HelloID

Agent can run on any server in your domain that has HTTPS access to HelloID. We recommend, however, that it be run on a server that is not a domain controller. Running Agent on a domain controller can cause various problems. For example, if the Access Management Agent service starts before the necessary Active Directory services, Agent will be unable to reach AD and will shut down. The On-premises Provisioning Agent service may also encounter conflicts with local security policies.

If you must install Agent on a domain controller, you can attempt to work around these limitations by setting the HelloID Directory Agent to restart on failure in the Recovery tab of its Windows service. You will also need to manually identify and evaluate any security policies which may interfere with the on-premises Provisioning Agent service.

The HelloID Agent should be installed using a domain account with Local Administrator privileges:

Once installed, all three On-premises Agent services should also run on a domain account with Local Administrator privileges. Attempting to run the Agent services with a local system account can cause logon problems for end users or failed AD synchronization tasks. Admin privileges are necessary for Agent to auto-update.

The domain account also needs other permissions depending on the operations that you want to perform in your network. Common permission requirements are listed below.

Synchronizing AD users to HelloID

Tasks and other PowerShell scripts

When Agent is used to run a task from the HelloID Task catalog, any required PowerShell modules must be installed on the server running the Agent. Required modules are displayed alongside each task in the task catalog. For example:

For custom PowerShell tasks, PowerShell data sources, and Delegated form PowerShell scripts, you must manually determine & assign the needed permissions.

The server(s) running Agent need to have access to the HelloID platform to ensure working communication for the user synchronization, authentication, and automation tasks. All traffic is initiated by Agent itself using HTTPS port 443. No inbound ports need to be allowed on the firewall. You must also set up a Whitelist domains. The level of encryption is TLS 1.2, AES, with 256-bit encryption.

If it’s not possible to grant the server(s) an internet connection, the IP addresses of the HelloID servers in the Azure platform can be provided. Traffic to these addresses through port 443 has to be allowed in the firewall. However, when using this option, a configuration change has to be made in the HelloID platform. This change will cause the portal not to fail-over to other Azure regions, which can lead to downtime.