I happened to see, after looking at it several times, the Community answer about Active Directory not being the source for machines. So, that answers part of my question.
In that case, if I manually install agents will they check in with the cloud? I'd guess that they do.
So then, is there a silent install option for the agent that I can push out?
Are you referring to Shavlik Protect agents? If so, the Agent Policy dictates where the agent will check-into so enabling the cloud settings will prompt the agent to check into the cloud before trying a direct connection to the Protect console.