AlphaSense for PowerPoint and Excel - IT Admin Guide: Individual Deployment

This guide covers the technical details of AlphaSense's individual (self-install) deployment path. Use this when users install AlphaSense themselves, or when IT distributes the installer without using Microsoft 365 Admin Center for add-in deployment.

• Architecture Overview
• What Gets Installed
• Prerequisites
• Distribution Options
• Network Requirements
• Policy Controls
• Monitoring and Support
• Upgrade Path to Centralized Deployment
• Uninstall Behavior

Architecture Overview

AlphaSense for Office consists of two components:

User's Machine
|
+-- AlphaSense App Manager (Electron desktop app)
|    +-- Python backend       (OS-assigned port)
|    +-- Excel backend        (OS-assigned port)
|    +-- Service discovery    (localhost:8100+)
|
+-- Office Add-in (PowerPoint & Excel)
     +-- Taskpane UI loaded from <https://plugins.alpha-sense.org/>...
     +-- Connects to local backends via service discovery

The add-in frontend is hosted externally on AlphaSense infrastructure. The local App Manager provides backend AI services (slide processing, spreadsheet operations, document analysis) that the frontend connects to via http://localhost.

Note: Both the PowerPoint and Excel add-ins are generally available. App Manager can launch either host app with the AlphaSense taskpane ready.

In the individual deployment path, the installer also registers the add-in with Office via WEF Developer registry entries, so Office knows to load the add-in for the current user.

What Gets Installed

Installation Location

All files are installed under the current user's profile. No admin privileges are required.

Registry Entries

The installer creates these per-user registry entries:

Add-in IDs and Public Manifest URLs

AlphaSense publishes the add-in in two formats:

• Classic XML manifest — what App Manager registers on each machine in this guide. Nothing to choose or upload; App Manager handles it.
• Unified manifest — Microsoft's newer format, a .zip with a manifest.json inside. It can only be deployed through Microsoft 365 Admin Center; Office has no way to register it locally. You only need it if you move to centralized deployment (see IT Admin: Centralized Deployment).

The two formats have different add-in IDs, so Office treats them as separate add-ins:

After installing the online App Manager, the same files are also bundled at:

%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Ppt Add-In\manifest-ppt.xml
%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Ppt Add-In\AlphaSense-for-PowerPoint.stable.zip
%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Excel Add-In\manifest-excel.xml
%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Excel Add-In\AlphaSense-for-Excel.stable.zip

Prerequisites

Microsoft Edge WebView2 Runtime (Evergreen)

On Windows, the Office add-in taskpane renders in the Microsoft Edge WebView2 Runtime (Evergreen), which must be present and reasonably current. Enterprises that block msedgeupdate via GPO, run LTSC images, or strip Edge from golden images may lack it — the symptom is a blank taskpane that never loads. Following Microsoft's detection guidance (https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution#detect-if-a-suitable-webview2-runtime-is-already-installed), check the pv (REG_SZ) value at both of these keys — the runtime can be installed per-machine or per-user:

HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv
HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv

The runtime is installed only if at least one of the two values exists, is non-empty, and is a version greater than 0.0.0.0 (a literal 0.0.0.0 is an uninstalled placeholder and must be treated as missing). On 32-bit Windows the HKLM key has no WOW6432Node segment. If neither key qualifies, install the runtime with the Evergreen Standalone Installer from Microsoft (https://developer.microsoft.com/en-us/microsoft-edge/webview2/).

Distribution Options

Option 1: Direct User Download

Users download the installer directly:

<https://plugins.alpha-sense.org/app-manager/channels/stable/AlphaSense-App-Manager-Setup-latest.exe>

The user runs the installer, selects "Local registration" on the deployment mode page, and follows the prompts.

Option 2: Silent Installation

The NSIS installer supports silent mode:

AlphaSense-App-Manager-Setup-latest.exe /S

In silent mode, the installer uses the default deployment mode (local registration). To override the deployment mode in a scripted install, set the environment variable before running:

$env:CAROUSEL_DEPLOYMENT_MODE = "local"
AlphaSense-App-Manager-Setup-latest.exe /S

Option 3: Intune / SCCM Distribution

Package the installer EXE for deployment via Microsoft Intune or SCCM:

• Install command: AlphaSense-App-Manager-Setup-latest.exe /S
• Uninstall command: "%LOCALAPPDATA%\Programs\AlphaSense App Manager\Uninstall AlphaSense App Manager.exe" /S
• Detection rule: File exists at %LOCALAPPDATA%\Programs\AlphaSense App Manager\AlphaSense App Manager.exe
• Install behavior: User context (required) — see the warning below
• Restart behavior: No restart required

With this command line, install behavior MUST be "User", not "System/Device".

Setup.exe /S on its own is a per-user install that lays the app down under the launching user's %LOCALAPPDATA%\Programs. Intune Win32 apps default to device (SYSTEM) context; run as SYSTEM without the /allusers switch, a per-user install would land in C:\Windows\System32\config\systemprofile\AppData\Local, a profile no interactive user can launch. The installer refuses this combination: it exits with code 1603 and writes the reason to %TEMP%\carousel-installer-trace.log (C:\Windows\Temp for SYSTEM), so the deployment reports a failure instead of a phantom success. Set Install behavior = User in the Win32 app configuration, or use the machine-wide alternative below.

Autopilot ESP device-phase deployment does not work with this command line either; assign the app to users and let it install in the user Enrollment Status Page phase (or post-enrollment).

Device-context alternative: machine-wide install

If you do need a device-context or Autopilot device-phase deployment, add the /allusers switch. This installs the app into Program Files and the backend components once into %ProgramFiles%\CarouselAppManager, shared by every user on the machine (both paths sit under Program Files, so default AppLocker/WDAC rules need no custom exclusions):

• Install command: AlphaSense-App-Manager-Setup-latest.exe /S /allusers
• Detection rule: Registry — HKEY_LOCAL_MACHINE\Software\AlphaSense\CarouselAppManager, value InstallScope equals machine, 64-bit view
• Install behavior: System (device context)

The trade-off is that updates become IT-owned: App Manager no longer updates its components or itself (the app sits in Program Files, which a user session cannot replace), so every update is an elevated installer re-run. Add-in registration stays per-user either way.

There is still no MSI variant; the EXE is the only package.

Machine-wide install is the right choice for shared workstations and RDS/AVD session hosts. Option 4 below covers the standalone machine-wide workflow (detection caveats, pinned updates, .locked manifests).

Option 4: Standalone Installer

For air-gapped or restricted network environments, use the standalone installer variant. This bundles all backend components into the installer so no downloads are needed after install.

Contact AlphaSense for the standalone installer package. The resulting file is named AlphaSense-App-Manager-Setup-{version}-standalone.exe.

Download URL (production online installer):

<https://plugins.alpha-sense.org/app-manager/channels/stable/AlphaSense-App-Manager-Setup-latest-standalone.exe>

When the standalone installer runs, it:

• Installs machine-wide only (no current-user option). Setup.exe /S is enough.
• Uses bundled component archives instead of downloading
• Disables automatic component updates (shows "Managed by your IT administrator" in the UI)
• Sideloads locked Office manifests (manifest-ppt.<channel>.locked.xml / manifest-excel.<channel>.locked.xml) whose page URLs point at the stable CDN loader (…/channels/<channel>/loader/…). The loader then hops to the frontend version pinned in machine state. Do not replace those with a latest/ manifest — that would float the taskpane off the pin.
• Also ships locked unified packages (AlphaSense-for-PowerPoint.<channel>.locked.zip / AlphaSense-for-Excel.<channel>.locked.zip) in the same resources folders. These are only for Microsoft 365 Admin Center — local registration always uses the XML file. If you deploy through M365 instead, see IT Admin: Standalone Centralized Deployment.
• Ribbon icons stay on latest/assets/; only taskpane/commands/login pages are loader-locked.
• Is not supported on VMs. Multi-user / shared-session hosts are still under test.

Network Requirements

Scope of Allowlisting

Do not validate allowlisting only by opening the URLs in a browser. The same destinations must be reachable by the local AlphaSense desktop runtime:

• AlphaSense App Manager (%LOCALAPPDATA%\Programs\AlphaSense App Manager\AlphaSense App Manager.exe)
• the App Manager updater and component installer
• the Office WebView taskpane hosted by PowerPoint
• local Python/Excel helper processes launched from %LOCALAPPDATA%\CarouselAppManager\components\

Corporate DNS, secure web gateways, endpoint firewalls, TLS inspection, and proxy policies must allow these non-browser processes to resolve and connect to the required endpoints. A browser-only allowlist is not enough: deployment can still fail if App Manager cannot fetch https://plugins.alpha-sense.org/app-manager/channels/stable/components/manifest.json, typically logged as getaddrinfo ENOTFOUND plugins.alpha-sense.org or a component installation failure.

Outbound HTTPS

If your organization tests release-candidate or development channels, also allow the corresponding non-production AlphaSense endpoints:

Some features may receive short-lived, pre-signed AWS S3 URLs from AlphaSense services for image/report upload or download. If your proxy blocks those requests, allow HTTPS access to the generated S3 URLs or use a policy that permits pre-signed AWS S3 traffic initiated from the AlphaSense add-in/App Manager.

Authenticated proxies

Proxies that require integrated Windows authentication (NTLM/Negotiate/Kerberos with single sign-on) work automatically — no configuration needed.

Proxies that require explicit (Basic-auth) credentials are supported by setting two environment variables for the App Manager process:

When set, the App Manager supplies these credentials for proxy authentication challenges on both application traffic and update downloads. If they are not set and the proxy demands explicit credentials, outbound requests will fail — prefer an SSO-integrated proxy, or the standalone installer (Option 4) to avoid install-time egress.

Local Ports

App Manager discovery uses a predefined port range from 8100 through 8109. The Python and Excel backends are assigned available ports by the OS at startup. All local services bind to http://localhost only. No inbound firewall rules are needed, but endpoint security tools must allow the Office WebView and App Manager to communicate with http://localhost loopback URLs.

Policy Controls

Control App Manager behavior via environment variables. These can be set system-wide, per-user, or via Intune/GPO.

When component or shell updates are disabled, the Updates page in App Manager shows "Managed by your IT administrator" and the update button is disabled.

VDI / RDS Environments

• Non-persistent VDI: the downloaded backend component store lives under %LOCALAPPDATA%\CarouselAppManager by default, which is typically discarded on logoff and re-downloaded every session. Set CAROUSEL_SHARED_DATA_PATH to an absolute path on a persistent volume (e.g. a location included in the FSLogix profile container) to keep components across sessions, or deploy the standalone installer (Option 4) so no downloads are needed. Because this root also holds per-user state (workbook/presentation registries, deployment mode), App Manager scopes the override to a per-user subdirectory automatically — do not point multiple users at the same final directory. On first launch with the override active, an existing %LOCALAPPDATA%\CarouselAppManager component store is migrated into the new location automatically (including re-pointing the installed-component records at the new root), so enabling it does not force a re-download. Recent workbook/presentation lists are not migrated and reset once when the override is first enabled.
• Use a local-volume path, not a network share: the redirected root contains executable content (the Python backend runtime). Point the override at a path that presents as a local volume — e.g. inside the FSLogix profile container VHD(X) — not at a UNC path (\\server\share\...). Executing unsigned binaries directly from an SMB share is blocked or heavily penalized by Defender ASR, AppLocker, and most EDR policies, and adds network latency to every backend start.
• Secure the shared root (required on multi-session hosts): App Manager trusts the contents of its per-user directory once components are installed. If the root is writable by all users (e.g. a world-writable folder on a shared volume), one user could pre-create another user's subdirectory and plant content that App Manager would later execute as that user. Provision the root so users cannot create or modify each other's subdirectories: either pre-create per-user directories with owner-only ACLs, place the root inside each user's profile (where the profile container already enforces isolation), or apply CREATOR OWNER-scoped ACLs on the root. Do not deploy a host-wide override onto an unsecured, world-writable directory.
• Update security-tool exclusions: any Defender/EDR, ASR, AppLocker, or WDAC exclusions or allow rules that reference the default %LOCALAPPDATA%\CarouselAppManager tree must be extended to cover the redirected root, since the backend runtime now runs from there.
• Multi-session hosts (RDS / Citrix): App Manager service discovery uses local ports 8100-8109, and each user session needs its own port. At most 10 concurrent user sessions per host are supported today.

Monitoring and Support

Diagnostics

Users can open App Manager and navigate to the Diagnostics page to see:

• Helper status: Whether Python and Excel backends are running, with PID and port
• Frontend status: Whether the add-in's web origin is reachable
• Add-in registration: Whether WEF Developer entries are active

Report Export

Users can click Report Issue in App Manager to export a diagnostic report that includes:

• System information
• Component versions and state
• Backend health status
• Log excerpts

Taskpane is blank / won't load

A blank white taskpane that never renders usually means the Microsoft Edge WebView2 Runtime is missing or blocked on the machine. See Prerequisites above for the detection registry key and remediation. If the runtime is installed, also confirm the taskpane origin (plugins.alpha-sense.org) is reachable from the Office WebView process (see Network Requirements above).

Component installation fails even though the URL opens in a browser

This usually means the browser has internet access but App Manager or its helper processes do not. Check the App Manager component install log for errors such as:

manifest fetch (<https://plugins.alpha-sense.org/app-manager/channels/stable/components/manifest.json>) failed: getaddrinfo ENOTFOUND plugins.alpha-sense.org
Install failed: getaddrinfo ENOTFOUND plugins.alpha-sense.org

To resolve:

• Confirm plugins.alpha-sense.org is allowed for AlphaSense App Manager.exe, not just for Chrome or Edge.
• Confirm DNS resolution is available to desktop applications and services launched from the user profile.
• Confirm proxy or TLS inspection rules allow App Manager's component manifest and package downloads.
• If online component downloads cannot be allowed, deploy the standalone installer (Option 4) instead.

Log Locations

Component State File

The file at %LOCALAPPDATA%\CarouselAppManager\components\installed-components.json contains:

{
  "schemaVersion": "1.0",
  "updatedAt": "2026-03-26T...",
  "deploymentMode": "local",
  "components": {
    "python-backend": {
      "version": "1.2.3",
      "path": "...",
      "installedAt": "..."
    }
  }
}

Upgrade Path to Centralized Deployment

If your organization later decides to move to Microsoft 365 Admin Center deployment:

1. Deploy the add-in manifest via M365 Admin Center (see IT Admin: Centralized Deployment).

2. On each machine, either:

• Reinstall App Manager and select "Managed by IT through Microsoft 365 Admin Center," or
• Set CAROUSEL_DEPLOYMENT_MODE=m365_admin_center as an environment variable.

3. App Manager will stop managing local Office registration and defer to the M365 deployment.

The existing App Manager installation and backend components remain in place — only the Office registration method changes.

Uninstall Behavior

The uninstaller:

1. Removes WEF Developer registry entries for both add-in IDs.
2. Deletes %LOCALAPPDATA%\CarouselAppManager\ (components, manifests, state).
3. Removes the auto-start Run key.
4. Removes the Electron application files.

During upgrades (when electron-builder detects an update rather than a fresh uninstall), cleanup is skipped to preserve component caches and avoid unnecessary re-downloads.