Commands

Run these with the installed binary:

& "$env:ProgramFiles\MSPilot\mspilot-agent.exe" status

A from-source build uses ./target/debug/mspilot-agent the same way.

Command	What it does
`enroll`	Registers this machine. If `device.json` already holds a device token, it pulls and prints `already_enrolled` instead of enrolling again.
`apply`	Writes app configs from the saved device state.
`pull`	Fetches gateway config and heals drifted apps. On a canonical Windows install it also compares the exe to the build the gateway pinned, and swaps the file when the hash differs. The new build runs on the next pull.
`rotate`	Rotates the device token and applies configs again.
`update`	Replaces the Program Files binary from the published channel’s `SHA256SUMS`.
`status`	Prints enrollment and drift. It does not print secrets.

enroll takes --gateway-url or the environment variable MSPILOT_GATEWAY_URL. --region ca, --region us, or --region eu selects https://{region}.gateway.mspilot.io only when no gateway URL is set. United Kingdom and Australia organizations pass the gateway URL from Deployment. After enroll, later commands use the gateway URL the server returned. The enrollment key is only the environment variable MSPILOT_ENROLLMENT_KEY. Passing --enrollment-key fails as an unknown argument.

Exit	Meaning
0	Ok. `mspilot_pending` on this exit means the gateway queued the machine.
1	Partial apply, drift, missing key, or no machine fingerprint.
2	This command cannot run in this context. Pull as SYSTEM returns 2. Enroll as SYSTEM is allowed.
3	The gateway rejected enroll, pull, or rotate.
4	Pending sync or pending approval. RMM wrappers turn this into exit 0 and print `mspilot_pending`. Retry later.

On the device list a machine is active, pending approval, not enrolled, or revoked. A global key can also leave a machine Unassigned when the RMM has no record to place it. Disable a device to free its seat. Pending sync means the RMM has not reported the machine yet. It shows in the job output, not as a device-list filter. You do not click anything. The agent retries at the next sign-in, and the machine moves on once the RMM reports it.

Getting started

Agent

Enrollment

Seats

Client setup