Already managed endpoints will have CEM turned on after they have received the CEM policy (this will be done once they become a member of that policy's target).
The CEM Agent package is for internet endpoints that are not currently managed.
The process for deploying a CeM Agent is the same installation process that you would use to get the agent installed on ANY device that is not connected to your LAN. This installation package would be sent to the target customer in this case and would simply be installed on the customer’s endpoint. Once installed the agent will report through the Internet Gateway to its destination Notification Server where it would be managed from.
NOTE: The Cloud-enabled Agent installation package is valid for a limited period of time. By default, it is valid for seven days from the time that it was generated. If you use this package to install the Agent after it has expired, the installed Agent is not able to use the SMP Internet gateway for communication. You then have to reinstall the Agent using a newly generated installation package. Other features in this installation package like Limiting the number of registrations, Signing using thumprint or file can be used to prevent malicious installation of this agent.