable encrypted remote access and screen sharing on managed devices. - [USB storage blocking](https://docs.getprimo.com/mdm/policies/usb-storage-blocking.md): Prevent USB keys, SD cards, and other removable storage from connecting to managed devices. - [Wi-Fi](https://docs.getprimo.com/mdm/policies/wifi.md): Push Wi-Fi settings to managed devices so employees connect to company networks automatically without entering credentials manually. - [AirPrint](https://docs.getprimo.com/mdm/policies/airprint.md): Install a network printer on managed Macs so employees can print without adding it themselves. #### Software - [Software overview](https://docs.getprimo.com/mdm/software-types.md): Choose how to deploy each app: compare the software types available on each platform and what they support. - [Fleet managed software](https://docs.getprimo.com/mdm/policies/fleet-maintained-software.md): Deploy popular apps from a curated, pre-packaged catalog maintained by Fleet — no installer management required. - [Custom software](https://docs.getprimo.com/mdm/policies/custom-software.md): Deploy your own installer packages — internal tools, enterprise builds, or any app not in the Fleet catalog. - [App Store apps](https://docs.getprimo.com/mdm/policies/app-store-apps.md): Deploy App Store apps to macOS and iOS/iPadOS devices through Apple's Volume Purchase Program (VPP). - [Google Play Store apps](https://docs.getprimo.com/mdm/policies/google-play-store.md): Deploy managed apps to Android devices through Android Enterprise and the Google Play Store. - [Software installation status](https://docs.getprimo.com/mdm/software-installation-status.md): Check the install state of every app you deploy on each targeted device, and install, update, or uninstall it from the cockpit. - [Find the right program name for Automatic Install](https://docs.getprimo.com/mdm/guides/find-program-name.md): Identify the exact software name to use in your auto-install detection query on Windows and Linux. #### MDM compliance - [MDM compliance overview](https://docs.getprimo.com/mdm/compliance/overview.md): Continuously audit every managed device against your security and IT policies, surface deviations, decide which device states count as a violation, and route them to tickets. - [MDM Remediation Agent](https://docs.getprimo.com/mdm/compliance/ai-remediation.md): Let Primo AI work your compliance tickets under a written policy: turn it on, understand its default behavior, narrow it, and steer it from the ticket. - [Configure compliance issue settings](https://docs.getprimo.com/mdm/compliance/issue-settings.md): Choose which device statuses count as a violation, which devices are exempt, and how long Primo waits before raising an issue. - [Compliance issue reference](https://docs.getprimo.com/mdm/compliance/issue-reference.md): What each compliance issue status means, why macOS and Windows devices trigger it, and how to bring them back to a compliant state. #### Integrations - [Vanta](https://docs.getprimo.com/mdm/integrations/vanta.md): Send your Primo admin accounts and your macOS and Windows device inventory to Vanta every hour, and know exactly which fields leave Primo. - [Bastion](https://docs.getprimo.com/mdm/integrations/bastion.md): Connect Bastion to Primo with a read-only Primo API key so it can check the security settings of your Mac, Windows, and Linux devices. #### Local accounts - [Change a local session password](https://docs.getprimo.com/mdm/policies/change-local-password.md): Reset the password of a local session on a managed device remotely from the cockpit. - [SecureToken rules](https://docs.getprimo.com/mdm/policies/secure-token.md): Understand which macOS accounts receive a secure token, what it unlocks, and how to grant one to the Primo admin account. #### MDM settings - [Settings](https://docs.getprimo.com/mdm/settings.md): Configure your Primo MDM instance — integrations, enrollment behavior, notifications, and more. - [Use the Fleet console](https://docs.getprimo.com/mdm/get-started/navigating-fleetdm.md): Find your way around the Fleet console: the Hosts, Controls, Queries, and Policies tabs. ### Endpoint Protection - [Endpoint Protection overview](https://docs.getprimo.com/mdm/endpoint-protection/overview.md): Deploy and monitor an endpoint detection and response (EDR) agent on your managed devices. - [ThreatDown](https://docs.getprimo.com/mdm/endpoint-protection/threatdown.md): Deploy ThreatDown (by Malwarebytes) automatically to protect your device fleet against security threats. - [SentinelOne](https://docs.getprimo.com/mdm/endpoint-protection/sentinelone.md): Connect your SentinelOne instance to Primo and deploy the agent automatically on macOS, Windows, and Linux devices. - [CrowdStrike Falcon](https://docs.getprimo.com/mdm/endpoint-protection/crowdstrike-falcon.md): Deploy the CrowdStrike Falcon agent on macOS and Windows devices. - [Bitdefender](https://docs.getprimo.com/mdm/endpoint-protection/bitdefender.md): Deploy the Bitdefender GravityZone agent on macOS and Windows devices using Primo MDM. ### SaaS Management - [SaaS Management overview](https://docs.getprimo.com/saas/overview.md): Discover the SaaS your company uses, provision and revoke accounts with the employee lifecycle, and track licences and costs. - [Connect your email provider](https://docs.getprimo.com/saas/get-started/connect-email-provider.md): Connect Google Workspace or Microsoft Entra ID to enable SaaS discovery, automated provisioning, and identity sync. - [Activate SaaS discovery](https://docs.getprimo.com/saas/get-started/activate-saas-discovery.md): Find every SaaS your employees use by activating SaaS discovery through Google Workspace, Microsoft Entra ID, or the Primo Chrome Extension. - [Set up provisioning rules](https://docs.getprimo.com/saas/rules.md): Define which SaaS, roles, groups, licences, and organizational units each new hire gets, based on their team, location, job title, legal entity, or manager. - [Identities](https://docs.getprimo.com/saas/identities.md): See every SaaS account in your company, who it belongs to, and what it grants. - [Audit logs](https://docs.getprimo.com/saas/audit-logs.md): Follow every provisioning, sync, and connection event across your SaaS, and retry the ones that failed. #### SaaS connections - [Connect your SaaS](https://docs.getprimo.com/saas/connect-apps.md): Connect a SaaS from the catalog with SSO, SCIM, or API credentials to provision accounts automatically. - [SaaS catalog](https://docs.getprimo.com/saas/connected-saas-properties.md): Check which SaaS Primo connects to, the plan each one requires, and what you can manage in each. - [Connect a custom SAML SaaS](https://docs.getprimo.com/saas/configure-sso.md): Connect any SaaS that supports SAML single sign-on (SSO), with Primo, Google, or Entra as the identity provider. - [Track a SaaS manually](https://docs.getprimo.com/saas/manual-saas.md): Add a SaaS that Primo can't connect to, assign an owner, and manage its accounts through tasks. #### Directory - [Manage your SaaS](https://docs.getprimo.com/saas/manage-tracked-apps.md): Find every SaaS in the Directory, see who has access, assign an owner, and request account changes. - [Cost management](https://docs.getprimo.com/saas/cost-management.md): Enter the contract of each SaaS to track its cost per seat, its yearly cost, and the cost of unused seats. ### Global Purchasing - [Global Purchasing overview](https://docs.getprimo.com/procurement/get-started.md): Set up your catalog, define how orders are authorized and paid, and enable procurement in the countries you operate in. - [Pricing and sourcing](https://docs.getprimo.com/procurement/why-buy-with-primo.md): Understand how Primo prices and sources IT equipment, what each order includes, and when to buy elsewhere. - [Equipment policy](https://docs.getprimo.com/procurement/equipment-policy.md): Define which devices and accessories employees can order based on their profile, and let Primo AI curate the catalog. - [Purchasing policy](https://docs.getprimo.com/procurement/purchasing-policy.md): Define how orders are authorized, where they ship, which billing profile pays, and who you buy from. #### Catalog - [Create and manage your catalog](https://docs.getprimo.com/procurement/add-products-catalog.md): Set up a per-country catalog and request products that aren't listed yet. - [Delivery countries](https://docs.getprimo.com/procurement/shipping-countries.md): Check the countries Primo ships to and request additional ones. - [Open a new country](https://docs.getprimo.com/procurement/open-new-country.md): Activate a new country to order and ship equipment to the employees located there. - [Set up zero-touch deployment on your catalog](https://docs.getprimo.com/mdm/zero-touch/setup-zero-touch-catalog.md): Configure Apple Business and Microsoft Entra so Primo enrolls ordered devices automatically with zero-touch deployment. - [Set up AppleCare for Enterprise](https://docs.getprimo.com/procurement/setup-applecare-enterprise.md): Set up AppleCare Enterprise (ACE), activate your MSA ID, and add ACE to your Primo orders. - [Keyboard layouts & localization](https://docs.getprimo.com/mdm/zero-touch/keyboard-layouts-localization.md): Understand how keyboard layout selection affects Zero-Touch Deployment (ZTD) eligibility when ordering devices. #### Orders - [Track your order](https://docs.getprimo.com/procurement/track-your-order.md): Track your device and accessory orders from placement to delivery and understand each status. - [Modify or cancel an order](https://docs.getprimo.com/procurement/modify-or-cancel-order.md): Cancel an order while it's still placed, replace it to change its details, and handle out-of-stock items. #### Shipments - [Create a shipment](https://docs.getprimo.com/procurement/create-shipment.md): Generate a shipping label and create a return shipment, either from the offboarding flow or manually from the cockpit. - [Track a shipment](https://docs.getprimo.com/procurement/track-shipment.md): Follow equipment return shipments through each status and open carrier tracking. - [Customs & international shipments](https://docs.getprimo.com/procurement/customs-international-shipments.md): Understand when customs duties and clearance apply to shipments between the EU, the United Kingdom, and the rest of the world. #### Returns and after-sales - [Returns & exchanges](https://docs.getprimo.com/procurement/returns-exchanges.md): When a return or exchange is accepted, the deadlines that apply, and how to submit a request for a wrong, defective, or damaged item. - [Repairs & warranty claims](https://docs.getprimo.com/procurement/repairs-warranty-claims.md): Standard warranty coverage, return policy, and how to handle accidental damage or theft for devices purchased through Primo. #### Resources - [Repair partners](https://docs.getprimo.com/procurement/local-partners-repair.md): Find a repair partner for your country and submit a repair request from the device panel in the cockpit. - [Buyback partners](https://docs.getprimo.com/procurement/local-partners-resell.md): Resell used IT equipment through a buyback partner that covers your country and devices.