Start at the vendor. Deploy from your own tenant.

Type the vendor's address yourself or use the links in the table below, which point to each vendor's own domain. Be wary of search ads and lookalike domains that imitate a vendor's sign-up page; check the address bar shows the vendor's exact domain over HTTPS before you enter any company details. Use a work mailbox you control, and turn on multi-factor authentication for the first account before you invite anyone else.

During a trial, create a separate test organisation or site inside the tenant instead of enrolling a live client straight away. It keeps trial agents easy to find and remove if you decide not to continue.

1. Generate it yourself. Create the agent package from inside your own console, for a named client or site. Never reuse a package someone sent you, even a colleague — generate a fresh one.
2. Check the digital signature. On Windows, open the file's Properties and the Digital Signatures tab, and confirm the signer is the vendor's company name and the signature is reported as valid. On macOS, the package should be signed and notarised; the system will warn you if it is not.
3. Compare the hash where one is published. If the vendor shows a SHA-256 value, compare it in PowerShell with Get-FileHash .\agent-package -Algorithm SHA256 or on macOS with shasum -a 256 agent-package.
4. Keep endpoint protection switched on. A genuine agent never needs antivirus disabled to run. If your security tool blocks it, add a narrowly scoped exclusion for the vendor's signed files using the vendor's documentation — not a blanket exception.
5. Watch it check in. Once deployed, the device should appear under the right client in your console within minutes. A device that shows up somewhere unexpected is a reason to stop and investigate.

Angry IP Scanner and Wireshark are free, open-source applications, and LizardSystems Network Scanner is a Windows program that is free for personal use but needs a paid business licence for client work. None of them is a cloud service, so there is no tenant to sign in to — which makes the source of the file matter even more. Popular free tools are a favourite disguise for bundled adware and worse on third-party mirror sites.

1. Use the publisher's own domain. Get Angry IP Scanner only from angryip.org (which points to the project's own release pages), Wireshark only from wireshark.org, and Network Scanner only from lizardsystems.com. Type the address yourself rather than clicking a search ad.
2. Check the signature where there is one. Wireshark's Windows packages are code-signed: open the file's Properties and confirm the Digital Signatures tab names the Wireshark Foundation and reports the signature as valid. On macOS, the system warns you if an app is not signed and notarised. Where a project does not sign a build, the published hash is your check.
3. Compare the published hash. Wireshark publishes SHA-256 values for every release on its site, and LizardSystems lists a SHA-256 value on its Network Scanner release page; compare with Get-FileHash .\file -Algorithm SHA256 in PowerShell or shasum -a 256 file on macOS and Linux. On Linux, the distribution's own package repository is a sound alternative.
4. Keep capture components official too. Wireshark on Windows relies on the Npcap capture driver, which its setup offers to add; accept it from there rather than from anywhere else.
5. Check the licence before client work. Open-source tools carry no fee, but a "free for personal use" licence does not cover commercial work. For LizardSystems Network Scanner, buy the business licence from the vendor before using it on a client network.
6. Write down the authorization. Scanners and packet analyzers belong on networks you manage or have written permission to assess. Record that permission in the client file before the first sweep or capture.