> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Endpoints

> Enroll Beacon on your endpoints with your self-hosted Asymptote deployment.

> [!NOTE]
>
> **Planned release.** Self-hosted Asymptote is in development and offered to design partners through a Private Deployment engagement; the Helm chart and Terraform modules described in this section are not generally available yet. This section describes the planned release: chart names, values keys and paths may change before it ships. Today's Asymptote Cloud dashboard uses hosted services for sign-in and product analytics; the self-hosted release replaces them, as described in [System Architecture](https://docs.asymptotelabs.ai/self-hosting/system-architecture.md#hosted-services-in-asymptote-cloud). [Contact us](https://asymptotelabs.ai/contact) to take part.

Beacon is the same on every hosting option. On a self-hosted deployment, you point it at your own dashboard URL when the device enrolls. After that, its telemetry and policy checks go only to your deployment.

## Enroll a device

The CLI's default service is beacon.sh, so always name your deployment.

> [tab] System mode (fleets)
>
> System mode is the usual mode for a managed fleet. As root, run:
>
> ```bash theme={null}
> sudo beacon endpoint connect --system --dashboard-url https://<domain>
> ```
>
> A browser opens on your dashboard, and a member of your organization approves the device. Use `--no-browser` to print the approval URL instead.

> [tab] User mode
>
> In user mode, the person's own sign-in authorizes the device. Sign in first, then connect with the same URL:
>
> ```bash theme={null}
> beacon login --auth-url https://<domain>
> beacon endpoint connect --dashboard-url https://<domain>
> ```
>
> `connect` refuses a URL that differs from the signed-in service.

Setting `BEACON_DASHBOARD_URL=https://<domain>` in the environment does the same as `--dashboard-url`, which helps in MDM scripts.

## Roll out with your MDM

Install the Beacon package with your MDM, then run the connect step on each machine. The [MDM guides](https://docs.asymptotelabs.ai/mdm.md) cover packaging and rollout; use your deployment's URL wherever they connect to Asymptote.

## Policy enforcement

With [policy enforcement](https://docs.asymptotelabs.ai/manage/policy-enforcement.md) on, the hooks on a connected device send their live checks to the `policy` service in your cluster. Turn it on per device with `sudo beacon endpoint enforcement enable`; the device must be an Apple Silicon Mac connected in system mode. `enable` downloads the enterprise Beacon package through your deployment, which fetches it from GitHub; to keep the cluster off GitHub, deploy the enterprise package with your MDM and then run `enable`.

## Check it

```bash theme={null}
beacon endpoint status --system --json
```

Its `managed_ingest` block reports the device as connected to your domain, and the credential check passes. Run an agent session, and it appears on the dashboard within a minute.

## Move devices from Asymptote Cloud

On each device, disconnect from Asymptote Cloud, then connect to your deployment:

```bash theme={null}
sudo beacon endpoint disconnect --system
sudo beacon endpoint connect --system --dashboard-url https://<domain>
```

Then revoke the devices on Asymptote Cloud's Beacon Endpoints page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.