Change, upgrade, or uninstall SaaS Agent

After you install the OpenLM SaaS Agent, you manage the platforms it monitors in the agent's app, upgrade the agent from Broker Hub or on its host, and remove it from Windows. To install and connect the agent, see Install and connect SaaS Agent.

Manage monitored services

Each row in Monitored Services carries the platform's status and its own controls. Use the headings in this section to find the task you need.

Run a scan now

To collect without waiting for the next scheduled scan, select Synchronize. The scan runs in the background. The agent refuses it if the last scan was less than a minute ago.

Sign in again

After a password change, or when a scan fails on expired credentials, select Relogin. The agent opens Chrome at the vendor's sign-in page so you can sign in again.

Watch a scan that fails

To see where a scan stops, select Run troubleshooting process. It repeats the scan in a visible browser. See Why is a service stuck on Error?

Pause or resume monitoring

To stop collecting without deleting the configuration, use Monitoring. The row reads Active or Paused.

Change what the agent collects or controls

• Usage Monitoring collects AI token usage in addition to seats. It is shown only for platforms that report it, and the app annotates it with the vendor rights it needs.
• License Allocation Control lets OpenLM Platform act on allocations for this SaaS platform. It is shown only where the platform supports it, and it is on by default when it does.
• Export data into a file for OpenLM Broker writes scan output to a local file instead of sending it to OpenLM Platform. See Use with OpenLM Version 26.

Change credentials or options

To reopen the SaaS platform's credential and option dialog, select Edit. For Autodesk Cloud, Edit Allow List restricts collection to named teams, as described in Restrict collection to named teams.

Remove a service

To stop collecting for a platform and remove its configuration, select Delete.

Add a platform or refresh the list

To monitor another platform, select Add Service, as described in Add a monitored service. When a service or a status looks stale, select Refresh List to reload the list and the current statuses.

Service status

The following table lists the statuses a monitored service can have:

Status	Meaning
Ok	The last scan finished successfully.
Error	The last scan failed. The Message column carries the reason.
Synchronization under process	A scan is running, or the service has not completed its first one.
Paused	Monitoring is switched off for this service.

A single Error often has a transient cause, such as a vendor service that was slow to respond. Run Synchronize again before investigating. The agent doesn't retry a failed scan. It discards the result and waits for the next scheduled run.

Every failure is also raised as an alert and recorded in the audit trail, so you do not have to watch this screen to notice one. See Alerts.

How often data is collected

To set how often the agent scans, select a Sample Rate mode. All schedules run in UTC. The modes are:

• Daily: one scan a day, at the Execution Time you set.
• Hourly: a scan every Run Every (minutes) minutes. New services start at 360 minutes, that is, every 6 hours.

The agent runs one scan at a time across all services, so staggering execution times avoids a queue building on a host with many monitored platforms.

Single sign-on

Autodesk Cloud and Siemens sign in through Microsoft Entra ID rather than a vendor-native login. Select the method in the service's Single Sign On control:

• Autodesk Cloud: None, Azure SSO with sessions, or Azure SSO sessionless.
• Siemens: None or Azure SSO.

Set this before the first sign-in. If you change it later, use Relogin so the agent captures a session for the new method.

Where your identity provider enforces multi-factor authentication, extend the prompt interval for the account the agent uses. The agent cannot answer an MFA challenge, so a short interval turns into a scan failure the next time the challenge appears. For Autodesk Cloud, after you sign in to the Autodesk portal, extend the MFA validity to 30 days.

Restrict collection to named teams

Autodesk Cloud accounts are often divided into teams. Edit Allow List limits what OpenLM collects to the teams you choose.

1. Select the Autodesk Cloud service, then Edit Allow List.
2. Select Import Teams to load the teams the signed-in account can see. They appear under Available Tenants.
3. Move the teams you want to Allowed Tenants with Add, or take them back with Remove.
4. Select Save.

Leaving Allowed Tenants empty applies no restriction: every team the account can see is collected.

Agent settings

To change a setting for the whole agent rather than for one service, open Settings. It has two switches:

• Debug Mode: turn on when a portal sign-in fails, to collect a much more detailed trace, including Chrome's own internal log. Turn it off again once the problem is solved, because it produces large amounts of data.
• Skip Chrome Profile Picker: suppresses Chrome's profile chooser, which helps on a host that nobody signs in to. This writes a machine-wide Chrome policy and needs administrator rights. When the agent can't write it, the app shows you the exact commands to run.

Upgrade the SaaS Agent

To upgrade the agent, either update it from Broker Hub without visiting its machine, or run the newer installer on the machine itself.

Upgrade on the host

To upgrade one agent on its own machine, run the installer of the newer version there, signed in to Windows with the account the service runs under.

1. Download the newer installer, OpenLM_SaaSAgent_<version>.msi, from the Platform tab of the Downloads page.

2. Open the installer as for a new installation, or run it silently with the command in Install silently.

   The installer upgrades the installed agent in place. It also upgrades an older OpenLM Cloud Broker Agent. In a silent upgrade, leave out SERVICE_USER to keep the account that the service already runs under, unless that account is LocalSystem.

3. When the installation finishes, check that OpenLM SaaS Agent Service runs in Windows Services.

   msiexec reports success even when the service doesn't start.

The installer accepts the same version, so you can repeat an upgrade. It refuses an older version with the message A newer version of OpenLM SaaS Agent is already installed. An upgrade replaces bin\appsettings.json and UI\appsettings.json, so set a changed port again, as described in Why does the service start, then stop?

Manage agents from OpenLM Platform

To see which machines run a SaaS Agent, and to update the agents without going to each machine, open the Broker Hub SaaS Agents page. It lists every agent that reports in, by the host name of its machine, with its status, ID, IP address, and version. To see the services an agent reports, select its host name.

To roll out a new version to your agents:

1. On the SaaS Agents page, select Update SaaS Agents.

2. Under Custom Version, select Choose file, and then select the installer, OpenLM_SaaSAgent_<version>.msi.

   Keep the installer's original file name. Broker Hub and the agent accept only a signed OpenLM SaaS Agent installer whose name contains openlm, saas, agent, and the four-part version. Latest Version isn't available for SaaS Agents.

3. When Broker Hub has checked the file, select Continue.

4. Select the agents to update, and then select Continue.

An update arrives as a command the agent picks up within about half a minute. The agent downloads the installer, stops itself, reinstalls silently using the service account saved at installation time, and starts again. The SaaS Agents list doesn't refresh by itself: reload the page to see the new versions.

Files and directories

Paths are relative to the installation folder, C:\Program Files\OpenLM\OpenLM SaaS Agent by default. The following table lists the paths and their contents:

Path	Contents
bin\	The Windows service.
UI\	The desktop application.
Shared User Data Directory\	The Chrome profile the agent signs in with, including the saved vendor passwords.
bin\logs\saasagent-<yyyyMMdd>.log	The agent's main log, one file a day.
bin\logs\saasagent-debug-.txt	The agent's debug messages.
bin\logs\Plugin\Plugin_<platform>_LOG\	Per-platform scan logs. The screenshots folder in it holds screenshots of failed scans.
bin\logs\Screenshots\	Screenshots captured when a Siemens scan fails.
bin\DB\	The agent's local database: its receivers, the monitored services, the delivery buffer, and its stored credentials.
bin\CloudBrokerAgentID.txt	The agent's ID, as Broker Hub shows it.
bin\appsettings.json	Service configuration, including the local port.
UI\appsettings.json	The app's settings, including the address of the service.
UI\logs\OpenLM.SaaSAgent.UI\	The app's own log, one file a day.

Send the main log and the log folder for the failing platform when you contact support.

Uninstall

Remove the SaaS Agent from Windows in one of these ways, signed in with the service account:

• Installed apps: in Windows Settings, uninstall OpenLM SaaS Agent.

• Silent uninstallation: run msiexec /x with the installer you installed from:

  msiexec /x "<full path>\OpenLM_SaaSAgent_<version>.msi" /qn

Uninstalling stops and removes the service, closes the agent's app, and removes the program files, the shortcuts, the two Chrome policy values, and the saved account in the Credential Manager of the account that uninstalls. These items stay in the installation folder:

• bin\DB\: the receivers, with the client ID and the encrypted secret, the monitored services, the delivery buffer, and the stored vendor credentials.
• bin\CloudBrokerAgentID.txt: the agent's ID.
• bin\logs\ and UI\logs\: the logs, which contain the client ID.
• Shared User Data Directory\: the Chrome profile with the saved vendor passwords, if the agent signed in to a portal.

A new installation in the same folder reuses these files: the agent keeps its ID and its receivers, and reports in again without a new import. If you are decommissioning the host, delete the installation folder, and also review the "Log on as a service" right granted to the service account, and the Windows Terminal setting, if you turned it on.

Uninstalling leaves the agent listed in Broker Hub, with the status Up. Broker Hub checks its agents every 4 hours. It raises an alert for an agent that has been silent for more than an hour, shows the agent as Warning after 24 hours without contact, and as Not Reporting after 48 hours. To remove the agent from the list, select it on the SaaS Agents page, and then select Delete.