The RMM agent is the foundation of almost everything a managed service provider promises. Patching, monitoring, alerting, scripting, remote support and the device count on the agreement all depend on it being on every device and reporting correctly. Yet deployment is often treated as a single step: push the installer, watch the count rise, move on. This free RMM agent deployment checklist gives service managers and onboarding engineers a structured rollout for one client estate. It builds a target inventory before anything is installed, sets up the site structure and policies, gets the policy set approved, runs a pilot, deploys in waves and then reconciles agents against the inventory and the directory until every device is either managed or explained. It also secures the RMM console itself, because a tool with administrative reach into every client is a target. A conditional phase removes a previous RMM agent when you are replacing one.
The deployment tool reports how many installs succeeded. It can’t tell you about the laptop that has been in a drawer since spring, the server that sits in the wrong site and so picked up the workstation patch policy, or the re-imaged PC that now appears twice. The only way to know coverage is to start from a list of what should be managed and compare it with what is reporting, device by device.
The other half of the job is the console. RMM software reaches every device it manages with administrative rights, and attackers know it. CISA, the NSA and MS-ISAC warned in advisory AA23-025A (January 2023) that criminals were using legitimate remote management software to gain access, and the joint Guide to Securing Remote Access Software that followed in June 2023 noted that RMM install paths are often excluded from EDR inspection. Its recommendations for MSPs include MFA on every account that can reach customer environments, treated as privileged, reduced-privilege roles for routine work such as read-only monitoring, and never reusing admin credentials across customers. A rollout that ignores the console widens the attack surface it was meant to reduce.
Measure: installs that returned success.
Misses: devices never targeted, agents in the wrong site, duplicates and agents that stopped checking in.
Risk: unpatched, unmonitored devices that the agreement says you manage.
Measure: every device in the target inventory reporting, in the right group, with policies applied.
Method: reconcile agents against discovery, the directory and the asset list.
Outcome: coverage you can state as a number, with an owner and a reason for every exception.
Seven phases take one client from target inventory to documented, reconciled coverage. Phase 6 appears only when a previous RMM agent has to come off the devices.
Build the list of what should be managed before you install anything. It is the yardstick for every later phase.
Nothing goes beyond the pilot until the service manager has approved the policy set.
This phase decides whether the rollout is finished. Every device ends up managed, retired or recorded as an exception.
Shown only when another RMM agent is on the estate, from an outgoing provider or from your own platform migration.
Most estates need more than one method. Domain-joined desktops, cloud-only laptops and Macs each have a natural route, and the stragglers always need a fallback. Pick the method per device group in Phase 1, so the pilot tests every route you will rely on.
| Method | Suits | Watch for |
|---|---|---|
| Intune Win32 app | Windows devices enrolled in Intune, including Entra-joined laptops that never see the office | The install must be fully silent. The Intune management extension checks for new Win32 app assignments every hour, so allow time before chasing. |
| Group Policy software installation | Domain-joined Windows devices on the office network | It needs a Windows Installer (.msi) package and applies at startup, so laptops that rarely reach a domain controller can miss it. |
| Mac MDM package and profile | Macs enrolled in the client’s device management service | A privacy profile can pre-approve full disk access, but screen recording for remote control can’t be granted silently. At most the profile lets a standard user approve it. |
| Existing management tool or script | Estates already managed by another tool you can use during the transition | Confirm who owns that tool and that its access is removed afterwards. |
| Manual install link | The last few devices no other method reaches | Install links and site keys enrol devices into a client’s site. Expire them when the rollout ends. |
Phase 2 includes a console check because every agent you deploy extends what a compromised technician account could reach. These points follow the CISA-led guidance on remote access software and the 2022 joint advisory on threats to MSPs:
Each wave records devices reporting against the target inventory, and Phase 5 ends with every gap either closed or recorded as an exception with an owner. Upload the reconciliation export to the task it proves, so the coverage figure has evidence behind it.
The policy set is an approval task assigned to the service manager. Until it is approved, the rollout tasks stay locked, so a bad patch or alert policy is caught on ten pilot devices rather than five hundred.
Launch the same checklist for a new client or for each client in a move to a new RMM platform. Conditional logic adds the removal phase only where an old agent exists, and the grid view shows which clients are mid-rollout.
The MSP Client Onboarding Checklist covers the whole takeover of a new client, from credentials and discovery to service desk cutover, and treats RMM deployment as one step within it. This checklist expands that step for estates where coverage needs its own plan. Endpoint security usually follows the same waves: the EDR Rollout Checklist picks up from a reconciled RMM inventory.
Agent deployment is one of the processes the MSP process management guide suggests standardising first, because everything else depends on it. Once agents report, the Patch Management Checklist runs the monthly cycle the RMM delivers. See how CheckFlow for MSPs keeps these processes consistent across every client.
Start with a target inventory built from discovery, the directory, Intune and the client’s own asset list, because the deployment tool only knows about devices it reaches. Choose a method for each device group, prove each method in a pilot, then deploy in waves. Finish by reconciling agents against the inventory until every device is either reporting or recorded as an exception with a reason.
Long enough to see a full cycle of check-ins, an alert, a patch scan and ideally one maintenance window. For most clients that means a few days to a week. Include every device type and every deployment method in the pilot, because problems with a Mac profile or a Group Policy package won’t show up on the devices you tested by hand.
Compare three lists. The RMM’s device list, the directory’s enabled computer accounts with recent sign-ins, and a network discovery scan of each site. A device in the directory or on the network with no agent is a gap. An agent with no matching directory account may be a personal or unknown device. Stale computer accounts belong in a directory clean-up rather than in your exception list.
Usually not. Install your agent first, confirm it reports and its policies apply, then remove the previous agent device by device. That avoids a window where nobody can reach or patch the device. Agree the removal date and method with the outgoing provider in writing, and check afterwards that no services, scheduled tasks or remote access components from the old platform are left running.
Treat every account that can reach client devices as privileged. CISA-led guidance recommends MFA on those accounts, reduced-privilege roles for routine work such as read-only monitoring and no reuse of admin credentials across customers. Add roles scoped per client, audit logging of remote sessions and scripts, and an access review whenever a technician joins, moves or leaves.
Yes, for Windows devices enrolled in Intune, which is often the only reliable route for cloud-only laptops. Package the installer as a Win32 app and assign it as required to a device group. Intune doesn’t support interactive installs, so the installer must run silently with the client’s site key built in. Confirm each device then checks into the right site before you count it as covered.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
