Standalone Installer Reference (Windows)

Windows only — no macOS standalone installer. This document covers the Windows *-standalone.exe artifact only. macOS has a single App Manager installer (AlphaSense-App-Manager-latest.dmg) — there is no standalone macOS artifact and no online/standalone choice on Mac. If your fleet includes Mac endpoints, use the standard IT admin guides for those machines (Individual Deployment · Centralized Deployment).

Appendix — technical reference for the *-standalone.exe artifact. This is not a deployment path; pick a workflow guide first.

CS / support: Do not attach this document in the initial IT packet. Send the matching path guide (Standalone Centralized Deployment or Standalone Individual Deployment) for day-one deployment. Share this reference on request when IT needs Intune/SCCM detection detail, online vs standalone comparison, frontend pinning, limitations, or artifact troubleshooting.

This reference covers what the standalone installer is: how it differs from the online installer, install scope, detection rules, update model, frontend pinning, limitations, and artifact troubleshooting.

Not intended for end-user self-service. The standalone installer requires administrator elevation, installs machine-wide under Program Files, and disables in-app updates (IT must redeploy to update). Individual users installing for themselves should use the online installer (AlphaSense-App-Manager-Setup-latest.exe) and the standard IT admin guides (Individual Deployment · Centralized Deployment).

Platform Requirements

Windows

• Windows 10 or later
• Microsoft 365 subscription required (desktop apps for PowerPoint and/or Excel); perpetual / LTSC Office is not supported
• Microsoft 365 Version 2501 or later
• Microsoft Edge WebView2 Evergreen runtime (blank taskpanes usually mean it is missing)
• Admin privileges for install (machine-wide scope)

macOS

Not supported. No macOS standalone artifact ships today. Mac fleets should use IT Admin: Individual Deployment or Centralized Deployment (online).

1. What the standalone installer is

The standalone installer is a single Windows Setup executable that contains every backend component (Python runtimes, native libraries, backend source) needed to run AlphaSense App Manager. At install time it:

• Extracts bundled component archives — zero remote component downloads
• Installs the App Manager shell and component store machine-wide under Program Files
• Writes a sticky pinned update policy so shell and component updates stay disabled
• Pins the Office taskpane frontend to the exact version released with that installer

Standalone is for IT-managed Windows endpoints where per-user installs under %LOCALAPPDATA% fail security review, where network policy blocks runtime component downloads, or where IT must control the update cadence.

2. Online vs Standalone — which one to use

Use standalone when

• Application control (ThreatLocker, AppLocker, WDAC) blocks executables under user-writable paths
• Network policy restricts or blocks runtime component downloads from plugins.alpha-sense.org
• IT must control when App Manager, backends, or the taskpane frontend update

Do not use standalone when

• Individual users are installing for themselves — use the online installer (Direct User Download in IT Admin: Individual Deployment)
• Any macOS endpoints — the standalone installer is Windows-only; deploy the Mac App Manager installer (AlphaSense-App-Manager-latest.dmg) per IT Admin: Individual Deployment or Centralized Deployment
• Virtual machines are not supported — do not install or validate on VMs, VDI, RDS, or AVD; use physical Windows endpoints only
• The organization wants automatic updates without IT intervention

3. Download

Artifact naming

Production standalone installer URL

<https://plugins.alpha-sense.org/app-manager/channels/stable/AlphaSense-App-Manager-Setup-latest-standalone.exe>

AlphaSense can advise on fleet rollout. The URL above is published by the release pipeline — you do not need to request a package for each version unless your security process requires a version-pinned artifact.

Approximate sizes

Measured against the production standalone build (2026-08-31):

Plan for the larger download in distribution tooling (Intune content prep, SCCM packages, golden images).

4. Install scope and security posture

Standalone always installs machine-wide. There is no "current user only" option.

Where files land

The component store ACL is pinned: SYSTEM and Administrators Full; Users Read+Execute only. Standard users cannot write executable code into the shared store.

Why Program Files matters for security review

Default AppLocker and WDAC path rules trust executables under %PROGRAMFILES% and %WINDIR% — not %LOCALAPPDATA% or %ProgramData%. A per-user online install places Python runtimes and native binaries in a user-writable path, which often fails application-control review.

The standalone install scope satisfies default path rules without custom exclusions. With standalone, fewer path exclusions are typically needed than for a per-user online install.

Code-signing publisher

September 2026 rotation. AlphaSense is replacing its Windows code-signing certificate. New stable standalone builds published September 17–18, 2026 onward are signed as AlphaSense, Inc. and supersede the outgoing Tegus, Inc. publisher for versions going forward. The outgoing certificate expires September 19, 2026 — after that date, no new binaries are signed with it. Keep both publisher rules in EDR through at least October 31, 2026: software already installed on your machines stays signed by the outgoing certificate and remains valid (Windows honors the timestamp countersignature).

Covers: installer, App Manager, uninstaller, Cython .pyd under backend-src.

Does not cover: third-party bundled natives (e.g. pdfium.dll, unsigned Aspose/PyPI .pyd files) — use hash or path exclusions below.

Application control rule hierarchy

Use the most precise rule type that works for each file. From strongest identity to broadest (and riskiest):

Add certificate-based exclusions in the EDR console — not Trusted Root Certification Authorities. See Software Approval and Executable Allowlisting for full publisher details and console paths.

Path-based rules (standalone — last resort)

Only use when certificate and hash exclusions do not resolve a block. Prefer a specific file hash over a folder wildcard when your EDR supports it.

%ProgramFiles%\AlphaSense App Manager\
%ProgramFiles%\CarouselAppManager\

If blocks persist after cert exclusion, add wildcard path exclusions for unsigned bundled natives — or better, hash-allow the specific blocked file from the EDR log:

• C:\Program Files\CarouselAppManager\components\store\runtime-ppt-deps\*
• C:\Program Files\CarouselAppManager\components\store\runtime-excel\*

Full EDR console guidance is in the Standalone Centralized and Standalone Individual deployment guides (EDR — helpers won't launch).

Elevation is required

• Interactive install: UAC elevation prompt (no "current user" page on standalone builds)
• Silent install: Setup.exe /S alone installs all-users; /allusers is accepted but not required
• /allusers does not elevate by itself. A non-elevated silent run silently lands in the wrong scope (per-user under the invoking profile, or a dead SYSTEM profile). Always run silent installs from an elevated or device/SYSTEM context.

5. Deployment paths

Standalone supports two registration paths. Each has its own step-by-step guide:

Both paths require an elevated or device/SYSTEM context. Use -Wait when launching from a script so component extraction finishes before detection logic runs.

Add-in files shipped with the installer

The installer puts the add-in files in %ProgramFiles%\AlphaSense App Manager\resources\Carousel Ppt Add-In\ and ...\Carousel Excel Add-In\. Standalone fleets should use the stable locked files:

The folders also hold other channel (dev, rc, testing) and non-locked variants; ignore those unless AlphaSense asks you to use one. The XML and unified versions have different add-in IDs, so assign only one format per app to any given user.

Detection rules (Intune / SCCM)

These values differ from the online installer's Intune guidance (IT Admin: Individual Deployment, Option 3). Do not reuse the online installer's per-user detection rule.

Install commands are in the deployment path guides above.

File-based detection:

%ProgramFiles%\AlphaSense App Manager\AlphaSense App Manager.exe

Registry-based detection (recommended completion signal):

Key:   HKLM\Software\AlphaSense\CarouselAppManager  (64-bit view)
Value: InstallScope
Data:  machine

InstallScope is written last on install and deleted first on uninstall. It is the only reliable signal that the install completed — other marker values may exist transiently during a failed or interrupted run.

Other marker values (informational, not required for detection):

The marker must exist only in the 64-bit registry view. If your tooling queries the 32-bit view (WOW6432Node), machine mode will appear absent even when the install succeeded.

SYSTEM without /allusers

If a deployment tool runs Setup as SYSTEM with /S but without machine scope (/allusers or a standalone build's forced per-machine mode), the installer refuses the install: it detects a system/service profile root (C:\Windows\System32\config\systemprofile\...), sets exit code 1603, and quits. This is deliberate — Intune/SCCM must surface a failure instead of a green deployment into a profile no user can access. The fix is /S /allusers in device context (standalone builds force machine scope even without /allusers, but device context is still required for elevation).

Network still required: Standalone bundles local backends, but the taskpane UI still loads from https://plugins.alpha-sense.org. This is not a true air-gap solution. Allowlist the endpoints in your deployment path guide; application-control path rules are in section 4 (Install scope and security posture) above.

6. Update model (frozen)

Standalone disables runtime updates by design.

What gets pinned

• updatePolicy: pinned in %ProgramFiles%\CarouselAppManager\components\installed-components.json
• UpdatePolicy=pinned in the HKLM install marker
• Machine scope independently disables in-app shell and component update controls

After writing these records, the installer deletes the bundled payload folder (resources\offline-payload, ~340 MB of archives inside the installed app). The pin does not depend on that folder existing — do not treat its absence as a broken install.

What users see

App Manager shows "Managed by your IT administrator" with update controls disabled. This is expected, not a fault.

Day-one standalone deploy

Do not set CAROUSEL_DISABLE_SHELL_UPDATES or CAROUSEL_DISABLE_COMPONENT_UPDATES to true for a normal standalone rollout. The installer already pins updates and machine scope disables in-app update controls. Setting those variables to true is redundant.

Set deployment mode with the install switch (/DeploymentMode=local or /DeploymentMode=m365_admin_center) in the path guide — not via a separate policy step.

Environment variables (optional)

Use only when you need an override. Deploy machine-level variables via GPO, Intune configuration profiles, SCCM, or provisioning scripts. Restart App Manager after changes.

Policy precedence

1. Environment variable override (if set): CAROUSEL_DISABLE_SHELL_UPDATES, CAROUSEL_DISABLE_COMPONENT_UPDATES, or CAROUSEL_UPDATE_POLICY
2. Installer mode from installed state (standalone disables updates)
3. Default behavior (online enables updates)

How to update

To update anything — App Manager shell, backend components, or the pinned taskpane frontend — IT pushes a new standalone installer. There is no in-app update path for standalone fleets.

IT notifications: AlphaSense can email your IT department when a new standalone App Manager version is available for fleet deployment. Provide a distribution-list address during onboarding. When a release also requires a manifest re-upload (critical component change or ribbon/manifest structure update), that can be included in the notification.

7. Frontend version pinning

With the online installer, the Office taskpane loads from CDN latest/ and picks up new frontend releases automatically. With standalone, the taskpane is locked to the exact frontend version that shipped with the installed backend.

Why IT cares

A new frontend release cannot drift against a frozen local backend. Backend API contracts and frontend behavior stay aligned to the version IT approved.

What is locked vs what still floats

Manifest page URLs point at the stable loader/ hop, which redirects to the pinned semver on each machine. For M365 manifest upload frequency and when re-upload is required, see Standalone Centralized Deployment (Manifest upload frequency).

Fallback behavior

If App Manager is unreachable at taskpane load time, the loader uses a cached pin when that snapshot still exists; otherwise it falls back to latest/ with a console warning.

Taskpane 404 after install

If the taskpane fails to load (404) immediately after deploying a new standalone build, this is usually a loader/channel deployment ordering issue — the pinned manifest references a frontend snapshot or loader prefix that is not yet on the CDN. Escalate to AlphaSense rather than attempting local repair.

8. Limitations

• Virtual machines are not supported. Install and validate on physical Windows endpoints only — not on VMs, VDI, RDS, or AVD.
• Concurrent multi-session hosts (RDS / AVD) are not certified for the standalone artifact yet. Do not treat shared-session hosts as certified without explicit AlphaSense guidance. VDI guidance for the online installer (CAROUSEL_SHARED_DATA_PATH, etc.) remains in IT Admin: Individual Deployment and IT Admin: Centralized Deployment — apply an explicit not certified for standalone policy on multi-session hosts until certified.
• Shared physical laptops with multiple Windows user profiles are supported when only one user is logged in at a time (not concurrent RDS/AVD sessions).
• Windows only. No macOS standalone installer is available; Mac fleets use AlphaSense-App-Manager-latest.dmg.
• Larger download (~454 MB vs ~122 MB online) and slower distribution.
• Not air-gapped. Local backends run offline after install, but the taskpane still requires HTTPS access to plugins.alpha-sense.org and the standard AlphaSense auth/API endpoints.

9. Troubleshooting

Diagnostics: App Manager → Diagnostics shows the active component store path, install scope, and update policy. Logs: %APPDATA%\CarouselData\logs\app-manager.log.

Installer trace: %TEMP%\carousel-installer-trace.log

10. Related documentation