Administration overview

This guide is for the people who run Genie for their company: the owner and admins of a workspace, and the company's system administrator. It explains each setting by what the people in your workspace will see. Genie itself is hosted and kept running by your Genie provider, so you never install, upgrade or back it up yourself. Start with this page to learn the roles, how workspaces are organised and where each setting lives.

Who does what

Each group of people looks after a different part:

Who	Typical person at Contoso	What they look after
Members (Viewers and Contributors)	Nam Vo (sales), Thu Hoang (HR)	Nothing to configure: they chat with Genie, read knowledge bases and run agents. Contributors also create knowledge bases and agents. Their Settings hold only their own account.
Workspace owner and admins	Linh Pham (owner), Minh Le (IT, admin)	One workspace: its members, knowledge bases, data sources, agents, the Toolbox, channels and integrations. On Features they can turn web search and running code off for their workspace.
System administrator	Minh Le, who also runs Microsoft 365 for Contoso	What applies to the whole company, set once for every workspace: the models, how Genie answers (limits, long-term memory, search), web search, data protection, running code and budgets; also user accounts, sign-in, the workspaces and their tree, email, network and antivirus. A few things are set for one workspace at a time, such as its network access and sandbox.
Your Genie provider	The vendor that hosts Genie	Servers, updates, backups, storage and the engines behind document processing

When a task on these pages needs a change on the server side, it says so and asks you to contact your Genie provider.

Roles

Everyone in a workspace has one of four roles. A person can belong to several workspaces and hold a different role in each: Minh Le can be Admin in Contoso and Viewer in another department's workspace.

What the person can do	Viewer	Contributor	Admin	Owner
Chat with Genie, read the knowledge bases and documents they are allowed to see, run the agents open to them	✓	✓	✓	✓
See the workspace's details and who else is in it (Workspace info, Members)	–	–	✓	✓
Create knowledge bases and agents, and manage the ones they created (upload, edit, delete, share)	–	✓	✓	✓
Manage every knowledge base and agent in the workspace, including restricted documents	–	–	✓	✓
Connect data sources (SharePoint, file servers, mailboxes, websites)	–	–	✓	✓
Configure the workspace: turn web search and running code off (Features), Databases, skills and MCP services, IM channels, website widget, MCP server, CLI, the default assistant	–	–	✓	✓
Set member attributes (for example `department = HR`), see Analytics, Usage & cost and the workspace audit log	–	–	✓	✓
Create and join Shared spaces with other workspaces	–	–	✓	✓
Invite and remove members, change roles, set an end date on someone's access	–	–	–	✓
Manage the workspace's API keys (API), rename the workspace, delete it	–	–	–	✓

A few rules sit on top of the table:

Creators manage what they created. A Contributor acts like an admin on their own knowledge bases and agents, and like a Viewer on everyone else's.
Only Owners manage membership. Admins cannot invite, remove or re-role people. If your IT team should handle membership, make that person an Owner, or let the system administrator map Microsoft Entra ID groups to roles so membership follows the groups (see Members and sign-in).
A workspace always keeps an Owner. The last Owner cannot leave, be removed or be demoted; promote someone else first.
Document permissions narrow what a role allows. A Viewer who may read a knowledge base still sees only the documents their document permissions let them see. Admins and Owners always see everything, so they can manage the content.
Agents can be limited. An agent's creator or an Admin can restrict who may run it, by role or by name (see Agents and the default assistant).
Admins see numbers, not conversations. Analytics shows counts. An admin reads a member's question and answer only when the member sends them with a Not helpful rating (see What admins can see).
Company-wide settings belong to the system administrator. The models, how Genie answers, web search, data protection, running code and budgets are set once for every workspace, and each workspace's network access and sandbox are set by a system administrator too. Admins and Owners just use them; the only thing they change is turning web search and running code off for their workspace, on Features (see below).

The system administrator

The system administrator role is not a workspace role. It opens the System administration group in Settings, where a system administrator sets up, once for every workspace:

the models, on Model management and Model catalog: workspaces do not connect models of their own;
how Genie answers, on Assistant & conversations: Genie's limits and routing, long-term memory, message search and search settings;
web search, on Web search: Genie Search and whether and how Genie searches the web;
data protection, on Data protection: which models may receive content from sensitive knowledge bases, fallback models, personal data masking and violations;
running code, on Sandbox: whether Genie and agents may run code (Running code in every workspace);
budgets, on Usage & cost: the company's Default budget per member and each workspace's monthly budget;
accounts and the platform, on System settings, Users, Workspaces, Email, Sign-in methods, Network & antivirus, Platform API keys and Audit log.

When one workspace needs a different value on Assistant & conversations, Web search, Data protection or Sandbox, the system administrator adds it under Workspaces with their own setting on that page. The workspace then keeps its own value when the company's changes.

Web search and running code are switched at two levels. When a system administrator turns one off, it is off in every workspace, and workspace admins cannot turn it on. When it is on, each workspace's Admins and Owners can still turn it off for their workspace, on Settings → Workspace → Features.

Settings → Features: web search and running code for everyone in the workspace

A few settings apply to one workspace at a time:

On Sandbox (where code runs), Vector database and Storage, and under Search services of a workspace on Web search, pick the workspace in the Workspace box first. You do not need to switch to that workspace.
A workspace's network access is on its Workspace info, so set it while working in that workspace (see Network and antivirus).

A system administrator can grant the role to other users (see System administrators). Being a system administrator does not make you a member of every workspace: to work with a workspace's knowledge bases, agents and members, you still need a role in it. See System administration.

Workspaces

A workspace is a team's own area in Genie: it has its own members, knowledge bases, agents, conversations and settings. People in one workspace never see another workspace's content unless it is shared with them on purpose. Contoso uses one workspace per department, for example Contoso for head office and a separate workspace for each branch.

To switch workspace, open the account menu (your name at the bottom of the sidebar) and pick a workspace under Switch workspace. Your role in each workspace is shown next to its name.
To create a workspace, choose Create new workspace in the same menu. You become its Owner. A system administrator can turn this off so that people join workspaces only by invitation.
To see the workspace's details, open Settings → Workspace info: it shows the Workspace ID, name, description and storage use. The Owner can edit the name and description and, at the bottom of the page, delete the workspace. A system administrator also sets Network access here, to allow the workspace only from the office and VPN networks; Admins and Owners do not see it (see Network and antivirus).

Someone who signs up and creates their first workspace goes through a short setup that starts with Welcome to Genie, …: what Genie does, including that it is Private and secure (conversations are encrypted and admins cannot read them; see Privacy), then the workspace's name, goals and invitations.

The first step of setting up a new workspace

A new workspace shows a Finish setting up Contoso checklist on the Home screen (create the workspace, add documents, invite teammates, ask a first question; only Owners get the invite step). There is no step to connect models: a system administrator shares models with every workspace. It disappears once the steps are done, or when you choose Hide.

Nested departments

Workspaces can be arranged in a tree that mirrors your organisation chart, for example Contoso → Contoso Da Nang → Da Nang Warehouse. Only a system administrator builds the tree, on System administration → Workspaces. The tree changes nothing until the system administrator switches on what a parent passes down to the workspaces below it:

its admins can share knowledge bases and agents down to every workspace below, read-only;
its admins (or owners) get the same role in every workspace below, without being added as members;
its Analytics and Usage & cost can include the workspaces below;
its monthly budget also caps the workspaces below.

Admins and Owners see where their workspace sits in Settings → Workspace info → Place in the company tree. See System administration for how to set it up.

Shared spaces

To share a knowledge base or an agent with a workspace that is not below yours in the tree, use Shared spaces in the sidebar. An Admin creates a shared space, invites other workspaces into it, and then the knowledge base's creator or an Admin shares content into it. Sharing never raises anyone's role: a person from another workspace reads shared content with the permission the share gives, and document permissions still apply. See Document permissions.

Where settings live

Most settings are in Settings: open the account menu at the bottom of the sidebar and choose Settings. The left side lists the groups below; people see only the items their role allows.

Group	Items	Who sees them
Account	General, Profile, My memory, Sandbox secrets (where sandboxes are available)	Everyone, for their own account
Workspace	Workspace info, Members, Features, Analytics	Admins and Owners (only Owners change members)
Publish & integrations	IM channels, Website widget, MCP server, CLI	Admins and Owners
	API	Owners
System administration	Model management, Model catalog, Assistant & conversations, Web search, Data protection, Vector database, Storage, Sandbox, System settings, Users, Workspaces, Usage & cost, Email, Sign-in methods, Network & antivirus, Task queues, Platform API keys, Audit log, Version info	System administrators

Members (Viewers and Contributors) see only the Account group and no Toolbox in the sidebar. They just use Genie.
Admins and Owners run their workspace from the Workspace and Publish & integrations groups and from the sidebar (below). On Features they turn Web search and Run code on or off for everyone in the workspace. A greyed-out switch with "Turned off by your system administrators." means the company turned that feature off. Analytics has the Usage & cost and Routing tabs too; on Routing, admins review the questions Genie sent to the wrong place (see Review misrouted questions).
System administrators set what applies to every workspace under System administration (see The system administrator). When a workspace admin follows a shortcut to one of these pages, for example from the agent editor or a knowledge base's settings, Genie tells them to ask their system administrator.

Vector database, Storage and Task queues are maintained by your Genie provider, where your deployment shows them. Leave them as they are unless the provider asks you to change them.

The rest is managed where the content lives, from the sidebar:

Sidebar	What you manage there	Page
Knowledge	Knowledge bases, documents, folders, tags, data sources, document permissions	Knowledge bases, Data sources, Document permissions
Agents	Agents, their instructions, knowledge and tools, who may run them; Genie's own settings (Default assistant settings, in Genie's More actions menu)	Agents and the default assistant
Toolbox (Admins and Owners)	Skills, MCP services and Databases that agents can use	Sandbox and skills, Agents and the default assistant, Databases and Power BI
Shared spaces	Sharing knowledge bases and agents with other workspaces	Document permissions

Setting up a workspace

A typical order for a new department workspace, using Contoso as the example:

Sign-in. The system administrator connects Genie to Microsoft Entra ID (contoso.test), so people sign in with their Microsoft account, and maps Entra groups such as Contoso-HR to workspace roles. See Members and sign-in.
Members. The Owner invites the rest of the team and gives each person a role. Admins add attributes such as department = HR or branch = Da Nang where documents or data depend on them.
Knowledge. Create the knowledge bases people will ask about (Human resources, Operations, Sales) and upload documents. See Knowledge bases.
Data sources. Keep knowledge bases in sync with the systems you already use: the SharePoint site "Contoso HR", the file server \\files.contoso.test\Operations. See Data sources.
Permissions. Restrict sensitive folders, such as salary scales, to the people who need them. See Document permissions.
Business data. Connect Contoso ERP so people can ask about sales and stock. See Databases and Power BI.
Agents. Set up the default assistant and agents such as the HR assistant and the Sales assistant. See Agents and the default assistant.
Channels. Bring Genie into Microsoft Teams, Zalo or the intranet. See Teams, Zalo and the website widget.
Follow-up. Watch usage, ratings and knowledge gaps to see what to improve. See Usage, analytics and audit.

Good to know

Roles are checked by the Genie server on every request. Hiding a button is not what protects your data; the role and the document permissions are.
Roles apply per workspace. Removing someone from one workspace does not affect their other workspaces or their account; disabling the account is a system administrator task.
Owners cannot be given an access end date. Use end dates for temporary members such as auditors or contractors.
Deleting a workspace cannot be undone from the app. Members lose access to its knowledge bases, agents and API keys at once.
When a Contributor leaves, the knowledge bases and agents they created stay in the workspace; Admins and Owners can keep managing them.
The Members page has a short Role permissions summary of the same rules, handy to show to new admins.

Administration overview ​

Who does what ​

Roles ​

The system administrator ​

Workspaces ​

Nested departments ​

Shared spaces ​

Where settings live ​

Setting up a workspace ​

Good to know ​

Related pages ​