Agent Installation

The SailPoint Disconnected Application Agent is a Windows service that SailPoint uses to replay recorded operations. SailPoint sends a request to the agent. The agent opens a browser on the Windows host, runs the recorded steps, and returns the result. The browser stays on your network, and the managed system does not need to be reachable from the internet.

The agent accepts TLS connections only. There is no plaintext port. The agent must run as a dedicated unprivileged service account. It does not run as SYSTEM. For more information, refer to Configuring TLS and Client Authentication.

Prerequisites

Before you install SpDisconAppSvc.exe, prepare a dedicated Windows Server virtual machine. The virtual machine must be able to reach the managed system, and the virtual appliance must be able to reach the virtual machine on the configured TLS port.

Software Requirements

Operating Systems

Microsoft Windows Server 2025
Microsoft Windows Server 2022
Microsoft Windows Server 2019
Microsoft Windows Server 2016

.NET Framework

.NET Framework version 4.8 and later

Hardware Requirements

Component	Recommended Hardware Requirement	Minimum Hardware Requirement
CPU	8-Core	4-Core
RAM	16 GB	8 GB
Free Disk Space	50 GB	250 MB

A dedicated service account used only by the SailPoint Disconnected Application Agent. The account must be a standard user whose only group membership is Users. Do not use an administrator account, a personal account, or SYSTEM.
Internet access on the host for the first runtime install, or pre-staged files for an offline install.
A TLS server certificate in Local Computer > Personal, with a subject or SAN that matches the host name. The service account needs Read on the private key. If the certificate is self-signed, also place it in Local Computer > Trusted Root Certification Authorities.
The Windows account that SailPoint uses to call the SailPoint Disconnected Application Agent. For more information, refer to Configuring TLS and Client Authentication.

Service Account Permissions

The service account requires the following permissions:

Permission	Location	Granted by
Log on as a service	Local security policy	Administrator
Full Control on the SailPoint Disconnected Application Agent registry key	Registry	Administrator
Modify on the log folder	`%ProgramData%\SailPoint\<instance>`	Granted by `--service-account`
Read on the TLS private key	Certificate store	Administrator
Write on the account temp folder	Account temp folder	Usually already present

To print the required permissions for the installed instance, run the following command:

SpDisconAppSvc.exe --required-permissions

Caution

--service-account records the account. It does not grant Log on as a service. Missing that right causes Windows error 1069.

Caution

Do not install the SailPoint Disconnected Application Agent under C:\Users\<name>\. Use a system path such as C:\SailPoint\SpDisconAppSvc. Do not give the service account write access to the install folder.

Downloading Agent

Note

You are only entitled to download components for which you have an active license with SailPoint. The availability of a component for download does not grant you a license to use a component or entitle you to use a component for which you do not have an active license. Contact your SailPoint Account Representative or Customer Success Manager (CSM) for more information.

Go to Agent Settings and select Download Agent.
Unzip the downloaded SpDisconAppSvc-<version>.zip archive to a system location. For example, C:\SailPoint\SpDisconAppSvc.
Open the DLL properties and confirm that the files are trusted. Unblock the files if needed.

Installing Agent

Complete the following steps from an elevated Command Prompt. After you start the service, the SailPoint Disconnected Application Agent runs as the service account.

The SailPoint Disconnected Application Agent does not include a browser. Before automation can run, install the browser runtime (Node.js, Playwright, and Chromium) on the host. You do not download these components by hand. One SailPoint Disconnected Application Agent command installs them.

Create the dedicated service account as a standard user whose only group membership is Users.
Install the browser runtime. This step requires internet access, or use --offline <DIR> for a host without internet access:
```
SpDisconAppSvc.exe --rpa-init
```
Install the Windows service:
```
SpDisconAppSvc.exe -i
```
Set the service account. You are prompted for the password:
```
SpDisconAppSvc.exe --service-account .\svc-rpa-agent
```
Grant Log on as a service, registry Full Control, and Read on the certificate private key.
Register the SailPoint caller. At least one caller is required, or the service does not start:
```
SpDisconAppSvc.exe -a DOMAIN\user
```

Verify the configuration, and then start the service:

SpDisconAppSvc.exe --show-config

SpDisconAppSvc.exe -s

--show-config prints Ready to start. or lists what is still missing. Starting the service is the real test. Failures go to the trace file and the Windows event log.

--rpa-init must complete before automation can run. Use --rpa-update later to switch only if the self-test passes. Use --rollback to return to the previous stack.

Useful Commands

Command	Purpose
`SpDisconAppSvc.exe -i` / `-u`	Install or uninstall
`SpDisconAppSvc.exe -s` / `-k` / `-t`	Start, stop, or restart
`SpDisconAppSvc.exe -p <port>`	TLS listen port. A restart is required.
`SpDisconAppSvc.exe -a DOMAIN\user`	Register a caller
`SpDisconAppSvc.exe --rpa-init`	Install Node.js, Playwright, and Chromium
`SpDisconAppSvc.exe --offline <DIR>`	Offline runtime install
`SpDisconAppSvc.exe --show-config`	Configuration and readiness
`SpDisconAppSvc.exe -h`	Help. Use this command if the available options differ.

Troubleshooting

Symptom	Resolution
Error 1069, logon failure	Grant Log on as a service, or correct the password.
Access is denied. The trace file is empty.	Reinstall outside `C:\Users\`.
Start times out after about 30 seconds. The trace file is empty.	The service account cannot write the registry key. Check Event Viewer. This is common after a reinstall.
TLS error mentions the certificate	Grant Read on the private key.
No certificate found, but it is in the store	Place the self-signed certificate in Trusted Root Certification Authorities.
Provisioning or automation error	Run `--rpa-init` to completion.
Name or port already in use on reinstall	Close Services and Event Viewer, and then retry.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.