Skip to main content
Use this section to take Bifrost Edge from an unconfigured deployment to a verified device. Every Edge user signs in through your organization’s identity provider (IdP), so identity is configured first and the agent is installed last.

​
Before you begin

You need:
  • A running Bifrost Enterprise deployment with an Edge entitlement and an available device seat.
  • The externally reachable HTTPS URL of the Bifrost deployment.
  • A supported identity provider (Okta, Microsoft Entra ID, Keycloak, Zitadel, Google Workspace, Auth0, or a generic OIDC provider) and permission to register an application in it.
  • Access to Governance and Edge Control in the Bifrost dashboard.
  • The Edge agent package for each target operating system and architecture, from the organization-specific download location shared during Edge onboarding.
An identity provider is required. Edge sign-in is unavailable until user provisioning is configured in Bifrost, and the tray reports User provisioning not set up - contact your Bifrost admin.

​
Setup sequence

1

Configure the identity provider

Enable OIDC sign-in under Governance → User Provisioning. See Prepare identity and access.
2

Provision users

Import or sync the people who will run Edge. See Provision Edge users.
3

Assign roles and access profiles

Give each Edge user a role and an access profile so Bifrost can issue the governed virtual key that Edge traffic is attributed to. See Assign roles and access profiles.
4

Configure Edge

Create the Edge certificate and review the fleet settings in Edge Control → Edge Settings. See Configure Edge.
5

Install the agent

Follow either the direct installation or MDM deployment path.
6

Sign in and verify

Sign in with SSO, trust the certificate, restart the computer, and confirm that a supported AI request reaches Bifrost. See Sign in and verify.

​
Choose an installation path

Install directly

Download the package for one device and install it locally. Use this path for a pilot, a test device, or a device that is not managed through MDM.

Deploy with MDM

Push the package and managed configuration to a fleet. On macOS, also push the Edge certificate as a device-scoped trusted root.
Both paths install the same agent and use the same SSO sign-in. They differ in how the device receives its Bifrost URL and certificate trust.

​
Verify setup

Do not treat installation alone as a successful rollout. A device is ready when:
  • The tray shows the signed-in user and Connected.
  • The computer was restarted after the Edge certificate was first trusted or last replaced.
  • Edge Diagnostics reports Healthy.
  • The device appears under Edge Control → Devices with the expected owner and hostname.
  • A request from a supported application is visible in Bifrost logs, attributed to the signed-in user.

​
Next step

Start with Prepare identity and access.