How to install and set up the 365TUNE Hybrid Agent

This guide takes you from the Download button in the portal to a registered, connected agent. On a prepared server it takes about 20 minutes. The screens below are illustrations of installer 1.0.11 on a server that passes every check; the names and values on them are examples.

Before you start

Have these ready, so that the installer's checks pass first time:

• A Windows server joined to your Active Directory domain. Use a member server in production; a domain controller is suitable for a lab only.
• A domain account to sign in to Windows on that server. If it is not a Domain Admin, have a separate Active Directory administrator account ready. It is used for this registration only.
• Outbound HTTPS from the server to login.microsoftonline.com, app.365tune.com and your tenant's Service Bus namespace. If a proxy inspects TLS, the server must trust the proxy's certificate.
• A 365TUNE account invited to your tenant with a role that allows agent registration, signing in from your own directory. A managed service provider's own account or a guest account is refused.
• In the portal, under Settings, Hybrid Agent, at least one authorised organisational unit and the attributes the agent may change. Registration stops if no unit is selected.
• A Key Distribution Service root key in the forest. A new key is usable ten hours after a Domain Admin runs Add-KdsRootKey. The installer checks everything else for you.

Step 1: download the installer from the portal

In the 365TUNE portal open Settings, then Hybrid Agent, and choose Download. Save 365TuneHybridAgentSetup.exe and copy it to the server. While you are on this page, select the organisational units the agent may work in and the attributes it may change.

Step 2: run the installer and pass the server checks

Sign in to Windows on the server with a domain account and run the installer. The setup window checks the server as soon as it opens: domain account, domain membership, a writable domain controller, the clock, the Key Distribution Service root key, the Active Directory PowerShell module, the embedded browser runtime, the two sign-in and registration destinations, and the .NET 8 runtime. Each check appears while it runs and disappears when it passes. When every check passes, the window says the server is ready to install.

If a check does not pass, the window keeps it on screen with a one-line explanation. A failed check shows a filled circle with an exclamation mark and blocks the install until you fix the cause and choose Check again; a warning shows a violet dot and only tells you what registration will need. If the .NET 8 runtime is missing, the installer offers Install now; the runtime is included in the package and nothing is downloaded. The Read more link beside any check opens the troubleshooting page at the right place.

Step 3: install

Choose Install. The installer puts the runtime, if it was missing, and the agent service in place. Nothing contacts 365TUNE during this step.

When the files are in place the installer runs the server checks once more and opens the Connect step. If you choose Skip there, the installer finishes without registering; open 365TUNE Hybrid Agent from the Start menu later to register.

Step 4: connect, choose the domain

The Connect step detects your Active Directory domain. If the server sits in a child or trusted domain, pick the domain you want the agent registered in, or type its DNS name. Then choose Sign in with 365TUNE. If your Windows session is not a Domain Admin, two more fields appear here for a separate Active Directory administrator account, entered as DOMAIN\user with its password. That account is used for this registration only; it travels to the registration tool over a local protected channel and is never written to a log or a command line.

Step 5: sign in with your Microsoft Work ID

Microsoft's own sign-in page opens inside the installer. Sign in with the work account you use on the 365TUNE portal and complete your organisation's multi-factor prompt. 365TUNE never sees your password. After the sign-in completes, Windows asks you to approve the elevation prompt for the registration tool. Accept it; registration cannot continue without it.

Step 6: registration runs

The Configuring step lists each stage as it completes, under the account you signed in with:

1. 365TUNE tenant names the tenant your account may register an agent for.
2. Directory matches confirms that this forest belongs to that tenant, and names the signal that matched.
3. RSA 4096-bit key pair generated, Registered with 365TUNE cloud, Certificate installed and agent.json written and secured create the agent's identity. The private key never leaves the server.
4. Nine service account steps create the group managed service account, install it on the server, grant it only what the agent needs, grant Log on as a service and apply the delegation on your authorised organisational units.
5. The Windows service starts as the service account.

If a stage fails, the installer shows one sentence saying why, with a Read more link to the troubleshooting page and a button that copies the full message for support. Back returns to the Connect step with your account kept, Switch account signs in with a different account, and Finish without registering keeps the installed files so you can register later. A failure before the key is generated leaves no key, certificate or service account behind.

Step 7: connected

The service sends its first heartbeat within a minute and the installer shows Connected to 365TUNE with the agent id, tenant, domain, service state, last heartbeat and certificate expiry. Choose Close.

Open 365TUNE Hybrid Agent from the Start menu at any time to see this screen with the live status. If it says Registered with 365TUNE, not connected, the line under it tells you why: the service is stopped, the first heartbeat has not completed yet, or the latest heartbeat failed.

After setup

• Check the portal. Under Settings, Hybrid Agent, the server is listed with its last heartbeat.
• Change the scope later. Select different organisational units or attributes in the portal, then run the permissions sync on the server so the Active Directory delegation matches. The agent's own checks follow the portal at the next refresh.
• Register again. On the Connected screen choose Register again. This replaces the agent's certificate and configuration; use it after a change of tenant or when support asks.
• Remove the agent. Revoke the agent in the portal first, then run the installer again and choose Uninstall. The service and files are removed; the service account and its delegation are removed with the documented clean-up steps.
• Logs. The setup log is at %TEMP%\365TuneSetup.log for the account that ran the installer. The agent writes to Event Viewer under Applications and Services Logs, 365TuneHybridADAgent.