---
description: "Settings for the whole installation, not for a single Workspace. Global Settings is available to System Administrators in the Enterprise edition…"
---

# Global Settings

Settings for the whole installation, not for a single Workspace. **Global Settings** is available to **System Administrators** in the **Enterprise edition** (sidebar). Workspace-level settings — members, Roles, labels, AI text generation — are under **Workspace Settings** instead; see [Workspaces](/documentation/workspaces).

The page is organised in tabs.

## General

**Instance Info**: the app version, the **Public Base URL** and the totals of Workspaces, users and runtimes.

## Feature Flags

Switch parts of the navigation on or off for everyone:

- **Knowledge** — the **Knowledge** page
- **Usage & Cost** — the **Usage & Cost** page
- **Agent Squads** — the **Squads** page
- **Devices** — the **Devices** page, and the **Client capabilities** setting on an agent's **Context** tab

Changes apply after the page is reloaded. Turning **Devices** off only hides these screens: devices that are already paired stay paired, and an agent's saved Client capabilities setting is not changed.

## White Label

- **Logo** — **Upload Logo** or **Delete logo**
- **App Title** — The name shown in the app
- **UI5 Theme** — SAP Horizon Dark (default), SAP Horizon Light, SAP Fiori 3 or SAP Belize

Press **Save** to apply.

## Identity

Single Sign-On with an OpenID Connect provider:

- **Redirect URI** — Register this exact address on your identity provider
- **Issuer / Discovery URL**, **Client ID**, **Client Secret**
- **Display Label** — The text of the login button (for example "Log in with Company SSO")

The client secret is stored encrypted and never shown again.

## Users

- **System Administrators** — Manage who holds the role: enter an account email and press **Look Up**
- **Pending Sign-Ups** — People who signed in through SSO for the first time wait here until you press **Approve** or **Reject**

## API Tokens

Tokens for the outbound REST API, one per Workspace. **Create Token** shows the token value once — copy it then. The list shows **Name**, **Workspace**, **Created**, **Last Used** and **Status**; **Revoke** disables a token. **Swagger Docs** opens the API documentation.

## AO MCP

The built-in MCP server that lets an agent use Agent Orchestrator itself. See [MCP Servers](/documentation/mcp-servers).

## Email

SMTP settings for the emails the app sends (Task watcher notifications, @mentions, SSO sign-up notices): **SMTP Host**, **SMTP Port**, **Username**, **Password**, **From Address** and **Use TLS/SSL**. **Test Email** sends a message to check them.

## Observability

- **Log Shipping** — Sends backend and daemon logs to an external OTLP-compatible service. It covers application logs only, and only when the instance has an endpoint configured
- **Product Analytics** — Sends product-usage events (sign-ups, logins, Workspace, agent and Task activity). It only works when the instance has an analytics key configured

## Audit Log

- **Retention** — Delete events older than: Forever, 30 days, 90 days, 180 days or 1 year
- **Visible Event Categories** — Which kinds of events appear in the Workspace Audit Logs: Task, Project, Agent, Run and Git events. Workspace member and Role changes are always visible