Agent Installation

The SailPoint Disconnected Application Agent is a Windows service that Identity Security Cloud uses to replay recorded operations. Identity Security Cloud sends a request to the agent. The agent opens a browser on the Windows host, runs the recorded steps, and returns the result. The browser stays on your network, and the managed system does not need to be reachable from the internet.

The agent accepts TLS connections only. There is no plaintext port. The agent must run as a dedicated unprivileged service account. It does not run as SYSTEM. For more information, refer to Configuring TLS and Client Authentication.

Prerequisites

Before you install SpDisconAppSvc.exe, prepare a dedicated Windows Server virtual machine. The virtual machine must be able to reach the managed system, and the virtual appliance must be able to reach the virtual machine on the configured TLS port.

Software Requirements

Operating Systems

  • Microsoft Windows Server 2025

  • Microsoft Windows Server 2022

  • Microsoft Windows Server 2019

  • Microsoft Windows Server 2016

.NET Framework

  • .NET Framework version 4.8 and later

Hardware Requirements

Component

Recommended Hardware Requirement

Minimum Hardware Requirement

CPU

8-Core

4-Core

RAM

16 GB

8 GB

Free Disk Space

50 GB

250 MB

  • A dedicated service account used only by the SailPoint Disconnected Application Agent. The account must be a standard user whose only group membership is Users. Do not use an administrator account, a personal account, or SYSTEM.

  • Internet access on the host for the first runtime install, or pre-staged files for an offline install.

  • A TLS server certificate in Local Computer > Personal, with a subject or SAN that matches the host name. The service account needs Read on the private key. If the certificate is self-signed, also place it in Local Computer > Trusted Root Certification Authorities.

  • The Windows account that Identity Security Cloud uses to call the SailPoint Disconnected Application Agent. For more information, refer to Configuring TLS and Client Authentication.

Service Account Permissions

The service account requires the following permissions:

Permission

Location

Granted by

Log on as a service

Local security policy

Administrator

Full Control on the SailPoint Disconnected Application Agent registry key

Registry

Administrator

Modify on the log folder

%ProgramData%\SailPoint\<instance>

Granted by --service-account

Read on the TLS private key

Certificate store

Administrator

Write on the account temp folder

Account temp folder

Usually already present

To print the required permissions for the installed instance, run the following command:

SpDisconAppSvc.exe --required-permissions

Caution
--service-account records the account. It does not grant Log on as a service. Missing that right causes Windows error 1069.

Caution
Do not install the SailPoint Disconnected Application Agent under C:\Users\<name>\. Use a system path such as C:\SailPoint\SpDisconAppSvc. Do not give the service account write access to the install folder.

Downloading Agent

Note
You are only entitled to download components for which you have an active license with SailPoint. The availability of a component for download does not grant you a license to use a component or entitle you to use a component for which you do not have an active license. Contact your SailPoint Account Representative or Customer Success Manager (CSM) for more information.

  1. Go to Agent Settings and select Download Agent.

  2. Unzip the downloaded SpDisconAppSvc-<version>.zip archive to a system location. For example, C:\SailPoint\SpDisconAppSvc.

  3. Open the DLL properties and confirm that the files are trusted. Unblock the files if needed.

Installing Agent

Complete the following steps from an elevated Command Prompt. After you start the service, the SailPoint Disconnected Application Agent runs as the service account.

The SailPoint Disconnected Application Agent does not include a browser. Before automation can run, install the browser runtime (Node.js, Playwright, and Chromium) on the host. You do not download these components by hand. One SailPoint Disconnected Application Agent command installs them.

  1. Create the dedicated service account as a standard user whose only group membership is Users.

  2. Install the browser runtime. This step requires internet access, or use --offline <DIR> for a host without internet access:

    SpDisconAppSvc.exe --rpa-init

  3. Install the Windows service:

    SpDisconAppSvc.exe -i

  4. Set the service account. You are prompted for the password:

    SpDisconAppSvc.exe --service-account .\svc-rpa-agent

  5. Grant Log on as a service, registry Full Control, and Read on the certificate private key.

  6. Register the Identity Security Cloud caller. At least one caller is required, or the service does not start:

    SpDisconAppSvc.exe -a DOMAIN\user

  7. Verify the configuration, and then start the service:

    SpDisconAppSvc.exe --show-config

    SpDisconAppSvc.exe -s

--show-config prints Ready to start. or lists what is still missing. Starting the service is the real test. Failures go to the trace file and the Windows event log.

--rpa-init must complete before automation can run. Use --rpa-update later to switch only if the self-test passes. Use --rollback to return to the previous stack.

Useful Commands

Command

Purpose

SpDisconAppSvc.exe -i / -u

Install or uninstall

SpDisconAppSvc.exe -s / -k / -t

Start, stop, or restart

SpDisconAppSvc.exe -p <port>

TLS listen port. A restart is required.

SpDisconAppSvc.exe -a DOMAIN\user

Register a caller

SpDisconAppSvc.exe --rpa-init

Install Node.js, Playwright, and Chromium

SpDisconAppSvc.exe --offline <DIR>

Offline runtime install

SpDisconAppSvc.exe --show-config

Configuration and readiness

SpDisconAppSvc.exe -h

Help. Use this command if the available options differ.

Troubleshooting

Symptom

Resolution

Error 1069, logon failure

Grant Log on as a service, or correct the password.

Access is denied. The trace file is empty.

Reinstall outside C:\Users\.

Start times out after about 30 seconds. The trace file is empty.

The service account cannot write the registry key. Check Event Viewer. This is common after a reinstall.

TLS error mentions the certificate

Grant Read on the private key.

No certificate found, but it is in the store

Place the self-signed certificate in Trusted Root Certification Authorities.

Provisioning or automation error

Run --rpa-init to completion.

Name or port already in use on reinstall

Close Services and Event Viewer, and then retry.