IT Admin Guide: Standalone Centralized Deployment (Windows)

Windows only — no macOS standalone installer. This guide covers the Windows *-standalone.exe workflow only. macOS has a single App Manager installer (AlphaSense-App-Manager-latest.dmg) — there is no standalone macOS artifact and no online/standalone choice on Mac. If your fleet includes Mac endpoints, use the standard IT admin guides for those machines (Individual Deployment · Centralized Deployment).

Deploy AlphaSense to your organization with Microsoft 365 Admin Center (delivers the Office add-in) plus the standalone App Manager installer on each machine (bundled local AI, slide, and Excel backends). This guide is the M365 centralized path for fleets that use the standalone artifact — machine-wide Program Files install, frozen updates, and frontend version pinning.

This guide is the document to send IT. It covers the M365 + standalone workflow end to end. The Standalone Installer Reference is an on-request appendix (detection rules, artifact comparison, troubleshooting) — share it only when IT asks; do not attach it in the initial packet.

IT readiness checklist

• Deploy the locked PowerPoint and Excel add-in files in M365 Admin Center — classic XML or unified .zip, one format per app (Step 1) — and assign users/groups. Allow up to 24h to sync.
• Distribute the standalone installer silently from an elevated / device context: AlphaSense-App-Manager-Setup-latest-standalone.exe /S /allusers /DeploymentMode=m365_admin_center.
• Ensure the Microsoft Edge WebView2 Evergreen runtime is present (a blank taskpane usually means it is missing/stale).
• Intune: set Install behavior = System / device context (not User — standalone is machine-wide).
• Allowlist the endpoints in Network & allowlist for App Manager and its helpers — not just browsers.
• Validate one pilot machine: App Manager → Diagnostics shows machine scope, pinned update policy, and healthy Python/Excel helpers.
• If helpers fail to start on a locked-down PC, apply the EDR exclusions in Troubleshooting (certificate-based first).
• Confirm AlphaSense has your IT contact email for new standalone installer notifications (see Updating below).

Why both systems

M365 delivers the add-in to assigned users and persists it across their devices. The standalone App Manager provides local AI processing with all backend components bundled at install time and updates frozen until IT pushes a new installer. In M365 mode, App Manager does not register the add-in locally — it defers to M365.

Standalone is for locked-down Windows fleets where per-user installs fail security review, runtime component downloads are blocked, or IT must control the update cadence.

Step 1 — Deploy the Add-in via Microsoft 365 Admin Center

Standalone fleets upload a locked add-in file — not the regular latest/ file used with the online installer. Locked files point the taskpane at a stable loader/ page that serves each machine the frontend version pinned by its installed App Manager.

AlphaSense ships the locked file in two formats. Both give users the same AlphaSense tab; they differ only in what you upload:

Which one should I use? If your admin center still accepts Office Add-in XML files, either works. If it only accepts .zip files, use the unified manifest. Give each user one format per app — the formats have different add-in IDs, so a user assigned both sees two AlphaSense tabs. See IT Admin: Centralized Deployment — Step 1 for more on choosing.

1. Get the locked files for your chosen format. Both formats ship inside the standalone installer:

%ProgramFiles%\AlphaSense App Manager\resources\Carousel Ppt Add-In\
%ProgramFiles%\AlphaSense App Manager\resources\Carousel Excel Add-In\

The locked .zip packages can also be downloaded:

<https://plugins.alpha-sense.org/carousel-addin/channels/stable/latest/AlphaSense-for-PowerPoint.stable.locked.zip>
<https://plugins.alpha-sense.org/carousel-excel-addin/channels/stable/latest/AlphaSense-for-Excel.stable.locked.zip>

There is no public download link for the locked XML files — take them from the install folder, or ask AlphaSense. Don't use manifest-ppt.xml or AlphaSense-for-PowerPoint.stable.zip (without .locked) — those are for the online installer and skip the loader/ page standalone needs.

2. Sign in to the Microsoft 365 Admin Center (https://admin.microsoft.com) → Settings → Integrated apps → Upload custom apps. Choose app type Office Add-in for the XML file or Teams app for the .zip, then upload the file. For the .zip, upload the whole package — not the manifest.json inside it.

3. Assign the users or groups who should get AlphaSense. Propagation can take up to 24 hours.

4. Repeat for the other app — deploy both PowerPoint and Excel for full coverage.

Manifest upload frequency

With standalone, the M365-uploaded manifest (XML or .zip) is mostly upload-once. Its page URLs point at stable loader/ pages that redirect to each machine's pinned frontend version, so routine frontend releases do not require re-upload.

Re-upload is required when:

• Ribbon buttons or manifest structure changes — new ribbon commands, changed FunctionName entries, or other Office manifest schema changes (ribbon icons themselves float on latest/ and do not require re-upload).
• AlphaSense requests a required manifest update — when a critical component change requires a new manifest (for example, a new entry point URL or add-in capability). AlphaSense will notify your IT department when this is needed.

How to re-upload: in Settings → Integrated apps → Deployed apps, click the existing AlphaSense app and update it from its details page, using the same format you deployed. Don't add it again through Upload custom apps. Microsoft 365 only pushes the update when the new file's version number is higher than the deployed one — AlphaSense raises it with every manifest change. Uploading a .zip with the same version fails with "Upload failed. Please check the manifest file and try again."

Step 2 — Distribute the standalone App Manager

Each user needs App Manager running locally. Silent install from an elevated PowerShell, CMD, or deployment tool session (recommended):

AlphaSense-App-Manager-Setup-latest-standalone.exe /S /allusers /DeploymentMode=m365_admin_center

The /DeploymentMode=m365_admin_center switch makes App Manager skip local Office registration with no interactive prompt (equivalent to setting CAROUSEL_DEPLOYMENT_MODE=m365_admin_center).

Download URL (production standalone installer):

<https://plugins.alpha-sense.org/app-manager/channels/stable/AlphaSense-App-Manager-Setup-latest-standalone.exe>

Intune / SCCM:

Do not reuse the online installer's Intune guidance (IT Admin: Individual Deployment, Option 3) — standalone requires device context and Program Files detection.

Step 3 — Expected behavior

Standalone freezes shell, component, and frontend updates automatically at install — no GPO or Intune env vars are required to disable updates. App Manager shows "Managed by your IT administrator" with update controls disabled; that is normal, not a misconfiguration.

CAROUSEL_DEPLOYMENT_MODE is already set by the /DeploymentMode=m365_admin_center install switch in Step 2. For optional env-var overrides (Basic-auth proxy, bisecting), see Standalone Installer Reference — Environment variables.

CAROUSEL_SHARED_DATA_PATH and VDI/RDS: Multi-user / RDS / AVD is not certified for the standalone artifact. Do not apply VDI guidance from the online guides to standalone without explicit AlphaSense guidance. See Standalone Installer Reference — Limitations.

Platform Requirements

Windows

• Windows 10 or later
• Microsoft 365 subscription required (desktop apps for PowerPoint and/or Excel); perpetual / LTSC Office is not supported
• Microsoft 365 Version 2501 or later
• Microsoft Edge WebView2 Evergreen runtime (blank taskpanes usually mean it is missing)
• Admin privileges for install (machine-wide scope)

macOS

Not supported. No macOS standalone artifact ships today. Mac fleets should use IT Admin: Centralized Deployment (online).

Prerequisites & environment notes

• WebView2 Evergreen runtime (Windows): the taskpane renders in Microsoft Edge WebView2 and requires a current runtime. Blank/failed taskpanes on LTSC images, GPO-blocked msedgeupdate, or Edge-stripped golden images usually mean it is missing. Detect via HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv (non-empty = installed); remediate with Microsoft's Evergreen Standalone installer.
• Elevation required: standalone always installs machine-wide under Program Files. Silent installs must run from an elevated or device/SYSTEM context.
• Authenticated proxies: NTLM/Negotiate with SSO works automatically; Basic-auth proxies need CAROUSEL_PROXY_USERNAME/CAROUSEL_PROXY_PASSWORD.

Network & allowlist

These destinations must be reachable by App Manager, the Office WebView taskpane, and local helper processes — not just by a browser. Standalone bundles local backends at install time, but the taskpane UI still loads from https://plugins.alpha-sense.org. This is not a true air-gap solution.

Recommended (Authenticode revocation checks): ocsp.digicert.com, crl3.digicert.com, crl4.digicert.com, cacerts.digicert.com.

Application control and executable allowlisting

Network allowlisting is not enough — EDR and application-control tools may block local .pyd, .dll, and embedded Python even when HTTPS works. Standalone's Program Files install scope satisfies default AppLocker/WDAC path rules with fewer custom exclusions than a per-user online install. Use wildcard path rules:

%ProgramFiles%\AlphaSense App Manager\
%ProgramFiles%\CarouselAppManager\

New AlphaSense Windows binaries are signed by AlphaSense, Inc. (SHA-1 84C88F9B9A720F8146DC1313D468084208001A5B, valid through 2027-12-09). Keep the outgoing Tegus, Inc. rule (C5931AB11A182D6C316A4F8739AA4BDD3A6C1808) active through at least October 31, 2026 for already-deployed files. Add certificate-based exclusions in your EDR console — not Trusted Root Certification Authorities. See EDR — helpers won't launch in Troubleshooting below.

Some features receive short-lived pre-signed AWS S3 URLs for image/report upload/download — allow pre-signed S3 traffic initiated by the add-in/App Manager. All local services bind 127.0.0.1 only (discovery 8100-8109, backends OS-assigned), so no inbound firewall rules are needed.

How detection works

App Manager auto-detects M365 deployment by scanning the local Office cache and shows "Managed by IT". Before Office has synced the add-in it shows "Waiting for IT" — this means "be patient," not "deployment failed." The configured mode always wins: a machine set to local ignores any stale M365 cache, and a machine set to m365_admin_center never registers locally.

Launch behavior

Clicking Open PowerPoint or Open Excel in App Manager starts the backend services and opens the host app directly (no local sideload). The add-in loads because M365 deployed it. The loader hop ensures each machine's taskpane matches its pinned backend version.

Updating

Standalone disables in-app updates. IT pushes a new standalone installer to update the App Manager shell, backend components, or pinned taskpane frontend.

IT notifications from AlphaSense

AlphaSense will email your IT department whenever a new standalone App Manager version is available for fleet deployment. Provide a distribution-list address during onboarding so your team can schedule installer rollout on your cadence.

When a release requires a manifest re-upload (critical component change), AlphaSense will include that in the notification.

Rollback & coexistence

Removing the add-in from M365 stops it after the next Office sync; App Manager transitions to "Waiting for IT." To switch a machine to local sideload registration, reinstall standalone without /DeploymentMode= (or with /DeploymentMode=local) — see Standalone Individual Deployment. Mixed local and M365 users in one org is safe (mode is per-machine); do not run both local WEF registration and M365 deployment for the same add-in on the same machine (App Manager prevents this in M365 mode).

Troubleshooting

Add-in does not appear after M365 deployment — allow up to 24h; have the user reopen Office or sign out/in of their Microsoft account to force a sync; confirm the user is assigned and on the correct tenant.

App Manager stuck on "Waiting for IT" — confirm the assignment, trigger an Office sync (open/close), and check for M365 cache evidence: dir "%LOCALAPPDATA%\Microsoft\Office\16.0\Wef\AddinInfo" /s /b | findstr "boot.json". If none after 48h, consider the local sideload fallback (Standalone Individual Deployment).

Users see two AlphaSense tabs — the user has both the XML and the unified app assigned for the same Office app, or the machine was installed without /DeploymentMode=m365_admin_center and also registered the add-in locally. Remove one assignment, or reinstall with the switch.

"Upload failed. Please check the manifest file and try again." — check that you uploaded the whole .zip (not the manifest.json inside it), picked the right app type (Teams app for .zip, Office Add-in for XML), and, when updating, that the new file's version is higher than the deployed one.

A machine still shows the old add-in after an update — Office caches deployed add-ins. Close every Office app and reopen; allow up to 24 hours. Folder names under %LOCALAPPDATA%\Microsoft\Office\16.0\Wef\AddinInfo\1\excatalog\PowerPoint\ (or Excel) show the cached add-in ID and version, for example a9b3b4c5-6308-49c4-885d-b25cf55d52f7_1.0.1.0.

Backends not starting — App Manager → Diagnostics → check helper status and Restart Helpers; review %APPDATA%\CarouselData\logs\app-manager.log. Component store for standalone: %ProgramFiles%\CarouselAppManager\. If helpers never come up, endpoint protection is a common cause — see EDR below.

Taskpane 404 after new standalone deploy — usually a loader/channel deployment ordering issue. Escalate to AlphaSense rather than attempting local repair. See Standalone Installer Reference — Troubleshooting.

Machine mode did not activate — non-elevated silent install. Re-run from elevated/device context with /S /allusers. Check HKLM marker is in 64-bit view, not WOW6432Node.

Component install fails even though the URL opens in a browser — standalone should not download components at install time. If this appears post-install, the machine may have a partial online install. Re-run the current standalone installer with /S /allusers (idempotent).

EDR — helpers won't launch

If App Manager installs but the Python/Excel helpers stay down, EDR is often blocking process launch or a bundled native DLL. This shows up most on first launch after install.

1. Certificate-based exclusion (primary). Add allow rules for files signed by our publisher — certificate-based exclusions in the EDR console, not Trusted Root Certification Authorities. Add the current certificate and keep the outgoing one through at least October 31, 2026.

Current certificate (add):

• Publisher (Subject): CN="AlphaSense, Inc.", O="AlphaSense, Inc.", L=New York, S=New York, C=US, SERIALNUMBER=3178090, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
• Certificate policy: EV Code Signing (OID 2.23.140.1.3)
• Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
• SHA-1 thumbprint: 84C88F9B9A720F8146DC1313D468084208001A5B
• Valid: 2026-09-09 through 2027-12-09

Outgoing certificate (keep through at least Oct 31, 2026):

• Publisher (Subject): CN="Tegus, Inc.", OU=Tegus Engineering, O="Tegus, Inc.", L=Chicago, S=Illinois, C=US
• SHA-1 thumbprint: C5931AB11A182D6C316A4F8739AA4BDD3A6C1808
• Expires: 2026-09-19

This covers the installer and our own compiled backend files signed with this certificate.

2. Wildcard path exclusions. Some bundled third-party components (e.g. pdfium.dll) are not signed under our certificate. For standalone, the machine store path is:

• C:\Program Files\CarouselAppManager\components\store\runtime-ppt-deps\*
• C:\Program Files\CarouselAppManager\components\store\runtime-excel\*

If your security team prefers not to exclude the whole folder, we can scope to the specific blocked file — send the filename from the EDR log.

Related documentation