Organisation-wide settings live under Administration in the portal. It is one page with a section list on the left; you only see the sections your role has permission for, and the search box at the top filters them.

Sections and permissions

Group	Section	What it controls	Permission
People & access	Users	Invite people, change roles, suspend accounts	users.view
	Roles	What each role is allowed to do	roles.view
	Groups	Organise users into access groups	groups.view
	Policies	Who may reach which servers, and for how long	policies.view
Authentication	Single sign-on	Identity providers	settings.sso
	Two-factor	Authenticator codes at sign-in	settings.mfa
	Access rules	Production approvals, bypass and sign-in rules	org.access_settings
Organization	General	Name, domain and logo	org.update
	Certificate authority	The SSH CA and its keys	ca.view (rotation needs ca.rotate)
	Quick Connect	Ad-hoc SSH to unsaved hosts	quick_connect.settings
	Posture	Retention, expected-public ports, alert routing	posture.settings
Integrations	Email	Provider for invites and notifications	settings.smtp
	Storage	Where session recordings are kept	settings.storage

Sections are gated by permission, never by role name. If a section is missing, ask someone who can edit roles to grant the permission.

INFO

Leaving a section with unsaved edits asks before discarding them.

Access rules

Administration → Access rules holds three organisation-wide switches. Every change is audited as org.access_settings.update.

Allow skipping production approval

Production servers always require an approved access request. Roles that hold the Production without approval permission (access.prod_bypass) can skip the wait — but only while this switch is on.

Switch	Effect
Off	Every production request needs an approver, super admins included. Break-glass to production is also blocked.
On	Roles with Production without approval connect to production immediately.

Skipping the wait never skips the record. The request is still created with a reason, it is audited as access_request.prod_bypass, and the server's approvers are notified afterwards.

The card under the switch lists Roles with “Production without approval”. To change who holds it, follow Manage roles. If roles are listed while the switch is off, the page says so: Not in effect while the switch above is off.

WARNING

A policy's auto-approve flag can never grant unreviewed production access. These two controls — the permission and this switch — are the only way past the approver.

Require single sign-on

When on, everyone signs in through an SSO provider. Password sign-in, password resets and adding a password are refused — except for roles holding the Single sign-on permission (settings.sso), so an administrator can still get in if the identity provider breaks. The page lists those roles under Roles that can still sign in with a password.

The switch cannot be turned on until at least one SSO provider is added and enabled.

Personal vault

When on, users may keep private identities, keys and My hosts, visible only to their owner and never to admins. Turning it off hides and disables those items for everyone; nothing is deleted, and turning it back on restores what was saved. See Personal vault.

General

Administration → General sets the organisation name, domain and logo URL shown across the portal. Changes are audited as org.update.

Certificate authority

Administration → Certificate authority shows the active CA's fingerprint, public key, creation and last-rotation dates, and how many certificates it has issued.

Rotating the CA

Rotate CA invalidates every existing certificate. New certificates must be issued and hosts must fetch the new CA public key before anyone can connect again. It cannot be undone. Plan it like an outage.

Storage

Administration → Storage decides where session recordings and uploads are kept. Settings saved here override the environment variables, with no restart.

1. Choose a provider: MinIO (self-hosted, S3-compatible), AWS S3 or Azure Blob Storage.
2. Fill in the endpoint (MinIO), region, bucket and credentials. For MinIO and most self-hosted S3, turn on Force path-style addressing; turn on Use SSL/TLS if the endpoint is HTTPS.
3. Choose Save, then Test connection. The test creates the bucket if needed and writes, then deletes, a small object — so it proves read, write and delete rather than only reachability.

The secret key is encrypted at rest and never returned; when editing, leave it blank to keep the stored value. Reset to env defaults removes the saved configuration and returns to the environment variables.

Sections covered elsewhere

• Team and roles — Users and Roles
• Groups
• Access policies
• Single sign-on and Two-factor
• Quick Connect
• Posture
• Email delivery

Next steps

Team and rolesGrant the permissions that unlock each section.Access requestsSee what the production approval switch changes in practice.Hardening checklistSettings worth locking down before going live.