> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Edge

> Create the Edge interception certificate and review the fleet settings before installing the agent.

Configure the fleet before installing the first device. In the Bifrost dashboard, go to **Edge Control → Edge Settings**.

<Frame>
  <img src="https://mintcdn.com/bifrost/VyjCXmeURRYr5ZtC/media/edge/edge-settings1.png?fit=max&auto=format&n=VyjCXmeURRYr5ZtC&q=85&s=2c74fd7183887d80989e5917c7999b89" alt="Bifrost Edge Settings page" width="2252" height="1480" data-path="media/edge/edge-settings1.png" />
</Frame>

## 1. Set up the certificate authority

Edge uses the configured certificate authority (CA) to inspect TLS traffic for configured AI domains. The CA certificate must be trusted by each device. Its private key remains on the Bifrost server for current agents, which request short-lived leaf certificates from the server.

<Tabs>
  <Tab title="Generate a CA">
    1. In **Certificate Authority**, select **Generate CA**.
    2. Generate the certificate.
    3. Store the displayed private key securely. It is shown in the generation result and is not available from the active-certificate view afterward.
  </Tab>

  <Tab title="Upload a CA">
    1. In **Certificate Authority**, select **Upload CA**.
    2. Paste the PEM-encoded certificate and its matching PEM-encoded private key.
    3. Save the CA.
  </Tab>
</Tabs>

After either path, confirm that the CA shows **Active** and record its SHA-256 fingerprint. The fingerprint is the value administrators use to confirm that a device or MDM profile contains the active certificate.

<Warning>
  Replacing the CA changes the certificate that devices must trust. A macOS MDM deployment must receive an updated trusted-root profile for the replacement certificate. After the new CA is trusted, restart every affected computer before testing or resuming governed traffic. The restart is required for the CA certificate change to take effect.
</Warning>

## 2. Review first-rollout settings

| Setting                                | What to decide before rollout                                                                                                               |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **Agent sync poll interval**           | How frequently agents check for configuration changes. The default is 60 seconds and the minimum is 5 seconds.                              |
| **Allow pending apps and MCP servers** | When enabled, newly discovered pending items continue to work. When disabled, they are blocked until approved.                              |
| **Allow virtual key sign-in**          | Whether a user can enter a Bifrost virtual key when no IdP sign-in is available.                                                            |
| **App routing modes**                  | Whether supported apps use managed gateway routing or, where offered, subscription passthrough.                                             |
| **Edge traffic interception**          | Confirm that the global state is **Interception Active** before testing. Scoped user or team decisions can still override the global state. |

Save any changes before continuing.

## 3. Download the CA for MDM

If you are deploying to macOS with MDM, select **Download .crt** from the active certificate view. You will use that exact certificate in the device-scoped trusted-root profile.

Direct installations do not require you to download the CA separately. The agent receives it from Bifrost after sign-in and establishes trust as described in the direct-installation guide.

## Choose the installation path

* [Install Edge directly](/edge/install-direct)
* [Deploy Edge with MDM](/edge/install-mdm)