Connect your SentinelOne instance to Factorial IT and the SentinelOne agent is deployed automatically on macOS, Windows and Linux devices. This guide also covers exclusions, uninstalling, token renewal and moving to another SentinelOne console.

Feature/Functionality

Overview

Deployment type: automatic. As soon as the integration is connected and the control is switched on, the agent is pushed through MDM to every targeted device. Nobody installs anything by hand, and employees do not have to do anything.

Prerequisites

• Factorial IT MDM
• A SentinelOne licence, either bought through Factorial IT or one you already have

Need a SentinelOne instance? Get in touch with us or email support@factorial.it.

Which setup applies to you

Where your SentinelOne instance comes from changes three things. Find your case before you begin.

Connect your SentinelOne instance

Until the integration is connected, the EDR - SentinelOne cards are greyed out in the control catalogue. So begin with the connection.

Instance provided by Factorial IT

We connect it for you. While we do, SentinelOne shows Being set up in the Integrations section of MDM > Settings.

Your own instance

1. Go to MDM > Settings. In Integrations, click Add integration, then Connect on the SentinelOne card.
2. The Connect SentinelOne window asks for three values:

• SentinelOne URL: https://xxxxxxxxx.sentinelone.net
• Site ID: in SentinelOne, go to Policy & Settings > Sites, click the site to connect and copy its Site ID.
• Service User Token: in SentinelOne, go to Policy & Settings > Service Users > New Service User, limit the user to your site, give it the Admin role and copy the token. SentinelOne shows the token only once, when it is created, so copy it before you close that dialogue.

3. Click Connect. You know it worked when:

• SentinelOne appears in the Factorial IT main menu as a direct link to your console.
• The EDR - SentinelOne cards can be selected in the control catalogue.

How to use: deploy SentinelOne to your fleet

Deployment goes through your MDM controls.

1. Go to MDM > Controls > Add new control and pick the platform.
2. Switch on the card that matches your devices. Each card covers one platform and one architecture:

3. Set the targeting: all devices, specific device groups or a custom target. You do not need a device group per architecture. A card only applies to devices of its own platform and architecture, so mixed groups work fine.
4. Confirm. The agent installs automatically on every device the control covers.

macOS system profile

On macOS the agent needs a system profile that grants the system extension, Full Disk Access, notifications and the network filter. Without the profile the agent installs but stays partly inactive, and macOS asks the employee to approve things.

• Instance provided by Factorial IT: nothing to do. The control sends the profile together with the agent, so there is no .mobileconfig to build or upload.
• Your own instance (BYO): you provide the profile. Build it from the payloads SentinelOne publishes for your agent version, then open your macOS control in MDM > Controls and upload it as a Custom file. It works the same way as for CrowdStrike Falcon.

Exclude the Factorial IT agent from SentinelOne

SentinelOne may block, slow down or quarantine the Factorial IT agent. When it does, devices show as Missing agent or offline in Factorial IT even though people are using them (see Resolve enrolment issues).

On instances provided by Factorial IT, these exclusions are already on the SentinelOne policy. You only need this section with your own instance (BYO), where you add them for macOS and Windows.

In your SentinelOne console, add the paths below as Path exclusions. Scope them to the site connected to Factorial IT, switch on Include subfolders and set the mode to Interoperability.

Linux agents sit under the same /opt/orbit paths as macOS.

Modify or remove the control

Switch the card off in the control settings. This stops enforcement on new devices, but the agent stays on devices where it is already running.

Uninstall the agent from a device

Anti-tampering blocks any removal not approved from the console. If an employee runs the uninstaller, all it does is send you an uninstall request to approve or reject.

1. Get the passphrase. In the SentinelOne console, go to Agent management > Endpoints, open the endpoint and click Actions > Agent Actions > Show Passphrase.
2. Uninstall the agent. Either from the console (Actions > Uninstall) or from the command line with local admin rights:

macOS:

1. sudo sentinelctl unprotect --passphrase "passphrase"
   sudo sentinelctl uninstall --local

Linux: run it as root, because sudo on its own is not enough. Leave out --unquarantine and quarantined files are deleted rather than restored.

1. /opt/sentinelone/bin/sentinelctl control uninstall --passphrase "passphrase" --unquarantine

Windows: use the package downloaded from the console, not the one in Program Files. Restart the device afterwards.

1. msiexec.exe /quiet /norestart /x Agent_version.msi UNINSTALL_KEY="passphrase"

No passphrase? For an agent that never connected to a console, use an empty string. For an agent left over from a console that has been shut down, get the passphrase from that console if you can still log in. If not, on macOS start the device in Recovery Mode and follow SentinelOne's uninstall procedure from there. On Windows and Linux, ask SentinelOne Support instead of using a script from a forum.

Renew the Service User Token

SentinelOne service user tokens expire; their lifetime is chosen when the service user is created. When the token runs out, the integration stops syncing and protection statuses in Factorial IT go out of date.

Create a new service user in Policy & Settings > Service Users, then ask our team to swap the token in Factorial IT. The connected SentinelOne integration in MDM > Settings has no field for editing it.

Migrate to another SentinelOne console

To move endpoints from one SentinelOne console to another, first update the install scripts, then migrate the endpoints.

An endpoint can only move if it is online, has no open threats and is not in the middle of a full disk scan. Offline endpoints wait until they check in again. You need Global or Account-level permissions on the source console. If a partner provides the console, that level may belong to the partner rather than to you.

Get the destination site ready first. SentinelOne policies cannot be exported, so you rebuild them there. For a full tenant migration, SentinelOne Support can copy the configuration across for you.

1. Update the install scripts in Fleet.
   1. Open your Fleet instance.
   2. Open the Software tab and search for Sentinel (SentinelOne, Sentinel Agent and similar).
   3. For each package, click Edit, open Show advanced options and swap the old site token for the new one in the install script.
2. Migrate the existing endpoints. In your SentinelOne console, select the endpoints, go to Actions > Endpoint actions > Migrate endpoints, enter the new site token and confirm.

The token has to come from a site on the destination console. A token from the source console fails without any error, and the endpoints stay where they were.

Migration does no damage: if an agent cannot reach the new console within a few minutes, it stays registered on the old one.

1. Confirm, then tidy up the source console. Follow progress with the Console Migration Status filter under More filters: N/A, Pending or Migrated. The activity log of the source console also records the destination URL of each agent that moved.

Migrated endpoints remain in the source console, greyed out, and do not disappear by themselves. Decommission them once the destination console shows them as active, or shorten the decommission window so offline agents are cleared automatically. Until then, the same devices count on both consoles, so agree this with your provider before you begin.

1. Update the Factorial IT integration. Ask our team to change the Site ID, URL and Service User Token of the integration to the new console. The connected SentinelOne integration in MDM > Settings has no fields for editing them.

Unsupported platforms

If your platform is not in the tables above, you can still install SentinelOne by hand: download the installer from the SentinelOne console and deploy it as custom software.

Troubleshooting and FAQ

Troubleshooting

• The EDR - SentinelOne cards are greyed out. The integration is not connected yet. Connect it in MDM > Settings, or wait for our team if we provide the instance.
• Devices show as Missing agent or offline but are in use. SentinelOne is probably blocking the Factorial IT agent. Add the path exclusions above.
• macOS keeps asking the employee for approvals. The system profile is missing. On your own instance, upload it as a Custom file in your macOS control.
• Protection statuses have stopped updating. The Service User Token has probably expired. Create a new service user and ask our team to replace the token.
• Endpoints did not move after a migration. Check the token belongs to a site on the destination console. A source-console token fails without warning.

FAQ

1. Does switching off the control remove the agent?
   No. It stops enforcement on new devices, but the agent stays where it is already installed.
    
2. Can an employee uninstall the agent?
   No. Running the uninstaller only sends you a request to approve or reject.
    
3. Can I change the Service User Token myself?
   No. The integration has no field for it. Ask our team to replace it.
    
4. Do I need separate device groups for Intel and Arm devices?
   No. Each card only applies to devices of its own platform and architecture.