> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started with a SaaS Deployment

> First-time setup for Syteca SaaS — log in, mandatory password change, mandatory 2FA, view the serial key, and install Windows / macOS / Linux Clients on the endpoints to be monitored.

This guide walks new Syteca **SaaS** customers through the first hour after receiving their license. The steps differ slightly from on-premises deployments — SaaS enforces stricter login security (mandatory password change, mandatory 2FA) and some features are vendor-managed rather than admin-configurable. For the post-install task sequence (assigning licenses, adding Client groups, configuring monitoring, etc.), continue to the [Getting Started checklist](/docs/get-started/checklist) afterwards.

<Info>
  **Conventions used throughout this documentation:**

  | Label                     | Meaning                                                                                                                      |
  | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
  | **NOT AVAILABLE IN SAAS** | The feature exists but isn't user-configurable in SaaS — contact your Syteca vendor or Support, or it's on-prem-only.        |
  | **IN SAAS ONLY**          | The feature works differently in SaaS than in on-premises deployments — the section that follows describes the SaaS variant. |
</Info>

## What you receive from your vendor

After your **SaaS** product license serial key is issued, your Syteca vendor emails you:

* A **URL** for the Management Tool — in the form `<Customer_name>.syteca.com`.
* The **`admin`** account credentials (login + initial password).

<Note>
  The **SaaS** serial key type is currently subscription-only.
</Note>

## 1. Log in for the first time

<Frame caption="The mandatory password change screen — every SaaS user is forced through this on first sign-in, with the complexity requirements visible inline.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/get-started/saas-mandatory-password-change.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=e84bf9fb08a25c807947109d9a6087c8" alt="Syteca SaaS mandatory password change screen showing two password fields with complexity requirements listed beneath" width="834" height="949" data-path="images/get-started/saas-mandatory-password-change.png" />
</Frame>

<Steps>
  <Step title="Open the Management Tool">
    Enter the URL provided by your vendor into your browser. The Management Tool login screen opens.
  </Step>

  <Step title="Enter the admin credentials">
    Sign in with your login and the initial password your vendor provided.
  </Step>

  <Step title="Change your password (mandatory)">
    SaaS forces every user to change their password on first sign-in. Enter a new password in both fields and submit.

    <Note>
      Password requirements: **at least 8 characters**, containing at least **one lowercase letter, one uppercase letter, one numeric character, and one special character**. Cannot contain more than 3 consecutive identical characters.
    </Note>
  </Step>

  <Step title="Sign in again with the new password">
    The system signs you out — sign back in with the password you just set.
  </Step>

  <Step title="Set up two-factor authentication (mandatory)">
    A QR code appears. Scan it with an authenticator app on your phone (**Google Authenticator**, **Microsoft Authenticator**, or any TOTP-compatible app).

    <Warning>
      **Save the recovery code displayed alongside the QR code.** It's the only way to regain access if you lose your authenticator device. Store it somewhere safe and not on the same device as the authenticator.
    </Warning>

    <Note>
      **IN SAAS ONLY:** 2FA setup is mandatory on first sign-in for every user, every login afterwards uses 2FA, and **this requirement can't be disabled** — unlike in on-premises deployments where 2FA is configurable per user on the [Users page](/docs/administration/users/users).
    </Note>
  </Step>

  <Step title="Confirm 2FA">
    Click **Confirm**, then enter the 6-digit code generated by your authenticator app. You're now signed in.
  </Step>
</Steps>

## 2. View your serial key and Client licenses

<Steps>
  <Step title="Open Configuration">
    Click the **Configuration** (gear) icon at the top of the Management Tool.
  </Step>

  <Step title="Open the Serial Key Management tab">
    On the **Configuration** page, select the **Serial Key Management** tab. Your serial key details — the activated SaaS key, included Client licenses, expiration date — are displayed.
  </Step>
</Steps>

<Note>
  **IN SAAS ONLY:** Your serial key is **already activated** by your vendor — no user action required to activate it. However, **if your vendor updates the existing serial key**, you need to click **Update Serial Key** on the Serial Key Management tab for the changes to take effect.
</Note>

<Warning>
  You'll receive expiration notifications **14 days**, **5 days**, and **1 day** before the serial key expires. **If the key isn't renewed by 7 days after expiration, monitoring stops** — Clients will no longer be able to send data. Track the renewal date and coordinate with your vendor well ahead.
</Warning>

For full serial key details (licensed Client counts, included applications, license types), see [View the serial key and licenses](/docs/administration/licensing/manage-serial-key).

## 3. Install Clients on endpoint computers

Clients are downloaded from the Management Tool and installed on each endpoint computer (Windows, macOS, or Linux) to be monitored.

<Steps>
  <Step title="Sign in with Client Installation permission">
    Sign in as a user with the [administrative Client Installation and Management permission](/docs/administration/users/administrative-permissions).
  </Step>

  <Step title="Open the Install Clients page">
    Click **Clients** in the left navigation. On the **Client Management** tab, click **Install Clients** in the top right.

    On the **Computers without Clients** page, click **Download Installation File**.
  </Step>

  <Step title="Download the installation file for your OS">
    On the **Installation File Download** page, pick your OS in the drop-down and download the file:

    | OS          | Package                                                                                                         |
    | ----------- | --------------------------------------------------------------------------------------------------------------- |
    | **Windows** | `SytecaClient.msi` (default parameters) or `SytecaClient.zip` (`.msi + .ini`, for custom monitoring parameters) |
    | **macOS**   | `SytecaMacOSClientuniversal.tar.gz`                                                                             |
    | **Linux**   | `SytecaLinuxClientx64.tar.gz`                                                                                   |
  </Step>

  <Step title="Install the Client on each endpoint">
    <Tabs>
      <Tab title="Windows">
        Copy `SytecaClient.msi` (or the `.zip` for custom parameters) to each Windows endpoint, then install with one of:

        * **Windows Installer (GUI):** double-click `SytecaClient.msi` and follow the Setup Wizard.
        * **Command line:** open `cmd` or **PowerShell** as administrator, navigate to the folder containing the file, and run:

          ```text theme={"system"}
          msiexec /i SytecaClient.msi PROXY_HOST=<hostname_or_IP_address_of_load_balancer_on_Syteca_proxy_server>
          ```
        * **Custom parameters:** use `SytecaClient.zip` and follow [Install Windows Clients locally with custom monitoring parameters](/docs/administration/clients/install-windows#local-installation-without-an-ini-file).
      </Tab>

      <Tab title="macOS">
        Copy `SytecaMacOSClientuniversal.tar.gz` to each macOS endpoint. Then either:

        * **Local install:** use [the command-line installation procedure](/docs/administration/clients/install-macos#install-the-macos-client-from-the-command-line) — identical to on-prem.
        * **Remote mass deployment:** use [VMware Workspace ONE UEM](/docs/administration/clients/install-macos#remote-mass-deployment-using-vmware-workspace-one-uem) or [Jamf Pro](/docs/administration/clients/install-macos#remote-mass-deployment-using-jamf-pro) — identical to on-prem.
      </Tab>

      <Tab title="Linux">
        Copy `SytecaLinuxClientx64.tar.gz` to each Linux endpoint, then install via [the installation file procedure](/docs/administration/clients/install-linux#install-with-default-monitoring-parameters) — **but use the hostname or IP address of the load balancer on the Syteca proxy server** instead of the on-prem Application Server address.
      </Tab>
    </Tabs>

    <Warning>
      **Network ports required:**

      * **Port 443** — open for **Windows, macOS, and Linux** Clients.
      * **Port 9447** — also open for **Windows** Clients.

      See [Network Requirements](/docs/get-started/system-requirements) for full network specifications.
    </Warning>
  </Step>

  <Step title="Confirm monitoring is active">
    Once installed, the Client appears in the **Clients** list. Monitoring starts as soon as any user logs in to the endpoint.
  </Step>
</Steps>

## 4. Continue with the post-install checklist

Now that the platform is reachable and Clients are installed, work through the [Getting Started checklist](/docs/get-started/checklist) — assigning licenses, adding Client groups, defining monitoring configuration, creating PAM secrets, and configuring alerts and reports.

In SaaS, features marked **NOT AVAILABLE IN SAAS** in this Knowledge Base are either vendor-configured on request or on-prem-only. Features marked **IN SAAS ONLY** behave differently from on-premises — the page where each label appears explains the variant.

## Related

<CardGroup cols={2}>
  <Card title="Getting Started checklist" icon="square-check" href="/docs/get-started/checklist">
    The post-install task sequence — licenses, Client groups, monitoring, PAM, alerts, reports.
  </Card>

  <Card title="Management Tool basics" icon="layout-dashboard" href="/docs/get-started/management-tool-basics">
    Sign-in patterns, navigation, default brute-force lockout behavior.
  </Card>

  <Card title="Users and permissions" icon="users" href="/docs/administration/users/users">
    Add users, define groups, grant administrative and Client permissions.
  </Card>

  <Card title="Getting started with PAM" icon="key-round" href="/docs/get-started/password-management">
    Configure Password Management for your SaaS deployment.
  </Card>
</CardGroup>