Pult Agent
A lightweight desktop application for automatic office presence detection on macOS, Windows, and Linux.
The Pult Agent is a lightweight desktop application that runs in the system tray and automatically detects when an employee is in the office. It works by periodically checking the device's network connection against configured office IP subnets.
How It Works
- The agent runs silently in the system tray after installation.
- It periodically sends a presence beacon to Pult, including the device's local IP addresses.
- Pult checks the beacon's source (public) IP and the reported local IPs against the presence location subnets.
- If a match is found, the user is recorded as present at that location.
- The resolved office location is displayed in the agent's tray menu.
The agent works over both WiFi and wired (LAN) connections -- unlike WiFi Presence, it is not limited to WiFi-connected devices.
Supported Platforms
| Platform | Architecture | Installer |
|---|---|---|
| macOS | Intel and Apple Silicon (universal binary) | .dmg (manual) or .pkg (MDM) |
| Windows | x86_64 and ARM64 | .msi |
| Linux | x86_64 | .deb |
Two Deployment Paths
Manual Installation
Employees download the agent, install it, and sign in with their Pult account via the browser. Suitable for smaller teams or testing.
See the Installation Guide.
Automated Rollout (MDM + Bootstrap Token)
IT deploys the agent centrally via an MDM system and uses a bootstrap token for hands-free enrollment. Employees don't need to sign in manually.
- Generate a bootstrap token in the Pult Dashboard.
- Deploy the agent and token via your MDM. See MDM Deployment.
- Approve incoming device authentication requests in the dashboard.
VPN Considerations
If employees use a VPN (especially a full-tunnel VPN), the VPN may route the agent's beacon through the VPN tunnel instead of the office network, preventing IP-based matching.
To resolve this, configure your VPN to exclude the Pult beacon endpoint from the tunnel (split-tunnel exclusion):
- Subnet to exclude:
18.96.35.116/30
This ensures beacons are sent directly from the office network's public IP, allowing Pult to correctly identify the office location.
Network Requirements
- Each office must have a static public IP (or small, stable IP range).
- The agent must be able to reach
gql.api.pult.comover HTTPS (port 443). - If using a VPN, the exclusion subnet above must be configured.
Next Steps
Last updated on Apr 20, 2026, 1:03 PM