SoftwareCentral · Installation Manual

Application Manager Only
Installation & Setup Guide

A single, end-to-end manual for installing and configuring the Application Manager Only edition of SoftwareCentral — from server prerequisites all the way through the in-app Application Manager Setup Guide. Both Azure / Entra (OpenID) and on-premise ConfigMgr environments are covered.

📦 Apps 🤖 Robopack 🌊 Flows 📡 Radar

1 About the Application Manager Only edition

The Application Manager Only edition is a focused, lightweight configuration of SoftwareCentral for teams that only need application and package management. Its interface is streamlined to four work areas and defaults to the dark theme.

What's included

AreaPurpose
📦 AppsCreate and manage applications and packages in ConfigMgr and/or Intune.
🤖 RobopackAutomated, always-up-to-date application packaging via the Robopack service.
🌊 FlowsPatch / update flows that keep applications current automatically.
📡 RadarDetection and discovery view for installed / available software.
⚙️ Setup GuideA guided, in-app checklist (covered in section 7) to finish configuration.

Features that belong to the full product (device management, deployment manager, AD delegation, reporting, the shop, etc.) are intentionally hidden in this edition.

Who this guide is for Administrators installing SoftwareCentral in the Application Manager Only edition. Follow it top-to-bottom. Where a step differs between environments, look for the Azure / Entra and ConfigMgr tags.

2 Installation overview

The complete process, at a glance:

1 · Prerequisites 2 · App registration (Azure) 3 · Run installer 4 · First-time config 5 · Setup Guide 6 · Hostname / HTTPS 7 · Verify & tune
Decide before you start Whether SoftwareCentral connects to ConfigMgr or runs Intune only, and the authentication method (Azure OpenID or Windows Authentication), are chosen in the installer and cannot be changed afterwards — changing them requires a fresh installation against a new database.

3 Prerequisites

Pick the column that matches your environment. Both share the same Windows Server baseline.

Azure / Entra Intune only

  • Windows Server 2019+ with Desktop Experience and internet access.
  • Only SoftwareCentral (and optionally SQL) on the server. TCP 8080 free.
  • SQL Server 2019+ / Express, or Azure SQL (auto-pause disabled).
  • A local service account with local administrative rights.

Accounts you'll sign on with during setup

  • Local administrator on the server.
  • Account able to create a SQL database and add logins/users.
  • Account able to register an Entra ID app, assign permissions and grant admin consent.

An Azure database must be in the same tenant as the app registration created during setup.

ConfigMgr ConfigMgr edition

  • Web server (Windows Server 2019+) for SoftwareCentral and its services.
  • SQL Server / Express 2019+ or Azure SQL; SQL server and DB on the same collation (recommended SQL_Latin1_General_CP1_CI_AS).
  • A local AD or Entra ID administrator group for SoftwareCentral admins.

Service account permissions

  • Read/write/execute on the SoftwareCentral DB (not for Azure SQL).
  • Read/execute on all ConfigMgr site databases.
  • Local admin, Log on as a service, Act as part of the OS, Replace a process level token, Adjust memory quotas.

The account must also read users, groups and memberships from AD. See the ConfigMgr security role in the appendix.

Windows Server minimum requirements

  • Windows Server 2019 or above
  • IIS 10 or above
  • .NET Framework 4.8 or above
  • IIS URL Rewrite Module 2.1+ (download)
  • Dual-core CPU or above
  • 8 GB RAM or above
  • 10 GB free disk or above
  • SQL Server / Express 2019 or above

Required server roles/features (IIS, ASP.NET 3.5/4.8, Windows Authentication when used) are installed automatically by the installer if missing. Firewall ports are listed in the appendix.

📄 Detailed page: Prerequisites · original: Prerequisites

4 Azure App Registration Azure / Entra

For Azure OpenID authentication and Intune connectivity you need an Entra ID app registration. The SoftwareCentral installer can create this automatically — do the manual steps below only if you prefer to prepare it in advance or reuse an existing one.

Shortcut Skip this section if you will let the installer create the app registration (step 5, “Connect to Intune tenant”). ConfigMgr installations using Windows Authentication can skip it entirely.
  1. Azure portal → your Entra ID → App registrationsNew registration.
  2. Give it a name; choose single- or multi-tenant. Do not set a Redirect URI yet. Click Register.
  3. On the overview page, copy the Client ID and Tenant ID — you'll need them in the installer.
  4. Add a platform → Web. Enter the SoftwareCentral host name; set the front-channel logout URL to the same host followed by /logout. Tick ID tokens. Do this for both the localhost and the regular binding.
Entra ID New registration blade with a name entered and account types selected
Entra ID New registration — enter a name and choose the account types, then Register.
App registration overview page with Client ID and Tenant ID
Overview — copy the Client ID and Tenant ID.
Add a platform panel
Click Add a platform.
Web platform configuration with redirect URI, logout URL and ID tokens ticked
Select Web; set the host and /logout URL; tick ID tokens.

Images show the standard installer flow; the Application Manager Only build is identical for these Azure steps.

📄 Detailed page: Azure App Registration · original: Create App Registration for Azure OpenID Authentication

5 Run the installer

Download the installer from SoftwareCentral Update and run it on the web server. Steps may vary slightly with your choices.

Step 5.1 — Requirements check

The first screen validates that the server meets the minimum requirements. Follow any prompts.

Installer welcome and requirements-check screen
The installer validates the server against the minimum requirements.

Step 5.2 — Service account

Enter the service account credentials. For ConfigMgr / hybrid this must be a domain user; for Intune only it can be a local account as servername\username. The account must be a local administrator.

Service-account credentials screen
Enter the service-account credentials (local administrator).

Step 5.3 — Site & database information

Accept the default names and paths where possible. Enter the SoftwareCentral database server (use servername\instance for a named instance, or servername.database.windows.net for Azure SQL).

Site information and database server screen
Site information and the SoftwareCentral database server.

Step 5.4 — Edition, authentication & Intune

  • ConfigMgr support: choose Disable ConfigMgr support for an Intune-only install. Azure / Entra
  • Authentication: Azure OpenID (default; work-account sign-in, MFA, SSO) or Windows Authentication (on-prem AD, domain users only).
  • Multi-tenant support: allow users from multiple Intune tenants (only added tenants can sign on).
  • Use Entra ID: source group memberships from Entra ID instead of on-prem AD.
  • Connect to Intune tenant: creates/updates the app registration automatically — or enter an existing Tenant ID / Client ID. After connecting, grant admin consent using the link shown.
Cannot be changed later The ConfigMgr-support choice is permanent for this database. Connecting to Intune overwrites the authentication SSL certificate only if it is expired; additional connected tenants must be updated manually.
Edition, authentication and Intune connection screen
Edition, authentication method and Connect to Intune tenant.

Step 5.5 — ConfigMgr connection ConfigMgr

For ConfigMgr installs, enter your Configuration Manager (MECM) details and click Check MECM to verify the connection and create the MECM database login. Assign permissions manually if the installer cannot (see the security role XML).

MECM details screen with Check MECM result
Enter the ConfigMgr (MECM) details and use Check MECM to verify.

Step 5.6 — Install

Click Install. For Azure SQL you'll be prompted to sign in with an account that can add logins/users. Errors are highlighted with suggested fixes; details are written to SoftwareCentralInstaller_Log.txt next to the installer.

Restart if prompted Newly installed roles/features or the IIS Rewrite add-on may require a server restart. Accept it (or restart manually) before continuing to configuration.

📄 Detailed page: Run the installer · original: Install SoftwareCentral

6 First-time configuration (from localhost)

The first configuration must run on the server, from the localhost binding — a security measure so remote connections can't change critical settings. In IIS Manager, select the SoftwareCentral site and click Browse *:8080 (https).

Browser Avoid Internet Explorer. If you must use it, disable Enhanced Security on the server first. Some steps appear only when their data isn't already present.
IIS Manager with SoftwareCentral site and Browse 8080 https highlighted
In IIS Manager, select the SoftwareCentral site and click Browse *:8080 (https).

6.1 — Database connection

The database details are pre-filled. Click Test to confirm connectivity, then save and continue.

6.2 — Intune configurator Azure / Entra

If Intune wasn't configured in the installer, this screen appears. Generate a certificate and upload it to the app registration, assign the required permissions, and Test. Then Save Azure configuration.

Give permissions a minute Newly assigned Intune permissions can take a few minutes to take effect. If the test fails, wait and retry. Additional tenants can be added later.

6.3 — Administrator group

Choose the administrator group (you must be a member). With Entra ID you can also create the group here and be added automatically.

On-prem AD only Group membership changes may take time to propagate; restarting the server can help. Configuration resumes where you left off — just browse the local https binding again.

6.4 — SoftwareCentral license

Enter the username/password from your retailer (online), or exchange the shown installation key for an offline license key. An Installation Title helps identify multiple installations. You cannot proceed without a valid license.

Database connection screen
6.1 — Database connection (test, then save).
Intune configurator screen
6.2 — Intune configurator (certificate + permissions).
Administrator group selection screen
6.3 — Administrator group.
SoftwareCentral license screen
6.4 — SoftwareCentral license.

6.5 — Verify settings

After the license step you land on the Settings interface. Mandatory fields are marked * Required in red and must be filled in before you continue — for example the Central Site Code, SCCM Server, SCCM Database Server Name/Name and the Application Base URL (e.g. https://softwarecentral/). Complete them and click Save Settings.

Application Manager Only settings interface with mandatory fields marked Required in red
6.5 — The Settings interface with mandatory fields highlighted * Required.

6.6 — SCCM Folders and Collections ConfigMgr

Once the mandatory settings are saved, go to Settings → SCCM Folders and Collections and set up the default collections and folders. SoftwareCentral uses this structure to find the correct collection to use when it creates, deploys and reads packages and applications.

Configure each root by selecting a node in the tree and saving it:

  • SCCM root collection (devices) and SCCM root user collection
  • Package root folder
  • Application Distribution Devices and Application Distribution Users

Click Create default structure to have SoftwareCentral build its own default structure automatically, or point the roots at your existing structure and use Create collection / Create folder as needed.

Only one install collection under this structure SoftwareCentral resolves the install and uninstall collection from the structure defined here. Your wider SCCM environment may contain more than one install collection in some scenarios, but only one install collection may exist under the SoftwareCentral root structure — otherwise SoftwareCentral cannot determine the correct collection to use. An application that has no collection, or several install collections with none under this structure, must be mended before it will work.
SCCM Folders and Collections page with the root collection tree and Create default structure button
6.6 — SCCM Folders and Collections. Assign the SCCM root collection (and user collection), the package root folder and the application distribution roots, then Save.

For a full explanation of the structure SoftwareCentral expects — and how to use your own — see Default Collection Structure and Custom Collection Structures.

📄 Detailed page: First-time configuration · original: Configure SoftwareCentral for the first time

7 Application Manager Setup Guide (in-app)

After the first-time wizard, the Application Manager Only edition opens its own guided checklist at Settings → Setup Guide. Each card shows a status indicator ( done, attention, action required) with Configure / Re-check actions. Use Re-check all at the top when finished.

Application Manager setup page showing the Intune, Mandatory settings and Robopack cards with status indicators
The Application Manager setup page. The header shows overall progress (2 of 4 complete) and the Re-check all button; each card carries a status dot — here Intune is green (configured, 1 tenant verified) while Mandatory settings is red (9 of 12 configured) with its details panel expanded, including Apply SCCM defaults and Save.

Card 1 — Intune

Connect & enable your Intune tenant(s)

Set the certificate path (.pfx) and password, or Generate self-signed certificate and upload the .cer to the app registration. Use Test settings, then enable tenants. Add or edit tenants inline.

Optional if you run ConfigMgr-only with no Intune targets.

Intune card expanded with certificate fields, test settings and the enabled tenant
The Intune card once configured — certificate path (.pfx) and password, Test settings, Generate self-signed certificate, and the enabled tenant showing Connection succeeded. The green status dot confirms Intune is configured.

Card 2 — Mandatory settings & connection tests

!

Fill required settings and run every connection test

Click Show details / Configure to edit: Central Site Code, SCCM Server, SCCM DB server & name, Administrator Group, Application Pool user/password, one Package Share per site, and Apply SCCM defaults (creates default root collections and “Software Distribution” folders).

Run each test: SCCM Server (WMI), SCCM Database, SoftwareCentral Database, Package Share access, SoftwareCentral Update connection, License, and SoftwareCentral version.

Intune-only installs SCCM-specific fields and tests (WMI, SCCM DB, Package Share, SCCM defaults) don't apply — focus on the SoftwareCentral Database, Update connection, License and version tests.
Mandatory settings card fully configured with all checklist items and connection tests green
The Mandatory settings card once complete — every required setting is ticked and all Connection tests pass (SCCM Server WMI, SCCM Database, SoftwareCentral Database, Package Share access, SoftwareCentral Update connection, License and version). Each test also has its own Test button to re-run it individually.

Card 3 — Robopack

!

Connect the Robopack service

Enter the Robopack API URL and API key, then Test connection. This powers the Robopack and Flows areas for automated packaging and updates.

Robopack card configured with API URL, API key and a successful test connection
The Robopack card once connected — the API URL and API key are set and Test connection confirms a successful connection to the Robopack service. The green status dot shows Robopack is configured.

Card 4 — Templates

Create the templates you'll deploy with

Create at least an Application Template and a Robopack Deployment Template (a default of each is recommended). Intune Application Templates appear when Intune is enabled; Phase Deployment Templates (SCCM / Intune) are optional. Use Create per row or Configure to manage existing ones.

Templates card with all template types in place
The Templates card once populated — Application Template, Intune Application Template, the optional Phase Deployment Templates (SCCM and Intune) and the Robopack Deployment Template, each with a count and a Create action. A default is recommended for the Application and Robopack Deployment templates.
Goal Every card should show a green status and the progress summary should read complete after Re-check all. At that point the Application Manager Only edition is fully configured.

8 Hostname & HTTPS (remote access)

Give users a friendly, secure URL by adding an HTTPS binding for your host name.

  1. Configure the host name in DNS.
  2. In IIS Manager, add an https binding for the host name with a certificate your clients trust.
  3. Optionally add a port-80 binding for the same host name — a rewrite rule redirects users to https.
  4. Azure / Entra In the app registration, add the new host name to the Redirect URIs, and add the front-channel logout URL (https://yourhost/logout) for single sign-out.
IIS Add Site Binding dialog with https and certificate
IIS Add Site Binding — https + trusted certificate.
App registration Redirect URIs with the new host name
App registration Redirect URIs — add the new host name.
App registration front-channel logout URL
Front-channel logout URL (/logout) for single sign-out.

📄 Detailed page: Hostname & HTTPS · original: Configure HTTPS

9 Verify & performance

9.1 — SoftwareCentral service

A Windows service handles long-running tasks and schedules, installed automatically. Confirm it under Settings → Service Manager. If it isn't running, the Log explains why and how to fix it.

9.2 — Performance tuning (optional)

Trade-off These settings noticeably increase memory usage.
  • Application pool → Start Mode = AlwaysRunning, Idle Time-out (minutes) = 0.
  • Site → Advanced SettingsPreload Enabled = True.
Service Manager showing the running SoftwareCentral service
Service Manager — confirm the service is running.
Application pool advanced settings with AlwaysRunning and Idle Time-out 0
App pool — AlwaysRunning and Idle Time-out = 0.
Site advanced settings with Preload Enabled set to True
Site — Preload Enabled = True.
Done 🎉 The Application Manager Only edition is installed and configured. Finish any remaining items in the in-app Application Manager Setup Guide.

10 Appendix & references

Firewall ports (ConfigMgr / hybrid)

PortPurpose
443 / 80HTTPS / HTTP to the site
1433Database connections
135 (+ range)WMI calls
2701 / 2702Remote Control Tool (ConfigMgr)
389 / 636LDAP / LDAPS
445Read log files on clients
137–139Network discovery (UDP/TCP)

ConfigMgr security role ConfigMgr

Import this XML in the ConfigMgr console → Administration → Security → Security Roles → Import to grant the service account the exact permissions SoftwareCentral needs.

Show SoftwareCentral ConfigMgr security role XML
<SMS_Roles>
  <SMS_Role CopiedFromID="SMS0009R" RoleName="SoftwareCentral" RoleDescription="">
    <Operations>
      <Operation GrantedOperations="1890811559" ObjectTypeID="1" />
      <Operation GrantedOperations="805446663" ObjectTypeID="2" />
      <Operation GrantedOperations="524289" ObjectTypeID="6" />
      <Operation GrantedOperations="140295" ObjectTypeID="7" />
      <Operation GrantedOperations="537011207" ObjectTypeID="9" />
      <Operation GrantedOperations="1031" ObjectTypeID="11" />
      <Operation GrantedOperations="813835269" ObjectTypeID="17" />
      <Operation GrantedOperations="140295" ObjectTypeID="19" />
      <Operation GrantedOperations="537011207" ObjectTypeID="20" />
      <Operation GrantedOperations="805448711" ObjectTypeID="31" />
      <Operation GrantedOperations="536871943" ObjectTypeID="33" />
      <Operation GrantedOperations="9" ObjectTypeID="42" />
      <Operation GrantedOperations="9" ObjectTypeID="43" />
      <Operation GrantedOperations="1031" ObjectTypeID="219" />
      <Operation GrantedOperations="142359" ObjectTypeID="224" />
      <Operation GrantedOperations="1031" ObjectTypeID="226" />
    </Operations>
  </SMS_Role>
</SMS_Roles>

Detailed guide pages

Other topics & original pages