Harmony Endpoint deployment and architecture
This domain tests how you choose and build the management layer for Harmony Endpoint, how clients register and receive content, and how you scale and upgrade without breaking policy delivery. Expect questions that contrast the on-premises Endpoint Security Management Server with cloud management through the Infinity Portal, and that ask you to place distribution servers and deployment agents correctly.
Management models
- On-premises: Endpoint Security Management Server on a supported Windows Server with a SQL database, Web Management console, and optionally the legacy SmartEndpoint console. You own backups, high availability, and upgrades.
- Cloud: Harmony Endpoint managed in Infinity Portal. Clients receive a provisioning key or deployment package and connect outbound over HTTPS 443; there is no customer-managed database.
- A client is registered to exactly one management. Mixing registrations causes policy and status conflicts.
Components and traffic
- The management server stores policy, logs, and endpoint status.
- A Distribution Server caches content and packages close to endpoints; it is not a second management server.
- The Deployment Agent discovers endpoints and can install the client automatically.
- Agents need HTTPS to management or distribution; cloud requires outbound 443 through any proxy, with the proxy configured in the package.
Deployment sequence
License and tenant or server, create package or provisioning key, distribute via GPO, SCCM/Intune, MSI, email link, or deployment rule, verify agent connected, assign policy profile, then install policy. Upgrades normally follow management compatibility first, then client packages.
Worked example
A company has 1,200 endpoints across three low-bandwidth sites. HQ can host a management server; WAN links are saturated at month end. Rather than force every client to pull content across the WAN, place a distribution server at each site and point site packages to the local distribution server. Use AD groups and a deployment rule to install only to the pilot OU first. Reasoning: management and policy remain centralized, content is local, and the pilot limits blast radius. If the company had no server team, cloud management in Infinity Portal would remove server maintenance but still require outbound 443 and a provisioning process.
Traps
- Treating a distribution server as a management server or expecting it to hold policy.
- Opening inbound ports to endpoints instead of allowing outbound HTTPS.
- Deploying to all OUs before validating a pilot.
- Upgrading clients beyond the management server's supported version.
- Forgetting that a cloud-managed client cannot be managed by an on-premises server at the same time.