AlphaSense for PowerPoint and Excel - IT Admin Guide: Centralized Deployment

Deploy AlphaSense to your organization with Microsoft 365 Admin Center (delivers the Office add-in) plus AlphaSense App Manager on each machine (local AI, slide, and Excel backends). You host nothing — the taskpane loads from https://plugins.alpha-sense.org.

• Step 1 — Deploy the add-in via M365 Admin Center
• Step 2 — Distribute App Manager
• Step 3 — Policies (optional)
• Prerequisites & environment notes

IT readiness checklist

• Pick a manifest format for each app — classic XML or the newer unified .zip (Step 1). Never assign both formats of the same app to the same users.
• Deploy AlphaSense for PowerPoint and Excel in M365 Admin Center (Step 1) and assign users/groups — allow up to 24h to sync.
• Standalone fleets: upload the locked files from the standalone install folder instead (%ProgramFiles%\AlphaSense App Manager\resources\Carousel Ppt Add-In\ and ...\Carousel Excel Add-In\) — manifest-ppt.stable.locked.xml / manifest-excel.stable.locked.xml, or AlphaSense-for-PowerPoint.stable.locked.zip / AlphaSense-for-Excel.stable.locked.zip.
• Distribute App Manager silently: AlphaSense-App-Manager-Setup-latest.exe /S /DeploymentMode=m365_admin_center (or standalone: AlphaSense-App-Manager-Setup-{version}-standalone.exe /S).
• Set CAROUSEL_DEPLOYMENT_MODE=m365_admin_center so App Manager does not attempt local WEF registration.
• Ensure the Microsoft Edge WebView2 Evergreen runtime is present (a blank taskpane usually means it is missing/stale).
• Intune: set Install behavior = User for per-user installs (device/SYSTEM context installs into a dead profile). Use /allusers only when you intend a machine-wide install (RDS/AVD).
• Allowlist the endpoints in Network & allowlist for App Manager and its helpers — not just browsers.
• For locked-down / air-gapped fleets, use the standalone installer and the optional policy env vars (Step 3).
• Validate one pilot machine: App Manager → Diagnostics shows "Managed by IT" with healthy Python/Excel helpers.
• If helpers fail to start on a locked-down PC, apply the EDR exclusions in Troubleshooting (certificate-based first).

Why both systems

M365 delivers the add-in to assigned users and persists it across their devices. App Manager exists so that your data stays on the user's machine instead of in the cloud: uploaded files, indexed presentations, and agent conversations are stored in a local on-device database, and the PowerPoint/Excel processing and AI agent pipelines that work on them run locally too. In M365 mode, App Manager does not register the add-in locally — it defers to M365.

Microsoft 365 Admin Center
 |- Deploys the Office add-in (XML manifest or unified .zip) to assigned users
 |- Office loads the AlphaSense taskpane from a hosted web origin
 |- Persists across devices tied to the user's M365 account

AlphaSense App Manager (on each user's machine)
 |- Python backend for AI processing and slide manipulation  (OS-assigned port)
 |- Excel backend for spreadsheet operations                 (OS-assigned port)
 |- Service discovery for the taskpane to find backends      (localhost:8100+)
 |- Does NOT register the add-in with Office (defers to M365)

Step 1 — Deploy the add-in via M365 Admin Center

AlphaSense publishes the add-in in two formats. Users get the same AlphaSense tab and taskpane either way — the formats only differ in what you upload to Microsoft 365.

Which one should I use?

• If Upload custom apps still accepts an Office Add-in XML file or manifest URL, either format works. XML is the long-standing option. The unified manifest is Microsoft's newer format — https://devblogs.microsoft.com/microsoft365dev/unified-manifest-for-office-add-ins-now-ga/.
• If your admin center only accepts a .zip (the classic Add-ins page is gone), use the unified manifest.
• Give each user one format per app. The two formats have different add-in IDs, so Microsoft 365 treats them as two separate apps — a user assigned both sees two AlphaSense tabs. Mixing across apps is fine (for example, XML for PowerPoint and unified for Excel).

Download the production manifests

These are the files most organizations upload in Microsoft 365 Admin Center (or hand to a deployment tool). Host: plugins.alpha-sense.org. Download and upload, or paste the XML URL when the admin center offers Provide link to manifest file.

Standalone fleets need the locked unified zips instead — see Standalone App Manager fleets below. Locked classic XML has no public download URL; copy it from the standalone installer resources folder.

Option A — Classic XML manifest

1. Sign in to the Microsoft 365 Admin Center (https://admin.microsoft.com) → Settings → Integrated apps → Upload custom apps, and choose app type Office Add-in.

2. Choose Provide link to manifest file, paste the URL below, and click Validate. (Or download the file and choose Upload manifest file.)

The taskpane URLs inside each manifest should point at the production web path (…/channels/stable/latest/…, not bare /latest/).

3. Assign the users or groups who should get AlphaSense. Propagation can take up to 24 hours.

4. Repeat for the other app — deploy both PowerPoint and Excel for full coverage.

The same XML files also ship inside App Manager after install. Prefer the CDN URLs above for M365 upload — the bundled copies must use the same channels/stable/latest/ page URLs.

%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Ppt Add-In\manifest-ppt.xml
%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Excel Add-In\manifest-excel.xml

Option B — Unified manifest (.zip)

1. Download the package for each app. Keep it zipped — Microsoft 365 needs the whole .zip, not the manifest.json inside it.

The same zips also ship inside App Manager after install:

%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Ppt Add-In\AlphaSense-for-PowerPoint.stable.zip
%LOCALAPPDATA%\Programs\AlphaSense App Manager\resources\Carousel Excel Add-In\AlphaSense-for-Excel.stable.zip

2. Sign in to the Microsoft 365 Admin Center (https://admin.microsoft.com) → Settings → Integrated apps → Upload custom apps, choose app type Teams app, and upload the .zip.

3. If the admin center asks you to accept permissions, accept them. AlphaSense only asks to read and write the document the user has open.

4. Assign the users or groups who should get AlphaSense. Propagation can take up to 24 hours.

5. Repeat for the other app.

App Manager works the same way with both formats. Office has no way to register a unified package locally, so keep CAROUSEL_DEPLOYMENT_MODE=m365_admin_center (Step 2) — otherwise App Manager also registers the XML add-in and users see a second AlphaSense tab. Once Office has synced the unified package, App Manager → Diagnostics shows "Managed by organization through Microsoft 365 Admin Center (unified manifest)".

Standalone App Manager fleets

If you install the standalone App Manager (*-standalone.exe), upload the locked version of whichever format you chose. Locked files point the taskpane at a loader page that serves each machine the frontend version pinned by its installed App Manager. Don't use the regular files above on standalone fleets.

Locked classic XML is not on a public download URL. Locked unified packages can be downloaded from the links above or copied from the standalone install folder:

%ProgramFiles%\AlphaSense App Manager\resources\Carousel Ppt Add-In\
%ProgramFiles%\AlphaSense App Manager\resources\Carousel Excel Add-In\

Full steps: IT Admin: Standalone Centralized Deployment.

Step 2 — Distribute App Manager

Each user needs App Manager running locally. Silent install (recommended):

AlphaSense-App-Manager-Setup-latest.exe /S /DeploymentMode=m365_admin_center

The /DeploymentMode=m365_admin_center switch makes App Manager skip local Office registration with no interactive prompt (equivalent to setting CAROUSEL_DEPLOYMENT_MODE=m365_admin_center).

Or set the environment variable before install (User scope for per-user installs; Machine scope for /allusers):

[Environment]::SetEnvironmentVariable("CAROUSEL_DEPLOYMENT_MODE", "m365_admin_center", "User")
AlphaSense-App-Manager-Setup-latest.exe /S

Intune / SCCM (per-user, recommended for most desktops):

• Install: AlphaSense-App-Manager-Setup-latest.exe /S /DeploymentMode=m365_admin_center
• Uninstall: "%LOCALAPPDATA%\Programs\AlphaSense App Manager\Uninstall AlphaSense App Manager.exe" /S
• Detection: file exists at %LOCALAPPDATA%\Programs\AlphaSense App Manager\AlphaSense App Manager.exe
• Install behavior: User (required) — see warning below
• Restart: not required

With the per-user command line above, install behavior MUST be "User", not "System/Device". A device/SYSTEM-context install lands in C:\Windows\System32\config\systemprofile\AppData\Local, a dead profile, and the per-user detection rule never matches. The installer exits with code 1603 and writes the reason to %TEMP%\carousel-installer-trace.log (C:\Windows\Temp for SYSTEM). Autopilot ESP device-phase and per-machine/MSI are not supported; assign to users.

Device-context alternative (RDS / AVD / shared workstations): add /allusers to install machine-wide into Program Files with a shared component store under %ProgramFiles%\CarouselAppManager:

• Install: AlphaSense-App-Manager-Setup-latest.exe /S /allusers /DeploymentMode=m365_admin_center
• Detection: Registry — HKEY_LOCAL_MACHINE\Software\AlphaSense\CarouselAppManager, value InstallScope equals machine, 64-bit view (not a file-existence rule)
• Install behavior: System (device context)
• Set CAROUSEL_DEPLOYMENT_MODE as a Machine environment variable. Updates become IT-owned — re-run the installer elevated to update shell or components.

Standalone installer (restricted networks): use AlphaSense-App-Manager-Setup-{version}-standalone.exe (bundles all components, no download at install time, disables self-updates). Contact AlphaSense for the package, or download:

<https://plugins.alpha-sense.org/app-manager/channels/stable/AlphaSense-App-Manager-Setup-latest-standalone.exe>

The standalone installer installs machine-wide only (Setup.exe /S is enough), uses bundled archives, disables automatic updates, and sideloads locked manifests whose page URLs point at the CDN loader — do not swap those for latest/ manifests on standalone fleets. Multi-user / shared-session hosts are still under test; the artifact is not supported on VMs.

Self-download: https://plugins.alpha-sense.org/app-manager/channels/stable/AlphaSense-App-Manager-Setup-latest.exe — users choose "Managed by IT through Microsoft 365 Admin Center" when prompted.

Step 3 — Policies (optional)

Set via GPO, Intune configuration profiles, or login scripts:

Recommended policy for centralized deployment:

CAROUSEL_DEPLOYMENT_MODE = m365_admin_center
CAROUSEL_DISABLE_COMPONENT_UPDATES = true   (if you control component versions)
CAROUSEL_DISABLE_SHELL_UPDATES = true        (if you control App Manager versions)

When updates are disabled, App Manager shows "Managed by your IT administrator" with the update button disabled.

Prerequisites & environment notes

Microsoft Edge WebView2 Runtime (Evergreen)

On Windows, the Office add-in taskpane renders in the Microsoft Edge WebView2 Runtime (Evergreen), which must be present and reasonably current. Blank/failed taskpanes on LTSC images, GPO-blocked msedgeupdate, or Edge-stripped golden images usually mean it is missing. Following https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution#detect-if-a-suitable-webview2-runtime-is-already-installed, check the pv (REG_SZ) value at both of these keys — the runtime can be installed per-machine or per-user:

HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv
HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv

The runtime is installed only if at least one value exists, is non-empty, and is greater than 0.0.0.0 (a literal 0.0.0.0 is an uninstalled placeholder). If neither key qualifies, install the Evergreen Standalone Installer from Microsoft: https://developer.microsoft.com/en-us/microsoft-edge/webview2/.

Authenticated proxies

NTLM/Negotiate with SSO works automatically. Basic-auth proxies need CAROUSEL_PROXY_USERNAME/CAROUSEL_PROXY_PASSWORD. If credentials are not set and the proxy demands explicit auth, outbound requests fail — prefer an SSO-integrated proxy, or the standalone installer to avoid install-time egress.

Network & allowlist

These destinations must be reachable by App Manager, the Office WebView taskpane, the updater/component installer, and local helper processes — not just by a browser. A browser-only allowlist can still leave deployment broken (e.g. getaddrinfo ENOTFOUND plugins.alpha-sense.org).

Corporate DNS, secure web gateways, endpoint firewalls, TLS inspection, and proxy policies must allow these non-browser processes to resolve and connect. Typical failure: App Manager cannot fetch https://plugins.alpha-sense.org/app-manager/channels/stable/components/manifest.json.

RC / dev channels (only if you test them): auth.rc.alpha-sense.com, main.rc2.alpha-sense.org, auth.dev4.alpha-sense.org, dev4.alpha-sense.org.

Recommended (Authenticode revocation checks): ocsp.digicert.com, crl3.digicert.com, crl4.digicert.com, cacerts.digicert.com. Windows soft-fails when these are blocked, but a black-holed (silently dropped) endpoint can stall signature validation of updates.

Some features receive short-lived pre-signed AWS S3 URLs for image/report upload/download — allow pre-signed S3 traffic initiated by the add-in/App Manager.

Local ports (http://localhost only)

All local services bind 127.0.0.1 only — no inbound firewall rules are needed, but endpoint security tools must allow the Office WebView and App Manager to communicate with http://localhost loopback URLs.

How detection works

App Manager auto-detects M365 deployment by scanning the local Office cache and shows "Managed by IT". Before Office has synced the add-in it shows "Waiting for IT" — this means "be patient," not "deployment failed."

Primary signal — boot.json under:

%LOCALAPPDATA%\Microsoft\Office\16.0\Wef\AddinInfo\1\excatalog\{PowerPoint|Excel}\...\{addin-id}_*\boot.json

App Manager matches on the add-in ID (XML or unified — it recognizes both) and EXCatalog store ID. Secondary signal — AppCommands files containing the add-in ID, EXCatalog, and host name.

Precedence: (1) configured deployment mode always wins — m365_admin_center never registers locally even with stale cache; local ignores M365 evidence; (2) when mode is m365_admin_center, M365 cache evidence → "Managed by IT", no evidence → "Waiting for IT".

Launch behavior

Clicking Open PowerPoint or Open Excel in App Manager starts the backend services and opens the host app directly (no local sideload). The add-in loads because M365 deployed it. Once active, the taskpane experience is identical to individual setup.

Updating

• Add-in frontend (online App Manager): served from plugins.alpha-sense.org; updates are automatic and server-side. Routine AlphaSense releases need no re-upload in M365.
• Add-in frontend (standalone App Manager): each machine loads the frontend version pinned in its installed state — push a new standalone installer to move the pin; CDN latest/ changes do not affect already-installed standalone machines.
• App Manager / backends: automatic unless disabled by policy. With CAROUSEL_DISABLE_COMPONENT_UPDATES=true / CAROUSEL_DISABLE_SHELL_UPDATES=true, distribute new versions via Intune/SCCM. On machine-wide (/allusers) installs, updates are always installer-driven — re-run the installer elevated.
• The manifest or package itself: changes rarely — for example when AlphaSense adds a ribbon button. AlphaSense will tell you when to upload a new one (see below).

Uploading a new manifest or package

1. In Settings → Integrated apps, open the Deployed apps tab and click AlphaSense for PowerPoint (or Excel). Update it from the app's details page — Upload custom apps is only for first-time deployment.

2. Upload the new file in the same format you deployed (XML or .zip).

3. Users pick up the change after Office syncs, which can take up to 24 hours. Closing and reopening Office speeds this up.

Microsoft 365 only pushes an update to users when the version number in the new file is higher than the deployed one. AlphaSense raises the version every time the manifest changes. If you upload a file with the same version as the one already deployed, machines that already have it won't update — and for the unified .zip, the admin center may reject it with "Upload failed. Please check the manifest file and try again."

You can also remove the app and upload it again from scratch, but users lose AlphaSense until the new deployment syncs.

Rollback & coexistence

Removing the add-in from M365 stops it after the next Office sync; App Manager transitions to "Waiting for IT." Switch a machine to local registration by reinstalling with "Local registration" or setting CAROUSEL_DEPLOYMENT_MODE=local. Mixed local and M365 users in one org is safe (mode is per-machine); do not run both local WEF registration and M365 deployment for the same add-in on the same machine (App Manager prevents this in M365 mode).

Do not mix per-user (A1) and machine-wide (A2) installs on one machine — the install marker wins and leaves orphaned per-user component stores. If you migrate A1 → A2, delete %LOCALAPPDATA%\CarouselAppManager\components\ from affected profiles afterward.

Switching an app from XML to the unified manifest

Microsoft 365 treats the XML and unified versions of AlphaSense as two separate apps, so switching means adding one and removing the other. Move one group at a time:

1. Deploy the unified .zip (Step 1, Option B) and assign it to a pilot group.

2. Remove that group from the XML app's assignment.

3. Have pilot users close and reopen Office. Until both changes sync (up to 24 hours), they may briefly see two AlphaSense tabs, or none.

4. Once the pilot works, move the remaining groups, then remove the XML app.

Switching back to XML works the same way in reverse. Users' local data (conversations, indexed files) is unaffected — it lives with App Manager, not with the add-in.

VDI / RDS environments

• Non-persistent VDI: the component store under %LOCALAPPDATA%\CarouselAppManager is typically discarded on logoff. Set CAROUSEL_SHARED_DATA_PATH to a path on a persistent volume (e.g. inside an FSLogix profile container), or deploy the standalone installer so no downloads are needed each session. App Manager appends a per-user subdirectory automatically — do not point multiple users at the same final directory. Use a local-volume path, not a UNC share (executing backend binaries from SMB is blocked by most EDR/AppLocker policies).
• Multi-session hosts (RDS / AVD): M365 manifests are unstamped — the taskpane loader port-scans 127.0.0.1:8100-8109 for /discover. Each session's App Manager occupies a port in that range; at most ~10 concurrent sessions per host today. Machine-wide (/allusers) install gives one shared component store — size the host for one App Manager and two backend processes per concurrent session.
• Non-persistent profiles: user data under %APPDATA%\CarouselData\ is lost on logoff unless included in the profile container.

Troubleshooting

Add-in does not appear after M365 deployment — allow up to 24h; have the user reopen Office or sign out/in of their Microsoft account to force a sync; confirm the user is assigned and on the correct tenant.

Users see two AlphaSense tabs — the user has both the XML and the unified app assigned for the same Office app, or App Manager also registered the XML add-in locally. Remove one assignment, and confirm the machine has CAROUSEL_DEPLOYMENT_MODE=m365_admin_center.

"Upload failed. Please check the manifest file and try again." — usually one of:

• the manifest.json was uploaded on its own instead of the whole .zip;
• the file was uploaded under the wrong app type (the .zip must be a Teams app, the XML an Office Add-in);
• you're updating an existing app with a file whose version isn't higher than the deployed one (see Updating).

A machine still shows the old add-in after an update — Office caches deployed add-ins. Close every Office app and reopen; allow up to 24 hours. To check which version a machine has, look under %LOCALAPPDATA%\Microsoft\Office\16.0\Wef\AddinInfo\1\excatalog\PowerPoint\ (or Excel): each deployed add-in has a folder named after its ID and version, for example a9b3b4c5-6308-49c4-885d-b25cf55d52f7_1.0.1.0. Office adds a fourth .0 to the version, so 1.0.1 shows as 1.0.1.0.

App Manager stuck on "Waiting for IT" — confirm the assignment, trigger an Office sync (open/close), and check for M365 cache evidence: dir "%LOCALAPPDATA%\Microsoft\Office\16.0\Wef\AddinInfo" /s /b | findstr "boot.json". If none after 48h, consider the local-registration fallback.

Taskpane is blank / won't load — usually missing or blocked WebView2; see Prerequisites above. If WebView2 is installed, confirm plugins.alpha-sense.org is reachable from the Office WebView process.

Backends not starting — App Manager → Diagnostics → check helper status and Restart Helpers; review %APPDATA%\AlphaSense App Manager\logs\main.log. If helpers never come up, endpoint protection is a common cause — see EDR below.

Component install fails even though the URL opens in a browser — the browser has internet but App Manager does not. Confirm plugins.alpha-sense.org is allowed for AlphaSense App Manager.exe (not just Chrome/Edge) and that desktop apps get DNS + proxy/TLS-inspection access. Typical log lines:

manifest fetch (<https://plugins.alpha-sense.org/app-manager/channels/stable/components/manifest.json>) failed: getaddrinfo ENOTFOUND plugins.alpha-sense.org

If online downloads cannot be allowed, deploy the standalone installer instead. Component state:

Per-user:  %LOCALAPPDATA%\CarouselAppManager\components\installed-components.json
Machine:   %ProgramW6432%\CarouselAppManager\components\installed-components.json

Machine-wide install shows "Shared component store is incomplete" — re-run the installer elevated; check whether cleanup scripts or AV deleted content under %ProgramFiles%\CarouselAppManager\components\store\.

Machine-wide install shows "Add-in registration is blocked by policy" — App Manager could not write HKCU\...\Wef\Developer. Deliver the add-in through M365 (Step 1) or a Group Policy Trusted Catalog; backends still run.

EDR — helpers won't launch

If App Manager installs but the Python/Excel helpers stay down, EDR is often blocking process launch or a bundled native DLL. This shows up most on first launch after install.

1. Certificate-based exclusion (primary). Add an allow rule for files signed by our publisher — a certificate-based exclusion in the EDR console, not Trusted Root Certification Authorities:

• Publisher (Subject): CN="Tegus, Inc.", OU=Tegus Engineering, ...
• Certificate policy: EV Code Signing (OID 2.23.140.1.3)
• Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
• SHA-1 thumbprint: C5931AB11A182D6C316A4F8739AA4BDD3A6C1808
• Valid until: 2026-09-19 (we'll send an updated thumbprint before renewal)

This covers the installer and our own compiled backend files signed with this certificate.

2. Wildcard path exclusions. Some bundled third-party components (e.g. pdfium.dll) are not signed under our certificate. Add folder wildcards — not a version-pinned path — so they survive updates:

• C:\Users\*\AppData\Local\CarouselAppManager\components\store\backend-src\* (already covered by the cert exclusion — optional)
• C:\Users\*\AppData\Local\CarouselAppManager\components\store\runtime-ppt-deps\*
• C:\Users\*\AppData\Local\CarouselAppManager\components\store\runtime-excel\*

If your security team prefers not to exclude the whole folder, we can scope to the specific blocked file (e.g. runtime-ppt-deps\*\...\pdfium.dll) — send the filename from the EDR log. If you're still seeing blocks after both steps, send the EDR event (filename + action) and we'll identify the file.