Prerequisites – Application Manager Only

1 Choose your environment

The Application Manager Only edition can run against Intune (via Azure / Entra) or against an on-premise ConfigMgr site. The requirements differ slightly.

Azure / Entra Intune only

A server with Windows Server 2019 or above, with Desktop Experience and internet access.
- Only SoftwareCentral, and optionally a SQL server, should be installed on the server.
- TCP port 8080 must be free for SoftwareCentral.
Microsoft SQL Server 2019 or later, Express, or an Azure SQL database. Azure databases must have auto-pause disabled.
A local service account with local administrative permissions.

If you use an Azure database, it must be on the same tenant as the app registration created during setup.

ConfigMgr ConfigMgr edition

A web server (Windows Server 2019 or above) to install SoftwareCentral and its associated services on.
A Microsoft SQL database (SQL Server 2019, SQL Express 2019 or above, or Azure SQL).
The SQL server and database must use the same collation.
- Recommended collation: SQL_Latin1_General_CP1_CI_AS
- Azure databases must have auto-pause disabled.
A local Active Directory or Entra ID group to manage administrative users for SoftwareCentral.

2 Accounts

Accounts you sign on with during setup

You are prompted for these accounts while the installer runs.

A local user account with local administrative permissions on the server.
An account with permissions to create a SQL database and add logins and users to the database server.
Azure / Entra An account that can register an app with Microsoft Entra ID, assign the app registration the required permissions, and grant administrative consent on behalf of the organization.

ConfigMgr Service account permissions

The SoftwareCentral service account requires the following permissions:

Read, write and execute permissions on the SoftwareCentral database. (This does not apply to Azure databases.)
Read and execute permissions on all ConfigMgr site databases.
Local administrative rights on the web server.
Log on as a service.
Act as part of the operating system.
Replace a process level token.
Adjust memory quotas for a process.

Installing account The account that signs on to the web server to install SoftwareCentral needs local administrative rights and administrative access to the SoftwareCentral database. If it cannot create a database and login, create an empty database manually (collation SQL_Latin1_General_CP1_CI_AS) with a login for the service account that has read, write and execute permissions. If the account can reach the ConfigMgr database, the installer can create the required login and assign read/execute permissions automatically; otherwise assign them manually. For an on-premise Active Directory, the service account must also be able to read users, groups and their memberships — see Active Directory delegation of privilege.

3 Windows Server requirements

Windows Server 2019 or above
Internet Information Services (IIS) 10 or above
Microsoft .NET Framework 4.8 or above
IIS URL Rewrite Module 2.1 or above (download)
Dual-core processor or above
8 GB of memory or above
10 GB of free disk space or above
Microsoft SQL Server / Express 2019 or above

Hardware requirements grow with the number of simultaneous users. SoftwareCentral supports load balancing and SQL clusters if needed.

Required server roles and features

These are installed automatically during setup if they are not already present:

Web Server (IIS) → Common HTTP Features → Static Content
Web Server (IIS) → Application Development → ASP, ASP.NET 3.5, ASP.NET 4.8
Web Server (IIS) → Security → Windows Authentication (only if you intend to use Windows Authentication)
.NET Framework 4.8 Features → .NET Framework 4.8, ASP.NET 4.8
.NET Framework 3.5 Features → .NET Framework 3.5

4 ConfigMgr Firewall ports

Open these ports for ConfigMgr and hybrid environments:

Port	Purpose
443	HTTPS connections to the site
80	HTTP connection to the site
1433	Database connections
135 (+ range)	WMI calls (plus the dynamic range defined in your environment)
2701 / 2702	Remote Control Tool on ConfigMgr
389 / 636	LDAP / LDAPS
445	Read log files on clients
137 UDP/TCP	Network discovery
138 UDP	Network discovery
139 TCP	Network discovery

5 ConfigMgr ConfigMgr permissions

SoftwareCentral connects to ConfigMgr with the service account (you can add more service accounts after installation). The account needs the permissions below. The quickest way to grant them is to import the security role XML.

In the ConfigMgr console, go to Administration → Security → Security Roles and select Import in the upper-left corner. Save the XML below as an .xml file, then import it.

Show SoftwareCentral ConfigMgr security role XML

<SMS_Roles>
  <SMS_Role CopiedFromID="SMS0009R" RoleName="SoftwareCentral" RoleDescription="">
    <Operations>
      <Operation GrantedOperations="1890811559" ObjectTypeID="1" />
      <Operation GrantedOperations="805446663" ObjectTypeID="2" />
      <Operation GrantedOperations="524289" ObjectTypeID="6" />
      <Operation GrantedOperations="140295" ObjectTypeID="7" />
      <Operation GrantedOperations="537011207" ObjectTypeID="9" />
      <Operation GrantedOperations="1031" ObjectTypeID="11" />
      <Operation GrantedOperations="813835269" ObjectTypeID="17" />
      <Operation GrantedOperations="140295" ObjectTypeID="19" />
      <Operation GrantedOperations="537011207" ObjectTypeID="20" />
      <Operation GrantedOperations="805448711" ObjectTypeID="31" />
      <Operation GrantedOperations="536871943" ObjectTypeID="33" />
      <Operation GrantedOperations="9" ObjectTypeID="42" />
      <Operation GrantedOperations="9" ObjectTypeID="43" />
      <Operation GrantedOperations="1031" ObjectTypeID="219" />
      <Operation GrantedOperations="142359" ObjectTypeID="224" />
      <Operation GrantedOperations="1031" ObjectTypeID="226" />
    </Operations>
  </SMS_Role>
</SMS_Roles>

Show the full permission list per object

Object	Operations
Application	Read; Modify; Delete; Create; Approve; Move Object; Modify Folder; Run Report; Modify Report
Application Group	Read; Modify; Delete; Set Security Scope; Create; Approve; Move Object; Modify Folder
Boot Image Package	Read; Modify; Delete; Create; Move Object; Modify Folder
Collection	Read; Modify; Delete; Remote Control; Modify Resource; Delete Resource; Create; View Collected File; Read Resource; Move Object; Deploy Packages; Deploy Client Settings; Modify Folder; Deploy Applications; Modify Collection Setting; Deploy Task Sequences; Run Script; Notify Resource; Modify Client Status Alert
Computer Association	Read; Delete; Create; Move Object; Modify Folder; Recover User State; Run Report; Modify Report
Configuration Item	Read; Modify; Delete; Create
Distribution Point	Read; Copy to Distribution Point
Distribution Point Group	Read; Copy to Distribution Point
Folder Class	Read; Modify; Delete; Create
Package	Read; Modify; Delete; Create; Move Object; Modify Folder; Run Report; Modify Report
Phased Deployments	Read; Modify; Delete; Create
Query	Read; Modify; Delete; Create; Move Object; Modify Folder
Site	Read; Import Computers
SMS Scripts	Read; Modify; Delete; Create; Move Object; Modify Folder; Approve
Software Metering Rule	Read; Modify; Delete; Create; Move Object; Modify Folder; Modify Report
Software Update Group	Read; Modify; Delete; Create; Move Object; Modify Folder
Software Update Package	Read; Modify; Delete; Create; Move Object; Modify Folder
Task Sequence Package	Read; Modify; Delete; Create; Move Object; Modify Folder; Modify Report
User Device Affinities	Read; Modify; Delete; Create; Modify Report

6 Azure / Entra Intune requirements

For the full list of Intune permissions, see Intune Permissions.

You can use Azure OpenID to authenticate users to SoftwareCentral. This requires an application registration in your Entra ID — the installer can create it for you, or you can prepare it in advance. This is covered on the next page: Azure App Registration.