> ## Documentation Index > Fetch the complete documentation index at: https://help.draftable.com/llms.txt > Use this file to discover all available pages before exploring further. # Before you deploy: IT checklist > What IT needs to know, approve and prepare before rolling out Draftable Clean: the desktop app and the Outlook add-in, installers, Microsoft Entra approval, product keys, network access, security tools, Group Policy or Intune, and a pilot group. This checklist is for IT administrators preparing to roll out Draftable Clean. Work through it before you install anything, and follow the links for the detailed steps. Each item lists who needs to be involved and what to decide. ## Checklist at a glance | # | Item | Who is involved | | - | - | - | | 1 | Understand that Draftable Clean has two parts, and deploy them in order | IT | | 2 | Check system and Outlook requirements | IT | | 3 | Choose an installer: per-user EXE or machine-wide MSI | IT | | 4 | Line up the Microsoft 365 roles you need | Microsoft 365 administrator | | 5 | Plan how product keys reach users | IT, whoever holds your license | | 6 | Open the network connections Draftable Clean needs | Network or security team | | 7 | Check security tools that can block it | Security team | | 8 | Get the Group Policy or Intune templates | IT | | 9 | Decide how Classic and New Outlook should behave | IT | | 10 | Choose a pilot group | IT and a few willing users | ## 1. Two parts, deployed in order Draftable Clean is made of two parts that you deploy separately: * **The desktop application**, installed on each user's computer. It does the cleaning. * **The Outlook add-in**, deployed from the [Microsoft 365 admin center](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Installing-Draftable-Clean-Outlook-Add-in.md). It sends attachments to the desktop application over `localhost` and puts the cleaned copies back on the email. Installing the desktop application does not add anything to Outlook, and uninstalling it does not remove the add-in. The add-in does nothing useful until the desktop application is installed and licensed on that computer. Deploy in this order: **1. Install and license the desktop application** Install it on your pilot computers and confirm it activates. See [Single-user Installation](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Single-user-Installation.md) or [Enterprise Deployment](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Deployment-options.md). **2. Deploy the Outlook add-in** Deploy it from its manifest URL and assign it to the same users. It can take up to 72 hours to appear in Outlook. **3. Approve Draftable Clean in Microsoft Entra ID** Do this straight after deploying the add-in. See [Approving Draftable Clean in Microsoft Entra](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Draftable-Clean-and-Microsoft-Entra.md). > [!WARNING] > > When you remove Draftable Clean, reverse the order: remove the add-in from **Integrated apps** first, wait for it to disappear from users' Outlook (up to 72 hours), then uninstall the desktop application. Left in place, the add-in keeps trying to reach the desktop application, which can stop users sending emails with attachments. ## 2. Requirements * **Windows 10 or later.** See [System Requirements](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/System-Requirements.md) for processor, memory and disk space. .NET 10 is bundled, so you do not deploy it separately. * **Outlook**: Outlook on the web, Classic Outlook on Windows, or New Outlook for Windows (beta), supporting Mailbox API 1.13. * **Microsoft 365 Business account** for administrator deployment of the add-in. * **Desktop version**: the add-in needs Draftable Clean **26.6.0 or later**. Cleaning Microsoft Purview protected attachments needs **26.11.0 or later**. ## 3. Choose an installer | Installer | Scope | Updates | | - | - | - | | `DraftableCleanSetup.exe` | Per-user, no administrator rights | Automatic, in the background | | `DraftableCleanSystem.msi` | Machine-wide, administrator rights | You download and install each update | Shared machines such as Citrix and Remote Desktop Services need the MSI. See [Choosing how to deploy Draftable Clean](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Choosing-how-to-deploy-Draftable-Clean.md) to decide. ## 4. Microsoft 365 roles * **Deploying the add-in**: a Microsoft 365 administrator, in **Integrated apps**. * **Approving the Draftable Clean app**: an administrator who can grant tenant-wide admin consent, such as a **Global Administrator** or **Privileged Role Administrator**. The app is called **Draftable Clean**, application ID `a661f67c-f640-4e9c-8137-2ac9a32589d4`. You approve it once for the whole organization; users are never prompted. Until **Draftable Clean** is approved, cleaning works, but users in New Outlook and Outlook on the web are asked to confirm every send that has cleaned attachments. ## 5. Product keys On first launch, each user is asked to accept the terms and conditions, enter a product key, and acknowledge the telemetry notice, in that order. You can deploy all three centrally so users are never asked: * **Accept terms and conditions on behalf of users** skips the terms prompt. * **Configure product key** (`ProductKey`, `REG_SZ`) under `HKLM\Software\Policies\Draftable\Clean` or `HKCU\Software\Policies\Draftable\Clean`. Draftable Clean attempts activation on launch. * **Acknowledge telemetry notice on behalf of users** skips the telemetry prompt. Activation connects to `draftable.com` and follows the Windows system proxy settings. Deactivating Draftable Clean on a computer does not by itself free up an activation; contact [support@draftable.com](mailto:support@draftable.com) to move licenses. See [Troubleshooting: Licensing](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Troubleshooting-Licensing.md). ## 6. Network connections Allow HTTPS (port 443) to: | Host | Needed for | | - | - | | `draftable.com` | License verification (required) | | `dl.draftable.com` | Loading the Outlook add-in on every computer, installer downloads and per-user updates | | `appsforoffice.microsoft.com`, `graph.microsoft.com`, `login.microsoftonline.com` | The Outlook add-in | | Your iManage, NetDocuments or SharePoint hosts | Only if you use those integrations | Error reporting and usage statistics are optional and can be turned off. The full list, including Microsoft Purview endpoints, is in [Network Requirements](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Network-Requirements.md). ## 7. Security tools * **Allow `localhost` calls.** The add-in talks to the desktop application over `localhost`. Endpoint protection that blocks these calls stops cleaning. The local HTTP listener uses port `5044`. * **Allow the `draftableclean://` URL protocol** if you restrict custom protocol handlers. The Outlook add-in uses it to start the desktop application when it is not running, which can show users the prompt **This site is trying to open Draftable Clean.** You can pre-approve it for everyone; see [Troubleshooting: Outlook Add-in](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Troubleshooting-Outlook-Add-in.md). Other applications and the Windows 11 right-click menu also use the protocol to hand files to Draftable Clean. * **Allow the installer and the application to run** under any application control policy. The per-user installer runs Draftable Clean from `%LocalAppData%\DraftableClean`; the MSI installs to `C:\Program Files (x86)\Draftable\Draftable Clean` by default. > [!WARNING] > > The Outlook add-in always connects to Draftable Clean on port **5044**, whatever the **Configure HTTP listener port** policy says. If your organization uses the Outlook add-in, leave the listener port at 5044. Changing it stops the add-in from reaching the desktop application. ## 8. Group Policy and Intune templates The administrative templates (ADMX and ADML files) are in the `GroupPolicy` folder of an installed copy, or available to download. Use them to deploy the product key, cleaning profiles, domain rules and send protection before users start. See [Configure Draftable Clean with Group Policy](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Configuring-preferences-with-Group-Policy-Draftable-Clean.md) or [Configure Draftable Clean with Microsoft Intune](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Configuring-preferences-with-Microsoft-Intune-Draftable-Clean.md). ## 9. Classic and New Outlook * **Classic Outlook** cleans attachments only while the Draftable Clean pane is open. Each user pins the pane once; administrators cannot pin it for them. Send protection still applies when the pane is closed. * **New Outlook for Windows** support is in beta. The **Clean attachments in New Outlook (beta)** policy (`CleanInNewOutlook`, `REG_DWORD` under `Software\Policies\Draftable\Clean\AddIn`) turns cleaning and pre-send checks on (`1`) or off (`0`) in New Outlook only. Not configured leaves the choice to each user, and the default is on. ## 10. A pilot group Assign the add-in to a small group first, not the entire organization. The admin center lets you choose **Specific users** or **Groups**. See [Rolling out Draftable Clean to your users](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Rolling-out-Draftable-Clean-to-your-users.md) for a pilot plan and an email you can send to users. ## Need help? If you have questions while planning your rollout, contact [support@draftable.com](mailto:support@draftable.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.