Chat now with support
Chat with Support

We will be performing website maintenance Friday, March 6, 2026 from 3PM-5PM PST. Some brief down time may occur at this time.

On Demand Global Settings Current - User Guide

Working with On Demand Global Settings Overview of On Demand Global Settings Signing up for On Demand Global Settings Managing organizations and regions Adding users and groups to an organization Managing your Microsoft Entra tenants and on-premises domains On Demand Home page Configuring settings Documentation roadmap Technical Support

Agent service account configuration

When specifying a service account, the following options are supported:

•
Group Managed Service Account (gMSA) and Standalone Managed Service Account (sMSA) types. When this account type is used, a password will not be requested. Specify the account using domain\account$ format.
•
Local System account. When this account type is used, a password will not be requested.Specify the account using one of the following formats:
•
.\LocalSystem
•
LocalSystem
•
NT Authority\Local System
•
Local user accounts. When this account type is used, specify the account using one of the following formats:
•
.\Username
•
Username
•
computername\Username

Consult your module documentation for any additional pre-requisites.

Secure LDAP configuration and deployment

When selecting to use Secure LDAP, ensure that you adhere to the following guidelines:

•
A valid certificate must be provisioned.
•
A public-key certificate for the domain controller is required on the host of each Hybrid Agent that makes Active Directory requests to a domain controller.
•
Secure LDAP settings are global. Once enabled, domain controllers from all domains known to Actions assigned to the Hybrid Agent which support Secure LDAP must be configured to support this method. Domains which do not support Secure LDAP will not be searchable by assigned Actions which respect the Hybrid Agent Secure LDAP configuration setting.
•
Actions assigned to the Hybrid Agent may or may not support Secure LDAP or may require additional configuration from the corresponding On Demand module. Consult your module documentation for more information.

Installing the agent using the command shell

If you open a command shell, you must open it with elevated permissions (such as “Run as administrator”). The setup program requires admin rights.

You can provide the parameters for agent installation through command line switches. This method allows the agent to be installed without any prompts. The supported switches are as follows:

--outdir <output_directory>

Provides the target directory where the agent files will be extracted. This is the only switch that is handled directly by the self-extracting executable. All other switches are forwarded to the agent setup program that is executed after the files are extracted.

--quiet

Prevents prompting. When you use this switch, you must also specify all parameters that do not have default values through the command line. If any parameters are missing, the installation will fail.

--name <name>

The name used to identify the agent. The agent name is displayed in the On Demand Agent configuration page once the agent installation is completed. If no name is provided, the NETBIOS name of the computer is used as a default value.

--user <username>

The account under which the agent service is run. This is a required parameter. The account specified must have local administrator rights on the computer where the agent is being installed.
Additional permissions depend on the workload being performed by the agent. Refer to the documentation for the specific On Demand module for more information.
The account is granted Log On As Service rights on the local system during installation.

--password <password>

The password of the account under which the agent service is run. This password is not stored anywhere within On Demand. The password is only used to configure the startup properties of the Windows service.

--passphrase “<passphrase>”

The generated passphrase that was created on the How to Add an Agent page. The passphrase is required to install the agent. Since the passphrase will contain spaces, you must use quotation marks to enclose the passphrase.

--enableldaps

Enables TLS/SSL encryption on LDAP connections.

Configuring an agent

After you have installed the agent, you must assign the actions it can perform. Some actions require on-premises domains be specified in the Connected Domains section.

To configure an agent
1
Click Tenants in the left navigation bar and select Hybrid Agents.
A tile for the newly installed agent is displayed. The text under the headings for Domains and Agents shows Not Configured.
2
Click Edit Configuration.
3
In the Actions section, view the list of actions and select the actions that the agent is allowed to perform.
Consult your On Demand module documentation for Actions you might need to enable and other Action related requirements.
4
In the Connected Domains section, do one of the following steps:
•
Click Add New and add an on-premises domain to On Demand that will be connected to this agent. For information about adding a domain, see Adding an Active Directory domain .
- OR -
•
Click Select Existing and select a domain that has already been added to On Demand.
5
Click Save.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating