---
id: settings
title: Settings
sidebar_label: Settings
---

One page, three groups: **Access**, **Monitoring** and **Integrations**. Your
licence has its own page.

Settings need the `owner` or `admin` role.

## Access

### People

Add, remove and re-role the people who can sign in.

| Role     | Can                                                  |
| -------- | ---------------------------------------------------- |
| `owner`  | Everything                                           |
| `admin`  | Everything except owner-only settings                |
| `member` | Servers, keys, workflows, monitors, secrets, console |

Local members sign in with an email address and a password.

#### People managed by Vantage HQ

On a cloud instance, anyone granted access from the Vantage HQ portal appears
here as a read-only row with a link back to the portal.

:::warning You cannot edit those people here
Their role, password and access are owned by Vantage HQ, so changing or removing
them has to be done there. See
[People and roles](../hq/people-and-roles.md).
:::

### Single sign-on

:::info Requires the single sign-on feature on your licence
It is a per-instance feature you enable on a paid plan.
:::

Add as many identity providers as you need. Each has its own name, its own
button on the login page and its own callback URL.

If you configured single sign-on on an older version, see
[Upgrading](../operations/upgrading.md#single-sign-on-after-an-upgrade).

Start from a preset:

| Preset                 | You provide                              |
| ---------------------- | ---------------------------------------- |
| Microsoft Entra ID     | Directory (tenant) ID                    |
| Google Workspace       | Nothing further                          |
| Okta                   | Your Okta org domain                     |
| GitHub                 | Client ID and client secret only         |
| Other (OpenID Connect) | The issuer URL of your provider          |

Every provider also needs a **Client ID** and **Client secret**. The secret is
stored encrypted and is never shown again after you save it.

:::info GitHub needs a verified primary email
Vantage identifies people by email address, and it only accepts a GitHub address
that is both the account's primary address and confirmed by GitHub.
:::

#### Callback URL

Each provider's card shows its callback URL with a copy button. That is the
address you register with the identity provider when you set up the application
on their side. Register each provider separately, even where several use the
same identity provider.

#### Turning off password sign-in

Once at least one provider is enabled you can turn off email and password
sign-in. Vantage refuses any change that would leave nobody able to sign in,
whether that is switching off passwords or disabling your last provider. Keep
one route open until everyone who needs access can use the new one.

## Monitoring

- **Offline threshold**, how long a server may go unheard from before it is
  marked offline. The default is 5 minutes.
- **Offline alerts**, the [notification channels](./notification-channels.md) to
  tell when that happens.
- **Notification channels** have [their own page](./notification-channels.md).
- **Workflow log retention**, how long run logs are kept.

| Value    | Meaning        |
| -------- | -------------- |
| unset    | 30 days        |
| a number | that many days |
| `0`      | keep forever   |

## Integrations

### External Secrets Operator token

The token Kubernetes uses to read your secret groups. It is shown once, stored
only as a fingerprint, and can be replaced at any time. See
[Secrets](./secrets.md#kubernetes-external-secrets-operator).

## Licence

The **Licence** page, in the sidebar, shows your instance ID, whether you are
cloud or self-hosted, your tier, server allowance, enabled features and expiry
date.

On a **self-hosted** install you paste your licence here. This works even while
your current licence has expired, which is how you get an instance out of
read-only mode.

On a **cloud** instance there is nothing to paste. Licences are installed for
you, and the page links to the portal instead.

See [Licensing and entitlements](../hq/licensing-and-entitlements.md).

## Sessions

Signing in gives you a session that lasts 24 hours. There is no session list to
manage. On a self-hosted install, restarting Redis signs everyone out and affects
nothing else.