Skip to main content




The on-premises HelloID Agent comprises three Windows services that you install & run on a server within your organization's network. These services communicate with your HelloID tenant via HTTPS. This lets HelloID execute actions & PowerShell code in your network.

For example:

  • Executing Tasks and other PowerShell scripts on-premises, in order to manage folders, groups, users, or other IT resources

  • Synchronizing users into HelloID from an on-premises Active Directory configuration (see AD sync)

  • Authenticating users into HelloID when using the AD Agent IdP

  • Reading & writing data in on-premises source & target systems in Provisioning

To get started, Add an Agent Pool and then Install an on-premises Agent.


It is possible to install multiple on-premises Agent instances. This is particularly useful in large enterprise environments. If you do install multiple instances, they are coordinated by Agent pools.

On-premises Agent services

The three on-premises Agent services correspond to the three HelloID modules:


On-premises Agent updates

With every new version of HelloID, there is a new version of Agent. Agent auto-updates itself whenever it communicates with your HelloID portal and detects a version difference. This normally occurs immediately after each HelloID release. Under normal circumstances, no action is required on your part to update Agent. However, if the auto-update process fails, you will need to manually uninstall the services and re-install them from scratch.

Cloud Agent

HelloID Service Automation and HelloID Provisioning can run certain actions using a Cloud Agent instead of an on-premises Agent.

The Cloud SA Agent and Cloud Provisioning Agent are particularly useful if your organization is 100% cloud-based and does not have an on-premises Windows network.


Unlike HelloID Service Automation and HelloID Provisioning, HelloID Access Management does not have a cloud Agent. It only has an on-premises Agent.