Download

Download the local-first desktop app.

Download OpenAdminOS for Windows, macOS, or Linux, review release notes, and inspect the open-source Microsoft 365 admin agent runtime before running it against a tenant.

Current release

v0.7.0

Release notes SHA256SUMS.txt

macOS

Use the DMG for a normal workstation install. Use the PKG when you need a managed deployment package.

.dmg

DefaultApple Silicon · signed and notarized

Direct install for individual workstations

SHA-256

7f9be5593d948280e1f545675181d7d0bf40632abb2b03b4c54ad42baa9c83ca

Download .dmg

.pkg

ManagedApple Silicon · signed and notarized

Installer package for Intune, Jamf, Munki, or MDM rollout

SHA-256

a4fadaf77d3d1cdf7e7927b02b5f319c04da778886258dbb5ce671928c4c6812

Download .pkg

Linux x64

Linux packages are unsigned preview builds. Verify the SHA-256 hash before installing.

AppImage

PortableLinux x64 · unsigned

Runs on most desktop distributions

SHA-256

522687c19ec8991afa95e01ec4cc5aca1151134c5da7a16dda23524766f0d036

Download AppImage

.deb

Linux x64 · unsigned

Ubuntu and Debian-family systems

SHA-256

76e55aea47a2d2e31a579eea4d9b493e8a3dec8fe4baaead67cf54a0cecf5061

Download .deb

.rpm

Linux x64 · unsigned

Fedora, RHEL, and compatible systems

SHA-256

97323141bffde145823a1f992f90d16cb7af7fdfb37c83ed69b980806ecee32b

Download .rpm

Windows x64

Signed per-user installer, no administrator rights needed. If SmartScreen warns, confirm the publisher is Ugurlabs UG (haftungsbeschränkt) or verify the SHA-256 hash.

.exe

DefaultWindows x64 · signed

Per-user installer. Does not need local administrator rights.

SHA-256

17cd2cad4b7b520d21add24ed2768aa465106a2a92a3efe5ecbcb873dbff0450

Download .exe

Source

Inspect the code before connecting a tenant.

The app, runtime, registry contract, and SDK are open-source under the MIT License.

Inspect the repository

Before first run

Connect a tenant and choose a model provider.

OpenAdminOS uses MSAL for Microsoft 365 tenant consent and Microsoft Graph access. Local model providers keep prompts and tenant context on the workstation. Hosted providers are optional and labeled before tenant context leaves the device.

Read-only agents can run after consent. Write agents always stop at a diff confirmation screen before changing tenant state.

Read the trust model