Endpoint Agent · Step 6 of 8

Enable PAC Routing

To let the Quilr agent inspect AI-app traffic through its proxy path, route the monitored AI & collaboration hosts to the agent’s local proxy listening on 127.0.0.1:24080. Quilr ships a ready Proxy Auto-Config (PAC) file that does exactly this — contact Quilr support for the PAC file for your AI apps.

📩

Get the PAC file from Quilr support Email support@quilr.ai and request the AI-apps PAC file for your tenant. It is a standard application/x-ns-proxy-autoconfig document with a single FindProxyForURL(url, host) that sends monitored AI hosts to PROXY 127.0.0.1:24080 and everything else DIRECT.

ℹ️

When is this needed? The agent’s on-device interception (WinDivert driver on Windows, Network Extension on macOS) captures AI traffic without any system proxy. Use PAC routing when your deployment intercepts via the local proxy instead of — or alongside — an existing SWG. If you already run a PAC-based web filter, merge Quilr’s rule rather than replacing your file (see Step 1 · Coexisting with an existing PAC). If unsure which model applies, ask Quilr support.

1 · What the PAC does

The support-provided PAC matches the monitored AI & collaboration hosts and returns the local proxy for them, leaving all other traffic DIRECT:

FindProxyForURL — AI apps

function FindProxyForURL(url, host) {
    var quilrHosts = [
        "chatgpt.com", "*.oaiusercontent.com",
        "claude.ai", "api.anthropic.com",
        "gemini.google.com", "*.deepseek.com",
        "*.slack.com", "teams.microsoft.com"
        /* full list supplied by Quilr support */
    ];
    for (var i = 0; i < quilrHosts.length; i++) {
        if (shExpMatch(host, quilrHosts[i])) {
            return "PROXY 127.0.0.1:24080; DIRECT";
        }
    }
    return "DIRECT";
}

⚠️

Keep the host list authoritative Use the list inside the PAC file Quilr support sends — it is kept in sync with the monitored-apps set. The snippet above is illustrative and trimmed.

2 · Point the device at the PAC

Host the PAC file where managed devices can reach it (an internal HTTPS URL, or the hosted URL Quilr support provides), then set the OS proxy auto-configuration setting to that URL. Push it through your MDM the same way you deployed the agent in Step 5.

Intune → Devices → Configuration → Settings Catalog, search Proxy, enable Configure proxy server settings:

Proxy server type: Automatic proxy configuration
Setup script address: <your PAC URL>

Or per-browser via Edge/Chrome ProxySettings policy: ProxyMode = "pac_script", ProxyPacUrl = <your PAC URL>.

Deploy a Custom Configuration Profile (Device channel) with a com.apple.proxy.AutoConfig.url payload:

mobileconfig payload

<key>PayloadType</key>            <string>com.apple.proxy.AutoConfig.url</string>
<key>ProxyAutoConfigEnable</key>  <true/>
<key>ProxyAutoConfigURLString</key> <string><your PAC URL></string>

Windows — Settings → Network & internet → Proxy → Use setup script, paste the PAC URL.
macOS — System Settings → Network → <interface> → Details → Proxies → Automatic Proxy Configuration, paste the PAC URL.

3 · Confirm the route

After the PAC applies, a monitored AI host should resolve through the local proxy. Reload the agent’s policy or reboot, then open an AI site — the proxy on 127.0.0.1:24080 handles the TLS and a flow.matched event appears in the agent log (see the checks in Step 7 · Verify MDM Install).

🔎

Pair with SSL-bypass If an upstream SWG sits in front of these hosts, add the monitored AI hosts to its Do Not Decrypt list so it does not re-sign the certificate — otherwise the agent’s pinning fails regardless of PAC routing.

✅

Exit criteria for Step 6 PAC file obtained from Quilr support · PAC URL pushed to the pilot device’s proxy auto-config setting · a monitored AI host routes through 127.0.0.1:24080. Then continue to Step 7 to verify the rollout.

←BackMDM Rollout Step 6 of 8 NextVerify MDM Install→