1 Overview
When you configure SoftwareCentral for the first time, you must do it from the localhost site. This is a security measure to ensure that remote connections cannot change any critical settings for SoftwareCentral.
Go to the Microsoft Internet Information Services (IIS) Manager. Locate the SoftwareCentral site and click on Browse *:8080 (https). SoftwareCentral only opens its configuration pages for requests that come from the server itself. If something is still missing and you open SoftwareCentral from another computer, you get an error asking you to go to the site on a local binding from the server hosting it.
SoftwareCentral will now launch in your browser. Depending on your type of authentication, you may be prompted to sign on.
If you are using Azure OpenID, you may be prompted to accept sign in on behalf of your organization. Accept that.
Which steps you see depends on how you installed SoftwareCentral:
| Step | When you see it |
|---|---|
| Database connection | Only if SoftwareCentral cannot connect to its database with the values saved by the installer. |
| Intune configurator | If Azure OpenID sign-on is used and no Intune tenant has been connected yet (for example because you did not connect to Intune in the installer), or if the database is an Azure SQL database that cannot be reached yet. |
| Administrator group | The first time someone signs on and no administrator group has been chosen. |
| SoftwareCentral license | Until a valid licence has been entered. |
| Verify settings | Always. The required fields depend on the edition (Intune only or ConfigMgr). |
2 Database connection
The first screen you will see is the database connection screen. It will already have your database information.
Test the connection to verify that the SoftwareCentral web site can connect to the database.
Once successful, save the configuration and proceed to the next step.
The screen is titled Configure SoftwareCentral Connection and has these fields:
| Field or button | What it does |
|---|---|
| SoftwareCentral Database Server Name | The SQL server. If the database runs in a named instance, enter servername\instancename. For an Azure database, use the full server name (servername.database.windows.net). |
| SoftwareCentral Database Name | The name of the database. Do not put the instance name here; it belongs in the server name field. |
| Ignore certificate trust issues | Tick this only if the SQL server uses a certificate that the web server does not trust. Prefer to install a trusted certificate on the SQL server instead. |
| Save / Test Connection | Save the values, or test them first. SoftwareCentral connects with the identity of the service account (a trusted connection). |
If you use an Azure database and the connection fails, make sure that you have generated a certificate and uploaded it to the app registration in Azure (see the next step). The same app registration is used for the sign-in to the database.
3 Intune configurator
If you have chosen the Intune only option, but did not configure the Intune settings during the installation, you will now come to the Intune configurator. If you do not see this screen, you may proceed to the next step in this guide.
Generate a new certificate and upload the certificate to the Azure app registration. Follow the description and links in the interface.
Assign the required permissions to the app registration and test the connection.
Once successful, click "Save Azure configuration" and proceed to the next step.
The page Intune Configurator lists five numbered steps. Work through them from the top:
| Step | What to do |
|---|---|
| 1. Acquire a SSL certificate | Click Generate self-signed certificate. Enter a strong password for the certificate and click Download new certificate. Save the .cer file on your computer; you need it in step 2. Save the password too, because you need it if you move the certificate to another server. |
| 2. Upload certifcate to Azure | The page shows the Client ID of your app registration and a link to the Azure portal. In the app registration, open Certificates & secrets and upload the .cer file. |
| 3. Assign API permissions | Give the app registration the permissions listed in Intune Permissions. If you do not want to grant all of them, the page lists the application permissions User.Read.All, Group.Read.All and GroupMember.Read.All as the permissions to give instead. Then grant admin consent. |
| 4. Test connection | Click Test connection. A green message means the connection works; a red message tells you what failed. |
| 5. Save Azure configuration | The button is enabled once the test has succeeded. Click it to save the configuration. |
Good to know about the certificate:
- SoftwareCentral stores the certificate, with its private key, in the Local Computer › Personal certificate store of the web server and remembers it by its thumbprint. It is the preferred way for the app registration to sign in.
- The generated certificate is valid for two years. An expired certificate is not used, so generate and upload a new one before it expires.
- If the log reports that the certificate has no private key that SoftwareCentral can read, import the certificate again from its .pfx file, or give the account the application pool runs as read access to the private key (open
certlm.msc, right-click the certificate, All Tasks › Manage Private Keys). - The page only opens from the server itself. If an Intune tenant is already configured, it sends you to the Intune configuration under Settings instead.
4 Administrator group
Next you must choose an administrator group. You must be a member of this group. If you are using Entra ID, you will also see an option to create an administrator group. You will automatically be added to the administrator group when it is created in SoftwareCentral.
Select the group and click "Save".
What you see depends on where your group memberships come from:
| Your setup | What to do |
|---|---|
| On-premises Active Directory | Select the domain and the group in the lists, and click Save. |
| Entra ID, existing group | Pick the group in the list Select an existing group... and click Choose group. |
| Entra ID, new group | Type a name in Enter a name for the group... and click Create group. The name can be up to 120 characters and must not already be in use. SoftwareCentral creates the group in the tenant and adds you to it. |
You must be a member of the group you choose. If you are not, SoftwareCentral shows an error and does not save the group. If you are not a member of any group that has access, the page says so.
The chosen group is saved as the Administrator Group setting (an AD group as DOMAIN\GroupName, or the ID of the Entra ID group). Members of this group sign on as SoftwareCentral Administrators. Other roles are created later with Security Roles.
5 SoftwareCentral license
In this step, you must enter the license for SoftwareCentral. If your installation has access to the internet, you must enter the user name and password provided by your retailer.
The "Installation Title" is used to identify your installations, if you have multiple installations of SoftwareCentral.
If your installation is offline, you will see an installation key. You must send this key to your retailer, that will then return your offline license key.
You cannot proceed without a valid license.
| Field | What to enter |
|---|---|
| Installation Title | A name that tells your installations apart. |
| Username and Password | The credentials from your retailer (online installations). |
| Installation key and License Key | Shown if the installation is offline. Send the key to your retailer and enter the licence key you get back. With several installations, send the key from each of them. |
| Submit | Submits the licence information and restarts the web site. |
For an online installation, the web server must be able to reach the SoftwareCentral update service (softwarecentralupdate.com) over HTTPS. This lets SoftwareCentral get licence information, information about new versions and health checks automatically, and it is strongly recommended. If the server cannot go online for security reasons, use an offline licence key. Only members of the administrator group can enter licence information.
6 Verify settings
You will now be redirected to the SoftwareCentral main interface and configuration menu. Note that the interface and available / required fields will vary depending on your configuration.
If any required settings are missing, you will see them highlighted with a red text.
For a ConfigMgr environment, you will need to enter some server details like reporting server, package share(s) etc. The required settings will be highlighted in the interface.
Intune only installations should only have to fill in the following setting:
Application Base URL - The standard base URL to SoftwareCentral. This could for instance be https://softwarecentral/
When the settings are saved, use the Test connections button on the settings page. It measures every connection SoftwareCentral uses, including how a proxy affects Microsoft Graph, and compares the result with earlier runs. The test uses the saved settings, so save first. You can download the current run or every stored run as a CSV file. Run it again after every change to a connection, a permission or a certificate.
7 SoftwareCentral Service
SoftwareCentral uses a Windows service to process long running tasks and schedules. This service is automatically installed during the configuration of SoftwareCentral.
To verify that it is installed, go to "Settings -> Service Manager". The service is named SoftwareCentral in the Windows services list.
Confirm that the service is running. If it is not running, go to the Log in SoftwareCentral. There will be one or more error messages stating why the service is not running and information on how to resolve the issues.
8 Additional Intune permissions
Some Intune features requires a service account. This includes reading BitLocker keys and resetting user passwords. For a complete list, see the Intune Permissions section.
You can add the service account in SoftwareCentral under Settings/Configuration -> Intune Configuration -> Manage Intune Tenants
That window is also where you add a second tenant or change an existing one. Pick a tenant in Select Intune tenant to edit it, or click Add new tenant. Fill in the fields for the tenant, and click Save changes before you select another tenant or close the window:
| Field | What it does |
|---|---|
| Tenant enabled (Enable tenant) | A disabled tenant gives users no access to its resources. Data already stored is not removed. Only users from enabled tenants can sign on when multi-tenant support is used. |
| Tenant friendly name | The name users see when they switch between tenants. |
| Tenant ID and Client ID | The IDs of the tenant and of its app registration. |
| Client Secret (optional) | A client secret for the app registration. If a secret is entered, it is used instead of the certificate. The certificate is the recommended way to sign in, so leave this empty when the certificate is uploaded to the app registration. |
| Administrative unit (optional) | The ID of an administrative unit to create all groups for the tenant inside. Entering an ID turns the feature on. It requires the permission AdministrativeUnit.Read.All and the role Groups Administrator or User Administrator on the administrative unit. |
| Service account username and Service account password | The service account for data that is not available to an application. Only enter a password if you want to change the existing one. |
| Test connection | Tests the tenant. If you have just changed permissions, wait a few minutes and test again. |
| Update permissions | Adds the permissions SoftwareCentral needs to the app registration. This only works if the app registration has the application permission Application.ReadWrite.All. If permissions were added, you must still grant admin consent in the Azure portal. |
| Remove tenant | Not available. A tenant cannot be removed from SoftwareCentral. |
Every extra tenant needs its own app registration, with the certificate uploaded and the permissions assigned. The installer only updates the certificate of the tenant it connected to. See Intune Configuration for the complete guide.
9 E-mail settings
SoftwareCentral will send out mails to notify users about various things, such as order confirmations and orders pending approval.
To send out mails, you must configure the mail settings in SoftwareCentral.
This is also done from the Configuration page.
In the left menu, go to "SoftwareCentral -> Mail".
By default, SoftwareCentral will send mails via Microsoft Graph (Intune). With the default configuration, you must add a service account for the Intune tenant (see the step above).
Note that the service account must have an active mail box.
You can also configure your own SMTP server. The other mail options are covered in the Settings section of the manual.
You can test the mail settings using the "Send test mail" button.
10 Improve performance
SoftwareCentral is installed with some default values on IIS server.
You can improve the performance (loading speed) of SoftwareCentral with the following advanced settings.
On the application pool, change the start mode to "AlwaysRunning".
Set Idle Time-out (minutes) to "0".
You may additionally extend or disable the application pool recycling, although this is not recommended.
On the site, under "Advanced Settings", change "Preload Enabled" to "True":
11 Add a hostname
Now the basic configuration of SoftwareCentral is complete, you can set up remote access to SoftwareCentral, so users can access SoftwareCentral from their own browsers.
Follow the instructions here Set up hostname to setup a hostname with a SSL certificate.
12 Installation and configuration complete
You are now ready to use SoftwareCentral.
You can read the Getting Started manual to help you get started with SoftwareCentral.
13 Best practice
- Use the certificate for the Entra ID app registration instead of a client secret, and keep a protected backup of the certificate (.pfx) and its password. Note the expiry date (two years after it was generated) and replace it in good time.
- Choose a dedicated administrator group, with only the people who administer SoftwareCentral as members.
- Set up HTTPS and a host name before you tell users about SoftwareCentral (see Configure HTTPS).
- Run Test connections after each change to the database, a tenant, a permission or the proxy settings.
- If you use an Azure SQL database, keep auto-pause disabled, as required in Prerequisites.
- Give the Intune service account only the roles it needs (see Intune Permissions); do not use a Global administrator in production.
- Back up the SoftwareCentral database regularly, and before every update.