--- title: Change, upgrade, or uninstall SaaS Agent description: Run, pause, and change the services of the OpenLM SaaS Agent, upgrade the agent on its host or from Broker Hub, and uninstall it, for OpenLM Platform. product: OpenLM Platform --- After you install the OpenLM SaaS Agent, you manage the platforms it monitors in the agent's app, upgrade the agent from Broker Hub or on its host, and remove it from Windows. To install and connect the agent, see [Install and connect SaaS Agent](https://www.openlm.com/documentation/cloud/data-collection/saas-agent/install). ## Manage monitored services Each row in **Monitored Services** carries the platform's status and its own controls. Use the headings in this section to find the task you need. ### Run a scan now To collect without waiting for the next scheduled scan, select **Synchronize**. The scan runs in the background. The agent refuses it if the last scan was less than a minute ago. ### Sign in again After a password change, or when a scan fails on expired credentials, select **Relogin**. The agent opens Chrome at the vendor's sign-in page so you can sign in again. ### Watch a scan that fails To see where a scan stops, select **Run troubleshooting process**. It repeats the scan in a visible browser. See [Why is a service stuck on Error?](https://www.openlm.com/documentation/cloud/data-collection/saas-agent/troubleshooting#why-is-a-service-stuck-on-error) ### Pause or resume monitoring To stop collecting without deleting the configuration, use **Monitoring**. The row reads **Active** or **Paused**. ### Change what the agent collects or controls - **Usage Monitoring** collects AI token usage in addition to seats. It is shown only for platforms that report it, and the app annotates it with the vendor rights it needs. - **License Allocation Control** lets OpenLM Platform act on allocations for this SaaS platform. It is shown only where the platform supports it, and it is on by default when it does. - **Export data into a file for OpenLM Broker** writes scan output to a local file instead of sending it to OpenLM Platform. See [Use with OpenLM Version 26](https://www.openlm.com/documentation/cloud/data-collection/saas-agent/install#use-with-openlm-version-26). ### Change credentials or options To reopen the SaaS platform's credential and option dialog, select **Edit**. For Autodesk Cloud, **Edit Allow List** restricts collection to named teams, as described in [Restrict collection to named teams](#restrict-collection-to-named-teams). ### Remove a service To stop collecting for a platform and remove its configuration, select **Delete**. ### Add a platform or refresh the list To monitor another platform, select **Add Service**, as described in [Add a monitored service](https://www.openlm.com/documentation/cloud/data-collection/saas-agent/install#add-a-monitored-service). When a service or a status looks stale, select **Refresh List** to reload the list and the current statuses. ### Service status The following table lists the statuses a monitored service can have: | Status | Meaning | | --- | --- | | **Ok** | The last scan finished successfully. | | **Error** | The last scan failed. The **Message** column carries the reason. | | **Synchronization under process** | A scan is running, or the service has not completed its first one. | | **Paused** | Monitoring is switched off for this service. | A single **Error** often has a transient cause, such as a vendor service that was slow to respond. Run **Synchronize** again before investigating. The agent doesn't retry a failed scan. It discards the result and waits for the next scheduled run. Every failure is also raised as an alert and recorded in the audit trail, so you do not have to watch this screen to notice one. See [Alerts](https://www.openlm.com/documentation/cloud/automations/alerts/). ### How often data is collected To set how often the agent scans, select a **Sample Rate** mode. All schedules run in UTC. The modes are: - **Daily**: one scan a day, at the **Execution Time** you set. - **Hourly**: a scan every **Run Every (minutes)** minutes. New services start at 360 minutes, that is, every 6 hours. The agent runs one scan at a time across all services, so staggering execution times avoids a queue building on a host with many monitored platforms. ### Single sign-on Autodesk Cloud and Siemens sign in through Microsoft Entra ID rather than a vendor-native login. Select the method in the service's **Single Sign On** control: - **Autodesk Cloud**: **None**, **Azure SSO with sessions**, or **Azure SSO sessionless**. - **Siemens**: **None** or **Azure SSO**. Set this before the first sign-in. If you change it later, use **Relogin** so the agent captures a session for the new method. Where your identity provider enforces multi-factor authentication, extend the prompt interval for the account the agent uses. The agent cannot answer an MFA challenge, so a short interval turns into a scan failure the next time the challenge appears. For Autodesk Cloud, after you sign in to the Autodesk portal, extend the MFA validity to 30 days. ### Restrict collection to named teams Autodesk Cloud accounts are often divided into teams. **Edit Allow List** limits what OpenLM collects to the teams you choose. 1. Select the Autodesk Cloud service, then **Edit Allow List**. 2. Select **Import Teams** to load the teams the signed-in account can see. They appear under **Available Tenants**. 3. Move the teams you want to **Allowed Tenants** with **Add**, or take them back with **Remove**. 4. Select **Save**. Leaving **Allowed Tenants** empty applies no restriction: every team the account can see is collected. ## Agent settings To change a setting for the whole agent rather than for one service, open **Settings**. It has two switches: - **Debug Mode**: turn on when a portal sign-in fails, to collect a much more detailed trace, including Chrome's own internal log. Turn it off again once the problem is solved, because it produces large amounts of data. - **Skip Chrome Profile Picker**: suppresses Chrome's profile chooser, which helps on a host that nobody signs in to. This writes a machine-wide Chrome policy and needs administrator rights. When the agent can't write it, the app shows you the exact commands to run. ## Upgrade the SaaS Agent To upgrade the agent, either update it from Broker Hub without visiting its machine, or run the newer installer on the machine itself. ### Upgrade on the host To upgrade one agent on its own machine, run the installer of the newer version there, signed in to Windows with the account the service runs under. 1. Download the newer installer, `OpenLM_SaaSAgent_.msi`, from the **Platform** tab of the [Downloads page](https://www.openlm.com/documentation/cloud/openlm-administration/products/). 2. Open the installer as for a new installation, or run it silently with the command in [Install silently](https://www.openlm.com/documentation/cloud/data-collection/saas-agent/install#install-silently). The installer upgrades the installed agent in place. It also upgrades an older **OpenLM Cloud Broker Agent**. In a silent upgrade, leave out `SERVICE_USER` to keep the account that the service already runs under, unless that account is LocalSystem. 3. When the installation finishes, check that **OpenLM SaaS Agent Service** runs in Windows **Services**. `msiexec` reports success even when the service doesn't start. The installer accepts the same version, so you can repeat an upgrade. It refuses an older version with the message `A newer version of OpenLM SaaS Agent is already installed.` An upgrade replaces `bin\appsettings.json` and `UI\appsettings.json`, so set a changed port again, as described in [Why does the service start, then stop?](https://www.openlm.com/documentation/cloud/data-collection/saas-agent/troubleshooting#why-does-the-service-start-then-stop) ### Manage agents from OpenLM Platform To see which machines run a SaaS Agent, and to update the agents without going to each machine, open the [Broker Hub](https://www.openlm.com/documentation/cloud/data-collection/broker-hub) **SaaS Agents** page. It lists every agent that reports in, by the host name of its machine, with its status, ID, IP address, and version. To see the services an agent reports, select its host name. To roll out a new version to your agents: 1. On the **SaaS Agents** page, select **Update SaaS Agents**. 2. Under **Custom Version**, select **Choose file**, and then select the installer, `OpenLM_SaaSAgent_.msi`. Keep the installer's original file name. Broker Hub and the agent accept only a signed OpenLM SaaS Agent installer whose name contains `openlm`, `saas`, `agent`, and the four-part version. **Latest Version** isn't available for SaaS Agents. 3. When Broker Hub has checked the file, select **Continue**. 4. Select the agents to update, and then select **Continue**. An update arrives as a command the agent picks up within about half a minute. The agent downloads the installer, stops itself, reinstalls silently using the service account saved at installation time, and starts again. The **SaaS Agents** list doesn't refresh by itself: reload the page to see the new versions. ## Files and directories Paths are relative to the installation folder, `C:\Program Files\OpenLM\OpenLM SaaS Agent` by default. The following table lists the paths and their contents: | Path | Contents | | --- | --- | | `bin\` | The Windows service. | | `UI\` | The desktop application. | | `Shared User Data Directory\` | The Chrome profile the agent signs in with, including the saved vendor passwords. | | `bin\logs\saasagent-.log` | The agent's main log, one file a day. | | `bin\logs\saasagent-debug-.txt` | The agent's debug messages. | | `bin\logs\Plugin\Plugin__LOG\` | Per-platform scan logs. The `screenshots` folder in it holds screenshots of failed scans. | | `bin\logs\Screenshots\` | Screenshots captured when a Siemens scan fails. | | `bin\DB\` | The agent's local database: its receivers, the monitored services, the delivery buffer, and its stored credentials. | | `bin\CloudBrokerAgentID.txt` | The agent's ID, as Broker Hub shows it. | | `bin\appsettings.json` | Service configuration, including the local port. | | `UI\appsettings.json` | The app's settings, including the address of the service. | | `UI\logs\OpenLM.SaaSAgent.UI\` | The app's own log, one file a day. | Send the main log and the log folder for the failing platform when you contact support. ## Uninstall Remove the SaaS Agent from Windows in one of these ways, signed in with the service account: - **Installed apps**: in Windows **Settings**, uninstall **OpenLM SaaS Agent**. - **Silent uninstallation**: run `msiexec /x` with the installer you installed from: ```bash msiexec /x "\OpenLM_SaaSAgent_.msi" /qn ``` Uninstalling stops and removes the service, closes the agent's app, and removes the program files, the shortcuts, the two Chrome policy values, and the saved account in the Credential Manager of the account that uninstalls. These items stay in the installation folder: - `bin\DB\`: the receivers, with the client ID and the encrypted secret, the monitored services, the delivery buffer, and the stored vendor credentials. - `bin\CloudBrokerAgentID.txt`: the agent's ID. - `bin\logs\` and `UI\logs\`: the logs, which contain the client ID. - `Shared User Data Directory\`: the Chrome profile with the saved vendor passwords, if the agent signed in to a portal. A new installation in the same folder reuses these files: the agent keeps its ID and its receivers, and reports in again without a new import. If you are decommissioning the host, delete the installation folder, and also review the "Log on as a service" right granted to the service account, and the Windows Terminal setting, if you turned it on. Uninstalling leaves the agent listed in Broker Hub, with the status **Up**. Broker Hub checks its agents every 4 hours. It raises an alert for an agent that has been silent for more than an hour, shows the agent as **Warning** after 24 hours without contact, and as **Not Reporting** after 48 hours. To remove the agent from the list, select it on the **SaaS Agents** page, and then select **Delete**.