Skip to main content

​
Prerequisites

  • Microsoft Intune admin access
  • Organization API key from Runlayer with MCP Watch Scan role
  • Devices running Windows 10 1607+ or Windows 11, Microsoft Entra joined
Organization API keys authenticate MDM-deployed scripts without per-device enrollment.
1

Navigate to API Keys

Go to Settings in the Runlayer dashboard and select the API Keys tab
2

Create a New Key

Click + Create Organization API Key
3

Configure the Key

  • Name (required): Enter a descriptive name (e.g., “MDM MCP Watch”)
  • Role: Select MCP Watch Scan
4

Copy the Key

Copy the generated key (starts with rl_org_) and store it securely
Organization API keys are shown only once. Store them securely and treat them like passwords.
Windows Home and S mode are not supported.

​
Deployment Steps

1

Generate the Script

Fill in your settings below to generate a deployment script.
  • DEVICE_NAME: Use an Intune variable or leave empty to use the device’s computer name (%COMPUTERNAME%).
2

Add Script in Intune

  • Open the Intune admin center
  • Go to Devices > Scripts and remediations > Platform scripts
  • Click Add > Windows 10 and later
  • Upload the generated script
  • Set Run this script using the logged on credentials to Yes
  • Set Run script in 64-bit PowerShell host to Yes
3

Assign to Groups

Select the device groups that should receive configuration sync, then click Add

​
Verification

Monitor script status in Devices > Scripts and remediations > Platform scripts. On a target device, open a client (e.g., Cursor) and confirm the synced MCP servers appear. If something went wrong, check %ProgramData%\RunlayerSync\runlayer-sync.log.

​
Troubleshooting

  • Ensure the device is Microsoft Entra joined (not just registered)
  • Check that the Intune Management Extension service is installed
  • Verify the device can reach https://pypi.org
  • Check %ProgramData%\RunlayerSync\runlayer-sync.log for errors
  • Verify the organization API key is correct and not revoked
  • Confirm servers have auto-sync enabled in the Runlayer dashboard
  • Verify the organization API key is correct
  • Check if the key has been revoked in Settings > API Keys