SaaS Agent

The OpenLM SaaS Agent is a Windows application you install on a machine of your own. It signs in to your SaaS vendors' administration portals through a Google Chrome installed on that machine, reads what the account holds and who is using it, and reports the result to the OpenLM Platform. Use it for the platforms that publish no usable licensing API — the ones where the only reliable source of truth is the vendor's own admin console.

The SaaS Agent is an installed component, not an app in the Navigation menu. After it reports in, you manage the fleet from the Broker Hub, on its SaaS Agents page.

note

Four OpenLM components have similar names. The OpenLM Broker is the service on your license server. The Broker Hub is the Platform console where you approve and manage every Broker and SaaS Agent. The Cloud Broker is a Platform service that reaches SaaS vendors over their APIs, with nothing installed on your side. The SaaS Agent (this page) is the Windows application that reaches SaaS vendors through a browser, when an API is not an option.

What the SaaS Agent records

For each vendor account you connect, a scan records:

• What the organization holds, and who holds it — the products or seats on the account, and the user each assignment belongs to.
• Consumption, wherever the vendor exposes it — active sessions or leases with a start time, last-access dates, or metered consumption such as tokens or credits.
• AI assistant usage — for the connectors that publish a usage report, broken down by user and model.

What actually arrives depends on what each vendor exposes through its portal or API, so coverage varies by connector and grows as connectors are added.

The data lands in the same reports as every other OpenLM source, so SaaS seats sit next to floating and named licenses in usage and compliance analysis. Where the vendor allows it, License Access Control can also act on the platform — assigning and revoking seats rather than only reporting them.

The agent's own window is a four-item sidebar: Monitored Services, OpenLM Platform, Settings, and Integration.

Choosing between the SaaS Agent and the Cloud Broker

Both components collect SaaS licensing data, but they reach the vendor in opposite ways.

	SaaS Agent	Cloud Broker
Where it runs	A Windows machine you provide	OpenLM Platform, nothing to install
How it reaches the vendor	Signs in to the admin portal through Google Chrome	Vendor API, with a token or key you supply
What you supply	A host, a Windows service account, and a portal sign-in	API credentials
Best for	Vendors with no licensing API, or where the API omits what you need	Vendors with a documented licensing API

Some platforms are supported by both components, and there is no single rule that one supersedes the other — it depends on the platform.

Bentley needs both. Cloud Broker collects Bentley floating-license usage from the vendor's reporting API and cannot perform License Access Control. The SaaS Agent reports entitled quantities and per-user allocations, and it is what carries out Bentley LAC. Configure Bentley in the SaaS Agent first, then add the Bentley credential in Cloud Broker: when you enable License Access Control there, Cloud Broker asks which SaaS Agent should apply the changes and forwards the commands to it. Because the two paths read different Bentley surfaces, Bentley appears in OpenLM as two license servers — one carrying usage, one carrying entitlements. That is expected.

Several platforms are listed in Cloud Broker but set up by OpenLM on your behalf. Their Cloud Broker form is replaced by a note asking you to contact support@openlm.com, so there is nothing to configure twice — Adobe Cloud, Altair One, Autodesk Cloud, Figma, LinkedIn Sales Navigator, Syncfusion, and ZoomInfo among them.

For the rest, choose one. Where both components can collect a platform independently, connect it in one of them only, so the same accounts are not reported twice.

Supported SaaS platforms

For which platforms OpenLM supports and which component collects each one, see Supported software and the SaaS platform guides. Platform names in the agent's Add Service dialog match the names used there.

What this page adds is the handful of platforms that behave differently once the agent is running:

• Single Sign On appears only on Autodesk Cloud and Siemens. Every other connector signs in with a vendor-native login and hides the control.
• Edit Allow List, which limits collection to named teams, applies only to Autodesk Cloud.
• License Access Control is available on every connector except Altium 365, and is on by default where it is available.
• ArcGIS Enterprise is the one connector that does not drive a browser — it queries your portal over REST — so it needs no Chrome sign-in. Chrome still has to be installed and healthy on the host, because the agent checks and manages the shared profile on every scan.

Some connectors also ask for credentials in the agent itself, in addition to or instead of the browser sign-in, and a few ask for your tenant's account URL. The Add Service flow prompts you for whatever a given platform needs, so there is nothing to look up in advance.

Before you install

Host requirements

See System requirements for the published figures. In addition:

• Google Chrome must already be installed. The agent starts the machine's own Chrome; it does not download or bundle a browser.
• The .NET 8 Desktop Runtime must be present. The agent and its UI are framework-dependent .NET 8 builds. The installer itself additionally requires .NET Framework 4.5 or later, and refuses to run without it.
• Install as an administrator. The package is machine-wide and stops with a message if it is not run elevated.
• The host stays on. Scans run from a Windows service, so they continue with nobody signed in, but not while the machine is asleep or shut down. A small always-on VM is a better host than a laptop.

Plan the Windows account first

The agent's service account is the single most consequential choice in the installation, because the same account has to do three jobs:

• run the Windows service,
• own the Chrome profile the agent signs in with,
• decrypt the SaaS credentials the agent stores on disk.

Those stored credentials are protected against the Windows account that wrote them. If you change the service account later, the agent can no longer read them and every affected service starts failing until you re-enter its credentials. Decide on a dedicated, permanent account before you start.

Collect these first

• The SaaS Agent installer, from the Platform tab of the Downloads page.
• A SaaS Agent authorization file, generated in Identity.
• The Windows account and password the service will run under.
• An administrator sign-in for each SaaS portal you intend to monitor.

Install the SaaS Agent

Run the installer as an administrator and work through the wizard.

1. Accept the license agreement and choose the installation folder. The default is C:\Program Files\OpenLM\OpenLM SaaS Agent. If an older OpenLM Cloud Broker Agent is installed in its default location, the wizard finds it and upgrades in place.

2. On Agent Service Logon Configuration, enter the account the service will run under.

   • Username accepts DOMAIN\Username or user@domain. For a local account, use .\Username or COMPUTERNAME\Username. The field is a drop-down pre-filled with the accounts on the machine, and you can type into it.
   • Password is masked; select Show password to check what you typed.
   • The installer verifies that the account exists and that the name is well formed. It does not verify the password — a wrong password surfaces later, when the service fails to start.
   • Leaving both fields empty installs the service under LocalSystem. The dialog's own note advises against it: do this only if installation otherwise fails, and set the logon account afterwards in Services.

   The credentials you enter are also saved to Windows Credential Manager, under the target OpenLM/SaaSAgent/ServiceAccount, so that an automatic update can reinstall the service under the same account.

3. On Additional Permissions, choose what the installer should configure for you. Three options are offered, and the first two are selected by default.

   Option	Default	What it changes
   Allow access to Chrome user data (for browser tracking)	Selected	Grants full control over the agent's shared Chrome profile folder, inside the installation directory.
   Allow registry changes to skip Chrome profile selection	Selected	Writes a machine-wide Chrome policy that suppresses the profile picker and disables browser sign-in. This affects every Chrome user on the machine, which is why the option says it may limit Chrome sign-in. Clear it on a shared workstation.
   Run Windows Terminal in administrator mode	Cleared	Marks Windows Terminal to always run elevated.

   The first option grants its permission to the account running the installer. If that is not the account you named in the previous step, grant that account full control of the Shared User Data Directory folder yourself after installing.

4. Finish the wizard, leaving the option to open the SaaS Agent UI selected.

The installer creates the Windows service OpenLMSaaSAgentService, displayed in Services as OpenLM SaaS Agent Service, set to start automatically (delayed).

Connect the agent to OpenLM

A receiver is the agent's connection to a Broker Hub. Until one exists, the agent has nowhere to send data, and the Add Service dialog offers only the platforms that can write to a local file instead.

1. In Identity, select Add Client, choose the SaaS Agent client type, and download the authorization file.
2. In the SaaS Agent, open OpenLM Platform and select Add Receiver.
3. Select Import Authorization file and choose the downloaded file. The URL, Client ID, and Client Secret fields fill in from it. You can also type the three values by hand.
4. Leave Buffering enabled unless you have a reason not to, and set Buffer file size (MB) if the default is too small for your outage window.
5. Select Check Connection. Wait for the status to report success.
6. Select Save.

The receiver now appears in the OpenLM Platform list with its connection status. The agent also appears in the Broker Hub, on the SaaS Agents page.

If Check Connection fails, confirm the authorization file has not expired, that the host has internet access, and that Broker Hub and Identity are reachable.

When Broker Hub is unreachable

With buffering on, data that cannot be delivered is written to disk and re-sent automatically, on the hour, once the connection returns. When the buffer reaches its size limit, the oldest messages are dropped to make room — so size the buffer for the longest outage you want to survive without gaps. CLEAR BUFFER on the receiver discards everything queued for it.

Failure alerts are not buffered. An alert raised while Broker Hub is unreachable is lost.

You can configure more than one receiver. Every message is sent to all of them.

Add a monitored service

1. Open Monitored Services and select Add Service.
2. Choose the platform and select Confirm.
3. If the platform needs credentials of its own, enter them when prompted. For Autodesk Cloud, use an account with administrator or secondary-administrator rights in the Autodesk portal; for Monday, LinkedIn Company Page, and ArcGIS Enterprise, supply your tenant's account URL as well.
4. The agent opens Chrome on the vendor's sign-in page. Sign in there as you normally would.
5. When Chrome offers to save the password, accept. The agent reuses that saved sign-in on later scans.
6. Close Chrome and answer the agent's prompt to confirm you have finished signing in.

The service appears in the list and its first scan starts immediately. When the scan succeeds, the status becomes Ok.

tip

Sign in with the Chrome profile that belongs to the account you are monitoring. The agent drives one shared Chrome profile, so a sign-in left behind by a different account is the most common cause of a scan that authenticates as the wrong user.

Manage monitored services

Each row in Monitored Services carries the platform's status and its own controls.

Control	What it does
Synchronize	Runs a scan now, in the background, without a visible browser. Refused if the last scan was less than a minute ago.
Relogin	Opens Chrome at the vendor's sign-in page so you can sign in again. Use it after a password change, or when a scan fails on expired credentials.
Run troubleshooting process	Repeats the scan in a visible browser so you can watch where it fails. See Troubleshooting.
Delete	Removes the service and stops collecting for it.
Monitoring	Pauses and resumes collection without deleting the configuration. The row reads Active or Paused.
Usage Monitoring	Collects AI token usage in addition to seats. Shown only for platforms that report it, and annotated in the app with the vendor rights it needs.
License Allocation Control	Lets OpenLM act on allocations for this platform. Shown only where the platform supports it, and on by default when it does.
Sample Rate	How often the scan runs. See How often data is collected.
Single Sign On	The sign-in method to use. Shown only for Autodesk Cloud and Siemens.
Export data into a file for OpenLM Broker	Writes scan output to a local file instead of sending it to OpenLM Platform. See Use with OpenLM Version 26.
Edit	Reopens the platform's credential and option dialog.
Edit Allow List	Restricts collection to named teams. Autodesk Cloud only.
Add Service	Adds another platform.
Refresh List	Reloads the list and the current statuses. Use it when a service or a status looks stale.

Service status

Status	Meaning
Ok	The last scan finished successfully.
Error	The last scan failed. The Message column carries the reason.
Synchronization under process	A scan is running, or the service has not completed its first one.
Paused	Monitoring is switched off for this service.

A single Error is often transient — a slow portal, a login page that changed shape for one visit. Run Synchronize again before investigating. There is no automatic retry: a failed scan is discarded and the service waits for its next scheduled run.

Every failure is also raised as an alert and recorded in the audit trail, so you do not have to watch this screen to notice one. See Alerts.

How often data is collected

Sample Rate offers two modes, and all schedules run in UTC.

• Daily — one scan a day, at the Execution Time you set.
• Hourly — a scan every Run Every (minutes) minutes. New services start at 360 minutes, that is, every six hours.

The agent runs one scan at a time across all services, so staggering execution times avoids a queue building on a host with many monitored platforms.

Single sign-on

Autodesk Cloud and Siemens sign in through Microsoft Entra ID rather than a vendor-native login. Choose the method on the service's Single Sign On control:

• Autodesk Cloud — None, Azure SSO with sessions, or Azure SSO sessionless.
• Siemens — None or Azure SSO.

Set this before the first sign-in. If you change it later, use Relogin so the agent captures a session for the new method.

Where your identity provider enforces multi-factor authentication, extend the prompt interval for the account the agent uses. The agent cannot answer an MFA challenge, so a short interval turns into a scan failure the next time the challenge appears.

Restrict collection to named teams

Autodesk Cloud accounts are often divided into teams. Edit Allow List limits what OpenLM collects to the teams you choose.

1. Select the Autodesk Cloud service, then Edit Allow List.
2. Select Import Teams to load the teams the signed-in account can see. They appear under Available Tenants.
3. Move the teams you want to Allowed Tenants with Add, or take them back with Remove.
4. Select Save.

Leaving Allowed Tenants empty applies no restriction — every team the account can see is collected.

Agent settings

Settings holds two switches that apply to the whole agent rather than to one service.

• Debug Mode — turn on when a portal sign-in fails, to collect a much more detailed trace, including Chrome's own internal log. Turn it off again once the problem is solved; it produces a lot of data.
• Skip Chrome Profile Picker — suppresses Chrome's profile chooser so an unattended scan is not left waiting on it. This writes a machine-wide Chrome policy and needs administrator rights; when the agent cannot write it, the app shows you the exact commands to run.

Use with OpenLM Version 26

The SaaS Agent can feed an on-premises OpenLM Version 26 deployment instead of the Platform. In that arrangement, the agent writes scan output to a local file that an OpenLM Broker picks up, and no Broker Hub receiver is involved.

Two things follow from that:

• With no receiver configured, Add Service offers only the platforms that support file export. Today that is Autodesk Cloud alone.
• File export is a per-service switch — Export data into a file for OpenLM Broker — that you have to turn on. Skipping the receiver does not switch it on for you.

If you are running OpenLM Platform, ignore this section and configure a receiver as described above.

Manage agents from the Platform

Once an agent has a receiver, it appears in the Broker Hub on the SaaS Agents page, alongside the Brokers installed on your license servers. From there you can see each agent's host and version, and roll out a new version to selected agents without touching the machine.

An update arrives as a command the agent picks up within about half a minute. The agent downloads the installer, stops itself, reinstalls silently using the service account saved at installation time, and starts again.

Files and directories

Paths are relative to the installation folder, C:\Program Files\OpenLM\OpenLM SaaS Agent by default.

Path	Contents
bin\	The Windows service.
UI\	The desktop application.
Shared User Data Directory\	The Chrome profile the agent signs in with, including the saved vendor passwords.
bin\logs\saasagent-<date>.log	The agent's main log.
bin\logs\Plugin\Plugin_<platform>_LOG\	Per-platform scan logs, and captured screenshots of failures.
bin\logs\Screenshots\	Screenshots captured when a scan fails.
bin\DB\	The agent's local database, the delivery buffer, and its stored credentials.
bin\appsettings.json	Service configuration, including the local port.

Send the main log and the log folder for the failing platform when you contact support.

Security

The SaaS Agent holds administrator sign-ins for your SaaS vendors and can change allocations on them. Treat its host as a privileged system.

• Give it a dedicated service account. It should be a permanent, non-interactive account that no one signs in with, and it should not be a domain administrator. Its identity is what protects the stored SaaS credentials.
• Restrict the agent's local port. The service listens on port 7572 for its own desktop UI. Nothing outside the host needs to reach it, so block it at the host firewall.
• Isolate the host. Do not use a machine that other people sign in to interactively. The shared Chrome profile holds the saved vendor passwords, and the profile-picker option changes Chrome for everyone on the machine.
• Know what leaves the machine. Scan results identify users by email address, so the reports contain personal data. Failure screenshots of vendor admin consoles are kept on disk for a week.
• Review who can deploy allocation rules. A License Access Control deployment reaching this agent can add, remove, and reassign seats on the live vendor platform.

Traffic to OpenLM is outbound HTTPS on port 443, authorized by the credentials in the authorization file. Ports 7572 and 9222–9226 are used on the host itself — 7572 between the desktop UI and the service, and 9222–9226 to control the local Chrome — and do not need to be opened at the perimeter.

Troubleshooting

A service is stuck on Error. Run Synchronize once to rule out a transient failure. Then Relogin — expired credentials are the most common cause. If both fail, use Run troubleshooting process, which repeats the scan in a visible browser so you can see where it stops. Let it finish on its own; the browser opens and closes as part of the run.

"The Shared User Data Directory of Chrome is already being used by the Windows Service." The agent drives one Chrome profile, and a scheduled scan currently holds it. Wait for the scan to finish and try again. A scan that finds the profile busy reschedules itself a few minutes later on its own.

A scan authenticates as the wrong user. The shared profile has a sign-in from another account. Use Relogin on the affected service and sign in with the right one.

Every protected-credential service failed at once, after nothing changed. Check whether the service logon account changed. The stored SaaS credentials can only be read by the account that wrote them; re-enter each service's credentials under the new account with Edit.

The service does not start after installation. The installer checks the account but not the password. Open Services, find OpenLM SaaS Agent Service, and set the correct password on its Log On tab.

The service starts, then exits. Something else is using port 7572. The agent records the conflict in the Windows event log with the commands to identify and free the port.

The agent does not appear in Broker Hub. Confirm the receiver's Check Connection succeeds, that the authorization file is current, and that the host can reach OpenLM on port 443.

Uninstall

Remove OpenLM SaaS Agent from Apps & features, or run msiexec /x against the installer package. This stops and removes the service and deletes the program files.

Some machine-level changes are left behind by design. If you are decommissioning the host, also review:

• the "Log on as a service" right granted to the service account,
• the Windows Terminal elevation setting, if you enabled it,
• the agent's data folder, which still holds its local database and buffered messages,
• the shared Chrome profile, which still holds saved vendor passwords.

Related

• Broker Hub — approve, monitor, and update every Broker and SaaS Agent from the Platform.
• Cloud Broker — the API-based alternative for SaaS platforms that expose one.
• SaaS platform guides — per-platform setup notes.
• License Access Control — act on SaaS allocations, not just report them.
• System requirements — the published host requirements.
• SaaS Agent changelog — what changed in each release.