Running the engagement from the dashboard

Everything here happens on your organization's home page in the dashboard. During setup it leads with a Get set up checklist that walks the rollout top to bottom, with each action on the step it belongs to and a check that fills in as each step is satisfied; below it sit the roster and devices. flowscope creates the organization and grants you access, and your contact can run any step with you.

1. Get the agent installer

Download the agent installer here; this is the file IT pushes to the fleet through Intune. The guide IT follows is Deploying the desktop agent with Microsoft Intune, and the egress destinations to allow are in Network and security requirements.

2. Set up the browser extension

The browser extension is not a download: it force-installs by browser policy from flowscope's self-hosted build, so IT points the policy at flowscope's update manifest and it installs with no per-person action. The full steps, the extension ID and manifest URL, and the self-serve path are in Rolling out the browser extension.

3. Mark deployment done

Once IT has pushed each piece to the fleet, flip the Agent (Intune) and Extension (browser policy) switches. Both must be on before you can add your team: until then the Add employee action stays disabled, so nobody is invited to open software that is not on their machine yet.

4. Add your team

Use Add employee to add each participant by work email. Because flowscope is already on their machines from the rollout above, each person is emailed their pairing link the moment you add them. You can work through the whole roster here, with each row filling in once that person signs in.

When someone has not paired yet, the Resend control on their pending invitation and the Remind control on their roster row re-deliver the nudge, so there is no separate batch step to remember. Each recipient signs in, accepts the agreement, and pairs their device, which then sits idle, capturing nothing, until you begin capture.

Watch the fleet come online

As participants sign in and pair, the Your team table fills in:

• EULA reads not yet, accepted, or stale (accepted an older version than the one in force).
• Devices lists each paired device with its platform, agent version, capture-health indicator, and last check-in. A device quiet for more than about ten minutes is flagged.
• The capture-health indicator reads ok, or flags permission denied or error (most often the agent needs reopening, or UI Automation has not attached yet). A flagged device usually just needs the participant to reopen the app and follow its prompts.

Pending invitations sit in their own section, and you can cancel one sent in error.

A device that has paired is online but is not yet capturing anything: the whole fleet stays idle through setup and starts capturing together when you begin capture, in the next step.

5. Begin capture

Begin capture stays locked until flowscope clears your engagement to start, so even with every step above complete the button can read "awaiting flowscope's go-ahead" for a short while. Once we approve it, and when everyone is paired, click Begin capture. The confirmation makes you complete two things:

1. It states that people show as anonymous letter labels by default, and that revealing real names is a logged action.
2. It asks you to acknowledge that your organization is responsible for how it uses the captured data, including any name reveal it performs.

On confirm, two things happen at once: every paired device begins capturing within a few minutes, and the fleet is sealed (no further people or devices). In the product, every person shows as an anonymous letter label like Person A by default. The AI that builds the map only ever sees these labels. Names never go into it.

Revoke a device

Revoking a device from its row disables its credential immediately: it stops capturing and cannot upload. During setup, before capture begins, someone who needs to return just pairs again, which issues a fresh device.

Pairing only works during setup. After Begin capture, no device can pair, re-pairs included, so handle late additions and swaps before you begin capture. The running phase is covered in While the engagement is running.

Review the app allowlist

Capture stays inside your organization's App allowlist, so the allowlist page is where you decide the scope. flowscope proposes the list from the systems you named, and keeps proposing as capture runs: business systems that fall inside the workflow scope you confirmed are added for you, and anything flowscope cannot place with confidence waits for your decision. Once capture begins, flowscope emails your admins when new items are waiting for review. Adding a system never turns on screen capture, which is a separate clearance. If you would rather decide every app yourself, switch the automatic additions off on the same page. That applies from then on and does not remove what is already on the list.

Revealing real names

In the product, every person shows as an anonymous letter label like Person A by default. From the settings gear in the top right of your organization's home page, an admin can turn real names on for their own screen. flowscope staff can do the same. The system records every reveal, so there is an audit trail of who saw real names and when. The AI that builds the map only ever sees the letter labels. Names never go into it.

Capture scope

What the software may observe (the per-organization allowlist) and what it never observes (the permanent denylist) are part of the agreed configuration. Participants can see the scope that applies to them, pause and resume capture, and remove the software. The participant view is in Your privacy and controls; the full posture is in the Discovery trust addendum.