IT Admin Guide: Standalone Individual Deployment (Windows)

Windows only — no macOS standalone installer. This guide covers the Windows *-standalone.exe workflow only. macOS has a single App Manager installer (AlphaSense-App-Manager-latest.dmg) — there is no standalone macOS artifact and no online/standalone choice on Mac. If your fleet includes Mac endpoints, use the standard IT admin guides for those machines (Individual Deployment · Centralized Deployment).

This guide covers IT distribution of the standalone App Manager installer with local sideload registration — the path where App Manager registers the Office add-in directly via WEF Developer entries, without Microsoft 365 Admin Center. Use this for locked-down Windows fleets that do not use M365 centralized add-in deployment.

This guide is the document to send IT. It covers local sideload + standalone workflow end to end. The Standalone Installer Reference is an on-request appendix (detection rules, artifact comparison, troubleshooting) — share it only when IT asks; do not attach it in the initial packet. For M365 centralized deployment with standalone, see Standalone Centralized Deployment.

Architecture Overview

AlphaSense for Office consists of two components:

User's Machine (machine-wide install)
|
+-- AlphaSense App Manager (Electron desktop app)
|    +-- Python backend       (OS-assigned port)
|    +-- Excel backend        (OS-assigned port)
|    +-- Service discovery    (localhost:8100+)
|    +-- Component store      (%ProgramFiles%\CarouselAppManager\)
|
+-- Office Add-in (PowerPoint & Excel)
     +-- Taskpane UI loaded from <https://plugins.alpha-sense.org/>...
     +-- Connects to local backends via service discovery
     +-- Registered via WEF Developer entries (local sideload)

The add-in frontend is hosted externally on AlphaSense infrastructure. The standalone App Manager bundles all backend components at install time and pins the taskpane frontend to the version released with that installer. The installer registers .locked manifest variants that point page URLs at the stable loader/ hop.

Note: Both the PowerPoint and Excel add-ins are generally available. App Manager can launch either host app with the AlphaSense taskpane ready.

In the standalone local-registration path, the installer writes WEF Developer registry entries for the installing user and registers .locked manifests from %ProgramFiles%\AlphaSense App Manager\resources\.

What Gets Installed

Installation Location

Standalone always installs machine-wide under Program Files. Admin privileges and elevation are required.

The component store ACL is pinned: SYSTEM and Administrators Full; Users Read+Execute only.

Registry Entries

The installer creates these entries:

On multi-user machines, WEF Developer entries are written for the installing user. Other users may need a one-time App Manager launch or IT script to register the add-in for their profile.

Add-in IDs and Manifest Files

These ship inside the installer at:

• %ProgramFiles%\AlphaSense App Manager\resources\Carousel Ppt Add-In\manifest-ppt.stable.locked.xml
• %ProgramFiles%\AlphaSense App Manager\resources\Carousel Excel Add-In\manifest-excel.stable.locked.xml

The .locked variants point taskpane/commands/login URLs at channels/stable/loader/ so each machine loads its pinned frontend version.

The same folders also contain locked unified manifest packages (AlphaSense-for-PowerPoint.stable.locked.zip / AlphaSense-for-Excel.stable.locked.zip). That's Microsoft's newer add-in format, and it can only be deployed through Microsoft 365 Admin Center — Office can't register it locally. You don't need them for this guide; they're there in case you move to centralized deployment later.

Distribution Options

Option 1: Direct Download (IT-assisted)

Download the standalone installer:

<https://plugins.alpha-sense.org/app-manager/channels/stable/AlphaSense-App-Manager-Setup-latest-standalone.exe>

Run from an elevated session. The installer registers the add-in locally (default deployment mode for standalone without /DeploymentMode=m365_admin_center).

Option 2: Silent Installation

From an elevated PowerShell or CMD session:

AlphaSense-App-Manager-Setup-latest-standalone.exe /S /allusers

Use -Wait when launching from a script so component extraction finishes before detection logic runs.

To explicitly set local registration mode:

AlphaSense-App-Manager-Setup-latest-standalone.exe /S /allusers /DeploymentMode=local

Equivalent environment variable:

[System.Environment]::SetEnvironmentVariable("CAROUSEL_DEPLOYMENT_MODE", "local", "Machine")

Option 3: Intune / SCCM Distribution

Package the standalone EXE for deployment via Microsoft Intune or SCCM:

Do not reuse the online installer's Intune guidance (IT Admin: Individual Deployment, Option 3) — standalone requires device context and Program Files detection. Full detection details: Standalone Installer Reference — Detection rules.

SYSTEM without /allusers: See Standalone Installer Reference — Detection rules.

Platform Requirements

Windows

• Windows 10 or later
• Microsoft 365 subscription required (desktop apps for PowerPoint and/or Excel); perpetual / LTSC Office is not supported
• Microsoft 365 Version 2501 or later
• Microsoft Edge WebView2 Evergreen runtime (blank taskpanes usually mean it is missing)
• Admin privileges for install (machine-wide scope)

macOS

Not supported. No macOS standalone artifact ships today. Mac fleets should use IT Admin: Individual Deployment (online).

Network Requirements

Scope of Allowlisting

Standalone bundles all backend components at install time — no component downloads at install. The taskpane UI still loads from https://plugins.alpha-sense.org. This is not a true air-gap solution.

Do not validate allowlisting only by opening URLs in a browser. The same destinations must be reachable by:

• AlphaSense App Manager (%ProgramFiles%\AlphaSense App Manager\AlphaSense App Manager.exe)
• the Office WebView taskpane hosted by PowerPoint/Excel
• local Python/Excel helper processes launched from %ProgramFiles%\CarouselAppManager\components\

Corporate DNS, secure web gateways, endpoint firewalls, TLS inspection, and proxy policies must allow these non-browser processes to resolve and connect to the required endpoints. Authenticated proxies: NTLM/Negotiate with SSO works automatically; Basic-auth forward proxies are configured via machine env vars — see Standalone Installer Reference — Environment variables.

Outbound HTTPS

Some features may receive short-lived, pre-signed AWS S3 URLs from AlphaSense services for image/report upload or download. Allow HTTPS access to the generated S3 URLs or use a policy that permits pre-signed AWS S3 traffic initiated from the AlphaSense add-in/App Manager.

Application control and executable allowlisting

Network allowlisting is not enough — EDR and application-control tools may block local .pyd, .dll, and embedded Python even when HTTPS works. Standalone always installs machine-wide under Program Files. Default AppLocker and WDAC path rules trust %PROGRAMFILES% and %WINDIR% — not %LOCALAPPDATA%. Use wildcard path rules:

%ProgramFiles%\AlphaSense App Manager\
%ProgramFiles%\CarouselAppManager\

New AlphaSense Windows binaries are signed by AlphaSense, Inc. (SHA-1 84C88F9B9A720F8146DC1313D468084208001A5B, valid through 2027-12-09). Keep the outgoing Tegus, Inc. rule (C5931AB11A182D6C316A4F8739AA4BDD3A6C1808) active through at least October 31, 2026 for already-deployed files. Add certificate-based exclusions in your EDR console — not Trusted Root Certification Authorities. See EDR — helpers won't launch below.

Local Ports

No inbound firewall rules are needed, but endpoint security tools must allow the Office WebView and App Manager to communicate with localhost loopback URLs.

Updating

Standalone freezes shell, component, and frontend updates automatically at install — no env vars are required. App Manager shows "Managed by your IT administrator" with update controls disabled; that is normal. IT pushes a new standalone installer to update the App Manager shell, backend components, or pinned taskpane frontend.

For optional env-var overrides (proxy, deployment mode without reinstall, bisecting), see Standalone Installer Reference — Environment variables.

IT notifications from AlphaSense

AlphaSense will email your IT department whenever a new standalone App Manager version is available for fleet deployment. Provide a distribution-list address during onboarding so your team can schedule installer rollout on your cadence.

Monitoring and Support

Diagnostics

Users can open App Manager and navigate to the Diagnostics page to see:

• Helper status: Whether Python and Excel backends are running, with PID and port
• Frontend status: Whether the add-in's web origin is reachable
• Add-in registration: Whether WEF Developer entries are active
• Install scope: Machine vs per-user; active component store path
• Update policy: Pinned (expected for standalone)

Logs: %APPDATA%\CarouselData\logs\app-manager.log

Report Export

Users can click Report Issue in App Manager to export a diagnostic report.

Component State File

For standalone, the authoritative state file is at:

%ProgramFiles%\CarouselAppManager\components\installed-components.json

Expected fields include updatePolicy: "pinned" and frontendPinned with the pinned PPT/Excel semver.

Common Issues

Backends not starting on machine install — Re-run the current standalone installer with /S /allusers (idempotent). Check Diagnostics for the active store path (%ProgramFiles%\CarouselAppManager\). EDR blocking is common — see EDR — helpers won't launch below.

Add-in missing for a second user on a shared machine — WEF Developer entries are per-user. The second user may need to launch App Manager once so it registers the add-in for their profile.

Taskpane 404 after new standalone deploy — Loader/channel deployment ordering issue. Escalate to AlphaSense. See Standalone Installer Reference — Troubleshooting.

Updates page says "Managed by IT" — Expected for standalone. No action needed.

EDR — helpers won't launch

If App Manager installs but the Python/Excel helpers stay down, EDR is often blocking process launch or a bundled native DLL. This shows up most on first launch after install.

1. Certificate-based exclusion (primary). Add allow rules for files signed by our publisher — certificate-based exclusions in the EDR console, not Trusted Root Certification Authorities. Add the current certificate and keep the outgoing one through at least October 31, 2026.

Current certificate (add):

• Publisher (Subject): CN="AlphaSense, Inc.", O="AlphaSense, Inc.", L=New York, S=New York, C=US, SERIALNUMBER=3178090, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
• Certificate policy: EV Code Signing (OID 2.23.140.1.3)
• Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
• SHA-1 thumbprint: 84C88F9B9A720F8146DC1313D468084208001A5B
• Valid: 2026-09-09 through 2027-12-09

Outgoing certificate (keep through at least Oct 31, 2026):

• Publisher (Subject): CN="Tegus, Inc.", OU=Tegus Engineering, O="Tegus, Inc.", L=Chicago, S=Illinois, C=US
• SHA-1 thumbprint: C5931AB11A182D6C316A4F8739AA4BDD3A6C1808
• Expires: 2026-09-19

This covers the installer and our own compiled backend files signed with this certificate.

2. Wildcard path exclusions. Some bundled third-party components (e.g. pdfium.dll) are not signed under our certificate. For standalone, the machine store path is:

• C:\Program Files\CarouselAppManager\components\store\runtime-ppt-deps\*
• C:\Program Files\CarouselAppManager\components\store\runtime-excel\*

If your security team prefers not to exclude the whole folder, we can scope to the specific blocked file — send the filename from the EDR log.

Upgrade Path to M365 Centralized Deployment

If your organization later moves to Microsoft 365 Admin Center deployment:

1. Deploy the locked add-in files via M365 Admin Center — either the classic XML (manifest-*.stable.locked.xml) or the unified .zip (AlphaSense-for-*.stable.locked.zip), one format per app (see Standalone Centralized Deployment, Step 1).

2. On each machine, reinstall standalone with /DeploymentMode=m365_admin_center:

AlphaSense-App-Manager-Setup-latest-standalone.exe /S /allusers /DeploymentMode=m365_admin_center

Or set CAROUSEL_DEPLOYMENT_MODE=m365_admin_center as a machine environment variable.

3. App Manager stops managing local Office registration and defers to the M365 deployment.

The existing backend components and machine store remain in place — only the Office registration method changes.

Limitations

• VMs are not a supported install target. Validate on physical endpoints or your standard managed image.
• Multi-user / RDS / AVD is not certified for the standalone artifact. See Standalone Installer Reference — Limitations.
• Windows only. No macOS standalone artifact.
• Larger download (~454 MB vs ~122 MB online).
• Not air-gapped. Local backends run offline after install, but the taskpane requires HTTPS access to plugins.alpha-sense.org.

Uninstall Behavior

The uninstaller:

1. Removes WEF Developer registry entries for both add-in IDs (for users who had them).
2. Deletes the machine component store at %ProgramFiles%\CarouselAppManager\.
3. Removes the HKLM auto-start Run key and install marker.
4. Removes the Electron application files from Program Files.

Use the UninstallString from HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\*. Do not pass /allusers to the uninstaller.

Related documentation

Standalone Installer Reference (Windows)