Administering a tenant
Each page covers one thing you want to do as the person managing the team. The chapters are being rewritten into these pages. Anything not here yet is under “Chapters not yet rewritten” below. For your own work, see Find what you want to do.
Getting started
Section titled “Getting started”| Page | What you can do |
|---|---|
| What a tenant administrator does | Learn how to open tenant settings, where your job ends and the deployment administrator’s begins, and what to look at on your first day |
Members
Section titled “Members”| Page | What you can do |
|---|---|
| Check on your members | See workspaces, disks, sessions and what needs attention, on the roster and in the member detail |
| Add a member | Put someone on the roster by email address, and know invite-only from auto-join |
| Remove a member | Offboard someone: stop their access, erase their home and backups, delete them from the roster |
| Replace a member’s Git token | Replace an internal Git token that may have leaked |
Sign-in
Section titled “Sign-in”| Page | What you can do |
|---|---|
| Choose how people sign in | Register your company’s IdP or a GitHub organisation, and read the login rules |
| Limit the networks people sign in from | Narrow where your tenant can be used from to a set of address ranges |
| Choose the OAuth apps for integrations | Decide which app “Connect with OAuth” uses for GitHub, Bitbucket and Jira |
Resources
Section titled “Resources”| Page | What you can do |
|---|---|
| See how resources are used | See members’ resources and the sessions running now, and narrow down the cause when things are slow |
| Set session limits | Set each member’s session limit, and check the tenant-wide limits and the limit board |
| Choose who may use the inference engines and which models | Choose the members who may use the self-hosted engines, and take models in when allowed |
| Set the workspace size | Set memory, CPU, disk and the machine, and grow a home |
| Stop workspaces left idle | Read the idle-stop outlook, and force-stop a workspace that runs away |
| Start the workspace at sign-in | Have a stopped workspace start when its member opens the Console |
Team defaults
Section titled “Team defaults”| Page | What you can do |
|---|---|
| Set the branch naming rules | Line up the branch names and starting branches proposed when work starts from an issue |
| Set member defaults | Decide which agent new members are pointed at |
Audit and usage
Section titled “Audit and usage”| Page | What you can do |
|---|---|
| Read the audit log | Check when, who, against what and what kind of change was made in your tenant |
| Read running time and cloud cost | See each member’s running time and cloud cost for a period and by month, and export it as CSV |
Outside connections
Section titled “Outside connections”| Page | What you can do |
|---|---|
| Distribute an MCP server to everyone | Hand a shared MCP server to every member of the tenant, and stop outside apps’ OAuth connections |
| Allow memory use from outside | Decide whether members may use memory from agents outside Agent Fleet |
| Allow MCP servers as watch sources | Decide whether members may make their own MCP servers a source for the watch tool |
These chapters have moved to the pages above: 01 Member management, 02 Resource limits and sessions, 03 Audit and usage, 04 MCP distribution and outside access, 05 Who may sign in, and from where, 06 Team defaults
What each role may do is in Roles and what they may do.