Tenant Settings

Configure defaults that apply across the whole tenant

Authentication Providers
Basic only

These authentication settings apply to all organizations in this tenant, unless an organization overrides them with its own settings.

Username and password login against accounts stored in this platform. Recommended to keep enabled so administrators can always sign in even if an external provider is misconfigured or temporarily unavailable.

Lets anyone with a Google or Google Workspace account sign in. Create an OAuth 2.0 Client ID of type Web application in the Google Cloud console.

Credentials console Create project OAuth consent screen Docs
Register these in the Google OAuth client:
Step-by-step setup guide
  1. Open the Google Cloud console and create (or pick) a project.
  2. Configure the OAuth consent screen — choose Internal for Workspace-only, or External for any Google account.
  3. Go to Credentials → Create credentials → OAuth client ID → Web application.
  4. Add the Authorized redirect URI and JavaScript origin shown above.
  5. Copy the generated Client ID and Client secret into the fields below.
  6. Enable the switch and save. Requested scopes: openid email profile.
Ends in .apps.googleusercontent.com. From the OAuth client “Client ID” field.
Shown once when you create the OAuth client (starts with GOCSPX-). Stored encrypted.

Lets users sign in with a Microsoft Entra ID (Azure AD), Microsoft 365 or personal Microsoft account. Register an application in the Microsoft Entra admin center and add a Web redirect URI.

App registrations (Entra) App registrations (Azure) Docs
Register this as a Web redirect URI:
Step-by-step setup guide
  1. Open Entra → App registrations and choose New registration.
  2. Under Supported account types pick who may sign in (single tenant, any org, or personal accounts too).
  3. Set Redirect URI platform to Web and paste the callback URI shown above.
  4. From the app Overview, copy the Application (client) ID and the Directory (tenant) ID into the fields below.
  5. Go to Certificates & secrets → New client secret, then copy its Value (not the Secret ID) below.
  6. Under API permissions ensure the delegated Microsoft Graph scopes openid, email, profile are present (added by default).
  7. Enable the switch and save.
The Application (client) ID (a GUID) from the app registration Overview page.
The secret Value from Certificates & secrets (copy it immediately — it is shown only once, and secrets expire). Stored encrypted.
The Directory (tenant) ID (a GUID) to restrict sign-in to one organization, or a keyword: common (any Microsoft account), organizations (any work/school account) or consumers (personal accounts only).
AI Settings
Not configured

These AI settings apply to all organizations in this tenant, unless an organization configures its own. If left disabled, the tenant inherits the platform’s provider.

Used for semantic search. Leave blank for the provider default.
Branding
Not configured

These branding defaults apply to all organizations in this tenant, unless an organization overrides them. Blank fields inherit the platform brand.

Shown in the navigation bar and page titles.
No logo — the default icon is used.
PNG/SVG, under 256 KB. Uploaded images are embedded inline.
Favicon preview No favicon — the default is used.
Custom Domains
0 domains

Map a domain to any published book across this tenant’s organizations.

Point the domain's DNS (an A/CNAME record) at this server, then map it to a public book below — it will be served at the domain root. TLS is handled by the reverse proxy in front of this app; the SSL status here is a record of that provisioning.

Domain Book SSL Active Actions
No custom domains yet. Click Add Domain to map one.
Git Providers

Disable any platform-enabled provider for this tenant. You cannot enable a provider the platform has disabled. Organizations pick their default from what remains.