--- title: "Prerequisites for ControlUp for Desktops" slug: "prerequisites-for-controlup-for-desktops" tags: ["ControlUp for Desktops"] updated: 2026-10-28T13:45:19Z published: 2026-10-28T13:45:19Z canonical: "support.controlup.com/prerequisites-for-controlup-for-desktops" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.controlup.com/llms.txt > Use this file to discover all available pages before exploring further. # Prerequisites for ControlUp for Desktops Important Read this article and make sure you meet the networking and AV exclusion prerequisites **before** you deploy ControlUp for Desktops. ## Before you deploy 1. [Find your tenant URL](/docs/prerequisites-for-controlup-for-desktops#your-tenant-url). 2. Meet the [network requirements](/docs/prerequisites-for-controlup-for-desktops#network-requirements), including any firewall, SSL inspection, and proxy settings that apply to your environment. 3. Add the [antivirus exclusions](/docs/prerequisites-for-controlup-for-desktops#antivirus-exclusions). 4. [Verify connectivity](/docs/prerequisites-for-controlup-for-desktops#verify-connectivity) with the ControlUp Tester tool. ## Network requirements ### Your tenant URL Several requirements in this section use your tenant URL, `<tenant-name>.sip.controlup.com`. Your tenant name is unique to your organization, so you need to get it from ControlUp. To find your tenant name, go to **Devices** > **Configuration** > **Agent Registration**. ![The Agent Registration page in ControlUp, showing the tenant name](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AccessAgentRegistrationSettings(6).png) Replace `<tenant-name>` with your tenant name. For example, if your tenant name is `acme-123`, your tenant URL is `acme-123.sip.controlup.com`. ### Managed devices Devices with the ControlUp for Desktops Agent installed must be able to reach these URLs over HTTPS (TCP port 443). Your tenant URL also uses secure WebSocket (WSS) connections. | URL | Required for | | --- | --- | | `<tenant-name>.sip.controlup.com` [Find your tenant name](/docs/prerequisites-for-controlup-for-desktops#your-tenant-url) | **Also requires WSS**. All agent communication with your tenant. Remote Control, Remote Shadow, and Remote Shell use a secure WebSocket (WSS) connection to this URL through your configured proxy. If you use domain-based firewall rules, see [Domain-based firewall rules](/docs/prerequisites-for-controlup-for-desktops#requirement-for-domainbased-firewall-rules). | | `downloads.sip.controlup.com` | Downloading agent versions. | | One URL, depending on your region: **US**: `agentblobeastus.blob.core.windows.net` **EU**: `agentblobwesteurope.blob.core.windows.net` **Canada**: `agentblobcanadacentral.blob.core.windows.net` | Uploading and downloading files with the [file browser](/v1/docs/file-browser), and importing and exporting registry files with the [registry editor](/docs/registry-editor). | #### Add-on products If you're licensed for any of these add-on products, your devices also need access to these URLs over HTTPS (TCP port 443). If you aren't, skip this section. | URL | Required for | | --- | --- | | `cdn.spm.controlup.com/waapi` `cdn.spm.controlup.com/agent` `securedx-cdn.controlup.com` | [ControlUp for Compliance](/docs/secure-dx-overview). | | **Chrome** `edgedx.blob.core.windows.net/artifacts/appdx/latest/appdx_chrome.crx` `downloads.sip.controlup.com/appdx/latest/appdx_chrome.xml` **Edge and Island** `edgedx.blob.core.windows.net/artifacts/appdx/latest/appdx_edge.crx` `downloads.sip.controlup.com/appdx/latest/appdx_edge.xml` | [ControlUp for Apps](/docs/controlup-for-apps-overview), if you deploy the browser extensions from the ControlUp CDN. | | **Chrome and Island** `clients2.google.com/service/update2/crx` **Edge** `edge.microsoft.com/extensionwebstorebase/v1/crx` | [ControlUp for Apps](/docs/controlup-for-apps-overview), if you deploy the browser extensions from the browser web stores. | ### ControlUp console To use ControlUp in your browser, you must have access to these URLs over HTTPS (TCP port 443). Your tenant URL also uses secure WebSocket (WSS) connections. | URL | Required for | | --- | --- | | `<tenant-name>.sip.controlup.com` [Find your tenant name](/docs/prerequisites-for-controlup-for-desktops#your-tenant-url) | **Also requires WSS.** Remote Control, Remote Shadow, and Remote Shell need a secure WebSocket (WSS) connection to this URL. | | `app.controlup.com` | The ControlUp console. | | `google.com/recaptcha` `gstatic.com/recaptcha` | Sign-in (reCAPTCHA). | | `maps.google.com` | Map views in the console. | | `edgedx-functions.azurewebsites.net` | Your first sign-in, when you create your tenant. You don't need this URL after your tenant exists. | | **US**: `prod-dex-login-eastus.controlup.com` **EU**: `prod-dex-login-westeurope.controlup.com` | SAML SSO only. | | `employee-cdn-prod.controlup.com` | The [Employees dashboards](/docs/employees-view-overview). | ### Requirement for domain-based firewall rules Your tenant URL is a CNAME record that points to an Azure domain, which can be a load balancer or your ControlUp tenant directly. If you use domain-based firewall rules, you might also need to allow this intermediary domain. To find it, run `nslookup` on `<tenant-name>.sip.controlup.com`. ![Screenshot showing the nslookup result for a tenant name](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/LoadBalancerURL.png) ### SSL inspection If a proxy or firewall on your network performs SSL inspection, do one of the following: - Install the trusted certificate on every device that has the ControlUp for Desktops Agent. Install it so that it's available to the computer account, not only the user account. - Turn off SSL inspection for your tenant URL `<tenant-name>.sip.controlup.com`. ### Proxy server You can configure the ControlUp for Desktops Agent to use a proxy server during Agent installation. If your proxy is only open when a user account is signed in, and you want to monitor the device when no user account is signed in, configure your proxy to bypass the following URLs: - `<tenant-name>.sip.controlup.com` - `downloads.sip.controlup.com` ### ZScaler VPN If you are using a ZScaler VPN, follow the instructions in [this article](/v1/docs/show-the-real-ip-address-for-devices-using-vpns) to ensure that you can see the real IP addresses of your devices. ## Antivirus exclusions Whitelist the following directories in your antivirus software (including next-gen security products such as Crowdstrike, Carbon Black, etc.): ``` C:\Program Files\Avacee\sip_agent\ C:\ProgramData\Avacee\sip_agent\scripts C:\Program Files\ControlUp\AgentManager C:\ProgramData\ControlUp\EdgeDx\UserSurveys ``` Alternatively, if you are unable to whitelist directories, you can whitelist the following executables: ``` C:\Program Files\Avacee\sip_agent\SIPAgent.exe C:\Program Files\Avacee\sip_agent\RCNotifications.exe C:\Program Files\Avacee\sip_agent\UserPrompt.exe C:\Program Files\Avacee\sip_agent\WinFocusMonitor.exe C:\Program Files\Avacee\sip_agent\Wow64MIHelper.exe C:\Program Files\Avacee\sip_agent\Survey.exe C:\Program Files\Avacee\sip_agent\SentimentUI.exe C:\Program Files\Avacee\sip_agent\cu_rc.exe C:\Program Files\Avacee\sip_agent\hookldr.exe C:\Program Files\ControlUp\AgentManager\AgentManager.exe ``` ## Verify connectivity After you've configured your network, download the [ControlUp Tester tool](/docs/how-to-check-network-connectivity-to-controlup-cloud-services) on a device and run the ControlUp for Desktops tests to check that it can reach all required URLs. ## Related articles - [ControlUp Synthetic Monitoring communication requirements](/docs/communication-requirements-for-scoutbees) - [ControlUp for VDI communication ports (US region)](/docs/communication-ports-used-by-controlup-hybrid-cloud-us-customers) - [ControlUp for VDI communication ports (EU region)](/docs/communication-ports-used-by-controlup-hybrid-cloud-eu-customers)