Deploying Scout at scale
The rollout order that saves the most work — import first, then agents — plus preconfigured per-tenant installers, enrollment tokens, central policy, coverage checks, and retirement with credential revocation.
Getting agents onto the estate
ITAM data is only as good as its coverage, so the rollout matters. This article is the ITAM-shaped summary of deploying VerOps Scout across a fleet — the order to do things in, and the decisions that are hard to change later. The mechanics of each installer live in the Scout category and are not repeated here.
The order that saves the most work
- Import your spreadsheet of record first. Load asset tags, custodians, locations and purchase records via asset import before agents roll out. As each machine enrolls, the agent merges into the record you already prepared instead of creating a bare new host you then reconcile by hand. This is the single highest-leverage step in the whole rollout.
- Decide your groups. Groups drive tracking rulesets, policy overrides and license scoping. An agent can be auto-assigned to a group at enrollment, so decide the shape before you mint tokens rather than re-grouping thousands of machines afterwards.
- Set the collection policy. Which modules are on, their cadences, and your trusted office networks for presence. Policy applies on each agent's next poll, so it is genuinely changeable later — but starting close to right avoids a fleet-wide re-poll and a confusing first week of data.
- Roll out agents. Pilot group first, then by department or site.
- Work the review queue and write matching rules. Normalization quality determines license accuracy — see Software and products.
- Turn on the recurring packs. Once coverage is real, put the true-up and patch-posture reports on a schedule.
Preconfigured installers and enrollment tokens
The fleet-friendly path is the preconfigured installer built for your organization under Inventory → Agents → Deploy Scout. It embeds your backend URL, organization, optional group and a limited-use enrollment token, so deployment needs no per-machine configuration file editing at all — push it through your normal software distribution tooling and machines appear in Inventory on their own.
On first start each agent exchanges the shared enrollment token for its own revocable per-device credential, which it stores locally. From then on the token is irrelevant to that machine. Two consequences matter at fleet scale:
- you are not distributing one long-lived organization-wide key to thousands of endpoints;
- you can revoke one machine — when a laptop is lost, sold or retired — without touching any other agent.
The full model, including the authentication precedence and the state-file locations, is in Enrollment and device credentials. Installation specifics for each platform are in Installation and enrollment.
Servers
Do not install Scout on machines that already run the Machine Agent. Enable its built-in inventory module instead — it reports into the same estate, with the same contract and the same central policy. See Software inventory module.
Coverage checks worth running
| Check | Why it matters for ITAM |
|---|---|
| Hosts still showing origin Imported | Either genuinely agentless (a switch, a printer) or a rollout gap. Distinguishing the two is the coverage question. |
| Assets in the stale lifecycle state | Machines that stopped reporting — decommissioned without being retired, or an agent that has failed. |
| Unknown update posture | Agents older than Scout 0.4.0 / Machine Agent 0.3.0, or the module switched off. See Patch posture. |
| Licenses reading No entitlements | Consumption is being measured with nothing to compare it against — the entitlement lines have not been entered yet. |
Retirement and revocation
When a machine leaves the estate, do both: retire the asset so it stops counting toward license consumption while keeping its history and financial record, and revoke its device credential under Inventory → Agents so the machine cannot report again. Retiring alone leaves a live credential on hardware you no longer control; revoking alone leaves the asset inflating your compliance position.
Note: Upgrading agents needs no re-enrollment. A machine's device credential survives an upgrade, so rolling Scout 0.3.0 forward to 0.4.0 simply adds the new update-posture facts to the asset you already have.