Practical AI Guides

English

简体中文

English

简体中文

Appearance

Enterprise IT Deployment: MDM, Network Allowlisting, and Identity Integration ​

The Goal in One Sentence ​

Grok Bot enterprise deployment means delivering the client to members through your existing MDM, firewall, and identity systems—IT doesn't need to build a separate process for it.

Prerequisites ​

  • You've completed the previous lesson, "Team Rollout: Shared Bots, Templates, and Admin Controls," and have dashboard admin permissions.
  • You have the necessary tools in place: an MDM (any one of Jamf, Kandji, Intune, ConfigMgr, Ansible), an egress firewall or proxy, and an Okta or Entra ID admin console.
  • You've decided on the target version: enterprise deployments pin a version, and you decide when to upgrade.

Follow Along ​

Step 1: Push the Grok Bot pinned-version installer via MDM ​

Get the versioned installer from the Download Grok Bot entry in the dashboard or from the release feed, then push it to members' devices using your existing Jamf, Kandji, Intune, ConfigMgr, or Ansible.

To script the packaging: read https://api2.cursor.sh/updates/api/download/stable/{platform}/sand, replace {platform} with the target platform (darwin-arm64, darwin-x64, win32-x64-user, win32-arm64-user, linux-x64, linux-arm64), and download the file it points to.

Expected result: macOS installs .dmg, Windows installs Setup .exe, Linux uses .deb/.rpm/AppImage; everyone is on the same version, and you schedule the upgrade window.

Boundary reminder: MDM only manages the app on members' devices; the hosted computer where the Bot does its work is a cloud Linux machine and is not enrolled in MDM. To install your own tools on it, Enterprise teams use Team Setup Scripts.

Step 2: Allow network traffic and disable TLS inspection ​

On your egress firewall or proxy, allow *.cursor.sh, *.cursor-cdn.com, *.cursorapi.com, *.cursorvm.com (note that the two-level wildcard *.*.cursorvm.com must also be allowed) as well as cursor.com and downloads.cursor.com (desktop installation and updates go through these two).

Also disable TLS inspection and response buffering for these domains; otherwise logins and long-lived connections tend to break.

Expected result: client logins, auto-updates, and Bot sessions are no longer cut off by the proxy.

Network Controls in the dashboard (visible only to Enterprise teams, under Grok Bot page's Network → Grok Bot Network Access) offers three modes: Allow All Network Access (allow everything; the default for teams with no policy set), Defaults + Team Allowlist (official default destinations plus your list), and Team Allowlist Only (only your list and the destinations required for the computer to run); the Apply to MCP servers toggle appears only in the two Allowlist modes—when enabled, MCP traffic is also allowed per the same list.

Step 3: Integrate Okta/Entra ID and define the scope ​

In Okta or Entra ID, assign the Cursor app to the members who need Grok Bot, then go back to the dashboard to define the access scope.

Expected result: members sign in with their company accounts; anyone not assigned cannot get in.

If the Bot needs to access the internal network: have members' desktops go through routing, or use Team Setup Scripts to install networking clients like Tailscale or Cloudflare Tunnel on the hosted computer.

On the security side, there are also shared static egress ranges and data residency (currently US only) options, both enabled through the Cursor account team; the unified provisioning and usage terms for the Enterprise tier are not publicly documented—contact the account team for those as well.

Verify ​

  • Pick a managed device whose client version matches the version you pinned.
  • Sign in once on the network where traffic has been allowed; the session works normally with no proxy errors.
  • Try signing in with a test account that hasn't been assigned the Cursor app; it should be blocked.

Common Pitfalls ​

  • Allowing only the one-level wildcard and missing *.*.cursorvm.com—the Bot can't reach the cloud computer.
  • Enabling TLS inspection or response buffering on Cursor domains; the symptom is getting stuck at login.
  • Trying to manage the hosted computer with MDM—it isn't enrolled in MDM; the correct entry point is Team Setup Scripts.
  • Counting on the pinned version to block updates: the macOS/Windows/AppImage clients have no policy or setting that turns off desktop updates—members' clients will still receive new versions, and the only option is for members to turn off Automatic Updates themselves, deferring installation until a manual restart (when the version is more than 14 days old and a newer version exists, a full-screen Update required prompt forces the update); the only places where you truly control the upgrade cadence are Linux .deb/.rpm (via package managers).

Next Lesson ​

After wrapping up Grok Bot enterprise deployment, take your members' questions into FAQ: Models, Limits, and the Official Line.