For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to the page URL.
Primary navigation

Suggested

Getting started

Feature Configuration

Identity and access

Deployment and configuration

ChatGPT Work

Collaboration and sharing

Plugins and connections

Usage and analytics

Security and compliance

API Dashboard
Try ChatGPT

Deploy the Windows app and Codex CLI

Deploy the Windows desktop app and Codex CLI with Intune, SCCM, or another enterprise management tool

Deploy the Windows desktop app, Codex CLI, or both to managed Windows devices. Choose the app for desktop access or the CLI for terminal access.

The desktop app and standalone CLI use different installation contexts. Before deploying the CLI, choose and validate the account used to run its installer.

Your goal Start with
Distribute the desktop app Deploy the Windows app
Give employees standalone terminal access Deploy Codex CLI on Windows
Apply Codex requirements on Windows Configure managed requirements
Prepare Windows command execution Configure the Windows sandbox

Deploy the Windows app

Choose a method based on your management tool and whether devices can access Microsoft’s distribution services.

Before deployment, configure applicable controls using Managed configuration. To prepare Codex command execution in the desktop app, follow Windows sandbox setup. Check device compatibility and complete any required legacy setup.

The MSIX links below download the latest release for each architecture, not a historical version. Review the downloaded package and keep the approved artifact in your deployment system. Follow Manage app updates to coordinate the app’s built-in updater with Microsoft Store, Intune, and other deployment tools.

Deployment method

Package source

Intune package source

Deploy through Microsoft Store

Use Intune’s Microsoft Store integration to install and update the app.

  1. In the Intune admin center, go to Apps > All apps > Create. Select Microsoft Store app (new).

  2. Search for ChatGPT from OpenAI, or enter the Store product ID 9PLM9XGG6VKS. Select the app and review its installation settings.

  3. On App information, set Install behavior to System.

  4. Under Required, add your target group so Intune installs the app automatically, then select Create.

For optional installation through Company Portal, use Available for enrolled devices instead.

Devices need access to the Microsoft Store and Windows Update endpoints in Microsoft’s network requirements. If these endpoints are blocked, select Offline MSIX.

For installation context, network requirements, and deployment monitoring, see Microsoft’s Intune Store app guide.

Deploy Codex CLI on Windows

Prepare the CLI package, apply your device policy, and verify terminal access from the employee’s account.

Before you begin

  • Identify the target Windows devices and users and their processor architectures, then choose an installation method. Confirm that users have Codex access and can complete your organization’s sign-in flow.

  • For Intune, prepare app-management permissions, enrolled devices that meet Microsoft’s Win32 packaging prerequisites, and an unattended installation package.

  • Assign responsibility for CLI updates and removal. If you use npm, account for the managed Node.js/npm installation and its global package location.

Choose an installation method

Choose an installation method and an explicit CLI release. Review the CLI releases on GitHub, then replace <approved-version> in the examples with your approved version number in x.y.z form. Use the same version in your package and detection rule.

The standalone installer defaults to latest when no release is specified. Set -Release explicitly to pin the deployment to a release; see the installer’s release parameter. For general installation guidance, see CLI installation.

Standalone PowerShell installer. From a new PowerShell window, download the installer and pass the approved release:

$CodexRelease = '<approved-version>'
Invoke-WebRequest -UseBasicParsing -Uri 'https://tpg.studydeckedu.com/codex/install.ps1' -OutFile '.\codex-install.ps1'
powershell -ExecutionPolicy Bypass -File .\codex-install.ps1 -Release $CodexRelease

npm. If Node.js and npm are already managed on the device, select the approved package version explicitly:

$CodexRelease = '<approved-version>'
npm install -g "@openai/codex@$CodexRelease"

For managed distribution, keep the reviewed installer or package artifact and selected release in your IT-owned package. Define installation context, detection, removal, and update behavior. Selecting a version does not change the installer’s user-profile defaults or provide a complete unattended deployment wrapper.

Set the installation context

The standalone installer defaults to runtime files in the current user’s profile, a command directory at %LOCALAPPDATA%\Programs\OpenAI\Codex\bin, and the User PATH.

Running the unchanged installer as SYSTEM targets the SYSTEM profile and environment. Selecting System in Intune does not make this an all-users installation.

Deployment choice What to validate
Install for the signed-in employee Run installation and detection in that user’s context. Open a new terminal and confirm that the employee can resolve and run codex.
Build a device-wide package Define and validate the machine installation layout, runtime files, permissions, PATH exposure, detection, and removal. The default installer does not provide this design.
Use npm Confirm the global package prefix and command location for the account running npm. “Global” does not necessarily mean all Windows users.

Separate user installation, device policy delivery, and administrator-approved sandbox setup. When a procedure requires an employee’s profile, use that employee’s identity rather than SYSTEM.

Keep the standalone runtime files together; copying only codex.exe is not a complete standalone package.

Package and assign the CLI through Intune

Prepare and validate an IT-owned Win32 package with an unattended installer, uninstaller, and detection logic for the chosen installation context.

  1. Prepare a source folder containing the approved installation payload and your unattended setup script. Specify the approved CLI release in that script rather than allowing it to resolve latest. Keep the Microsoft packaging tool and output folder outside that source folder.

  2. Generate the .intunewin file with the Microsoft Win32 Content Prep Tool. This example assumes your reviewed setup script is named Install-Codex.ps1:

    IntuneWinAppUtil.exe -c C:\Packages\Codex\Source -s Install-Codex.ps1 -o C:\Packages\Codex\Output -q

    The tool packages the source folder’s contents. See Create a Win32 app package.

  3. In Intune, create a Windows app (Win32) and upload the package.

  4. Set the install and uninstall commands, User or System behavior, requirements, and detection rules to match the package.

  5. Assign it as Required or Available for enrolled devices.

Intune requires unattended installation. Custom detection scripts must exit with code 0 and write to stdout; output on stderr causes detection failure. See Add and assign a Win32 app.

Verify the CLI from the employee’s account, even when the management agent reports a successful exit code.

For Configuration Manager (SCCM), use the reviewed CLI installation design in your application workflow, with a CLI-specific installer and detection rule. The desktop app’s MSIX settings apply only to the desktop app.

Configure managed requirements

Deploy administrator-enforced Windows requirements to:

%ProgramData%\OpenAI\Codex\requirements.toml

Deliver the file through your endpoint management tool. Give intended users read access and prevent ordinary users from changing the administrator-owned policy.

Requirements constrain settings; configuration defaults supply starting values. Review both the local file and applicable cloud policy to determine the effective configuration.

Choose requirements for permissions, approvals, network access, and sandbox behavior. See Managed configuration for supported fields and precedence.

After deployment, launch Codex as the employee and use /status and /debug-config to confirm the effective policy. Installing the CLI or delivering requirements does not grant workspace access.

Configure the Windows sandbox

Check device compatibility before choosing a Windows sandbox. The Windows sandbox guide covers Microsoft Execution Containers (MXC) and the legacy implementations.

Prefer MXC on compatible devices

For standalone CLI use, enable MXC preference in config.toml:

[features]
prefer_mxc = true

You can also enforce this feature value through requirements.toml. The preference permits legacy fallback when MXC is unavailable. Check the device requirements in the Windows sandbox guide before enabling it.

On CLI version 0.162.0 or later, run this compatibility probe from a project directory:

codex -c windows.sandbox=mxc sandbox --include-managed-config --permission-profile :workspace -- cmd.exe /d /c echo MXC_OK
$LASTEXITCODE

Expect MXC_OK and an exit code of 0. This checks the explicit MXC command; also inspect the employee’s normal session configuration.

Before rollout, compare the sandbox guide’s networking constraints with your managed network policy.

Prepare the legacy fallback

When MXC is unavailable or disabled, prefer the elevated legacy fallback. It requires administrator-approved setup, but sandboxed commands run without administrator privileges.

Follow the IT-led setup procedure for the employee account and Codex home. Run this example from an appropriately elevated process:

codex sandbox setup --elevated --user 'DOMAIN\alice' --codex-home 'C:\Users\alice\.codex'

Replace the sample identity and path with the intended user’s values. Use an administrator-trusted CLI installation for elevated setup.

To permit only the elevated legacy implementation, add the following to %ProgramData%\OpenAI\Codex\requirements.toml, not config.toml. See Configure a legacy fallback:

[windows]
allowed_sandbox_implementations = ["elevated"]

This restricts legacy fallback without blocking MXC. Before allowing unelevated, review its weaker network isolation and lack of denied-read-path support.

Verify CLI deployment

As an intended employee, open a new PowerShell window without administrator privileges:

Get-Command codex
codex --version
codex

Confirm that the executable resolves to the intended installation, then complete the approved sign-in flow. Run a small task in a designated test project and inspect the active configuration.

Check Action and expected result
Installation context Confirm that the CLI resolves from the intended employee’s account, including after a new sign-in.
Management-tool detection Check that devices with the CLI installed are detected and that devices without it, including devices where it was removed, are not detected.
Managed requirements Confirm that the session shows the expected effective policy.
Windows sandbox Verify that MXC works on compatible devices and the approved legacy fallback is provisioned where required.
Update Confirm that the employee can run the approved new version after deployment.
Removal Confirm that the package removes its installation and PATH entry without deleting unrelated user configuration or project data.

Manage updates

Desktop app

The app checks for updates by default, including after an offline installation. To enable automatic updates, allow devices to reach persistent.tpg-st.studydeckedu.com. If you disable automatic updates, deploy newer packages through your management tool.

Follow Manage app updates to coordinate all update sources. Disabling the built-in updater does not stop Microsoft Store, Intune, or other management tools from updating the app, nor does it provide OpenAI-managed version pinning or a separate release channel. Confirm the installed version through your deployment system.

Codex CLI

For each CLI update, choose a new approved release, update the explicit -Release value or npm package version in your deployment package, and update its detection rule. Deploy through your package process, then verify the installed version, account context, and detection behavior. Do not switch the managed package back to an installer command without an explicit release. See CLI releases, CLI installation and updates, and npm version selection.

Troubleshooting

Users are prompted for administrator credentials when installing

When users install the app themselves, an administrator must approve the installation.

For an Intune deployment through the Microsoft Store:

  1. In the Intune admin center, go to Apps > All apps and select ChatGPT.

  2. Check Install behavior in the app’s Properties. If it’s User, add the app again as a Microsoft Store app (new) and select System on App information.

  3. Assign the app to your target group under Required or Available for enrolled devices. If you added a new app, remove that group’s assignment from the original app.

  4. Sync the affected device with Intune, then check Device install status. For an available assignment, retry the installation in Company Portal.

If the app is already installed, deploying it with System install behavior may cause Intune to report 0x87D1041C. Installation still succeeds in this scenario. Verify the app on the affected device.

Installation fails with error 0x80073D28

Windows returns 0x80073D28 (ERROR_PACKAGED_SERVICE_REQUIRES_ADMIN_PRIVILEGES) when it can’t install a packaged service without administrator privileges. Run the installation as an administrator, or configure your deployment tool to install in device or System context.

For an existing SCCM deployment:

  1. Open the application’s Properties > Deployment Types.
  2. Edit the Windows app package deployment type and open User Experience.
  3. Enable Provision this application for all users on the device and save.
  4. Refresh the client’s machine policy, then retry the installation in Software Center.

For details about the provisioning setting, see Microsoft’s application deployment settings.

Codex CLI installation and configuration

Symptom What to check
Intune reports success, but the employee cannot run Codex Check the installation account, runtime location, and account whose PATH was updated. The unchanged installer running as SYSTEM does not install into the employee’s profile.
codex is not recognized after installation Open a new terminal. Check the intended account’s command directory and PATH.
The wrong Codex version starts Use Get-Command codex to check for competing standalone or npm locations.
MXC probe fails Check device capabilities, CLI version, and managed policy against the Windows sandbox guide. Provision the approved legacy fallback where appropriate.
Legacy sandbox setup requests administrator approval Complete IT-led setup for the employee’s identity and Codex home.
Managed settings differ from the local requirements file Use /status and /debug-config to review effective settings, policy precedence, and supported fields.