System administration
System administration is for the customer's system administrator: the IT person who looks after Genie for the whole company, across every workspace. It covers the models every workspace uses, how Genie works in every workspace, user accounts, the workspace tree, platform-wide settings, sign-in methods, the model catalog and platform API keys. You find it in Settings, in the System administration group, which only system administrators see. Workspace owners and admins manage their own workspace from the other groups of Settings and do not need this page.
The group lists these pages, in this order: Model management, Model catalog, Assistant & conversations, Web search, Data protection, Vector database, Storage, Sandbox, System settings, Users, Workspaces, Usage & cost, Email, Sign-in methods, Network & antivirus, Task queues, Platform API keys, Audit log and Version info. A page your deployment does not offer is not shown.
System administrators
A system administrator manages the platform, not a workspace. The role is separate from the workspace roles:
| Workspace Owner | System administrator | |
|---|---|---|
| Scope | One workspace | The whole Genie platform |
| How someone gets it | By creating the workspace, or from another Owner | Granted by another system administrator |
| What they manage | Members, roles, settings and content of their workspace | Models; Genie's limits, memory, search, web search, data protection and running code for every workspace, with exceptions for one workspace; each workspace's search services, vector database, storage and sandbox configurations; accounts, the workspace tree, sign-in methods, platform settings, budgets, email, network and antivirus rules, the platform audit log |
One does not imply the other. Being a system administrator does not make you a member of every workspace: to read a workspace's knowledge bases, you still need to be a member of it. Your Genie provider sets up the first system administrator when Genie is installed.
To grant or revoke the role:
- Open Settings → System settings → Accounts & access.
- Under System administrators:
- To grant: type the person's email, press Enter, and confirm with Promote. The person must already have a Genie account.
- To revoke: click × on their tag and confirm with Revoke.
You do not appear in the list, so you cannot revoke yourself, and the last system administrator cannot be revoked. Every grant and revocation is recorded in the platform Audit log. Keep at least two system administrators, one of them a password account with two-step verification, so you can still get in if single sign-on fails.
Users
Settings → Users lists every account on the platform, with:
- User: name and email, with badges: System admin, SSO (signs in only with the company account), MFA (two-step verification is on).
- Workspaces: each workspace and role. Memberships created by the SSO workspace rules are marked SSO.
- Status (Active or Disabled), Last sign-in and Created.
Search by name or email, and filter by status. From each row, and from System settings → Accounts & access, you can do the following.
| Task | Where | Details |
|---|---|---|
| Create one account | System settings → Accounts & access → Create user | Create a user |
| Create many accounts | Users → Import CSV | Import users from a CSV file |
| Set a new password | System settings → Accounts & access → Reset user password | Reset a password |
| Lock someone out | Users → ⋯ → Disable | Disable an account |
| Remove two-step verification | Users → ⋯ → Reset MFA | Two-step verification |
| Delete a leaver and hand over their content | Users → ⋯ → Delete… | Transfer a leaving person's content |
| Answer a personal-data request | Users → ⋯ → Export data… or Erase conversations… | Privacy and retention |
Create a user
Use this when public registration is off and you open accounts yourself, for example for a contractor who signs in with a password.
- Open Settings → System settings → Accounts & access.
- At Create user, click Create user.
- Enter the Username (2 to 50 characters) and the Email.
- Keep Auto-generate a random password on, or turn it off and type a password that follows the password policy.
- Click Create user.
- A generated password is shown only now: click Copy account details, hand them over securely, then click I have saved the password.
Whether the new account gets a personal workspace follows Default workspace provisioning (see System settings). Otherwise, invite the person to a workspace. If the account already exists, Genie leaves it unchanged and says User already existed; no changes made.
For people who sign in with Microsoft Entra ID you do not need to create accounts: they are created at their first sign-in or by SCIM provisioning.
Reset a password
For someone who cannot sign in and cannot use Forgot password? (for example because Genie does not send email):
- Open Settings → System settings → Accounts & access.
- At Reset user password, click Reset password.
- Enter the User email, the New password and Confirm new password, then click Confirm reset.
All of that person's sessions end, and they sign in again with the new password. You cannot reset your own password here: change it on your Profile. Accounts that sign in with Microsoft, Active Directory or SAML change their password in your directory, not in Genie. A password reset does not remove two-step verification; use Reset MFA for that.
Workspaces
Settings → Workspaces lists every workspace on the platform as your company tree: each workspace sits under its parent. Search by name or workspace ID. The columns show the Workspace (with its ID and what it passes down), how many workspaces are Below it, and when it was Created. Each row has a Manage menu with Move…, Inheritance… and Apply template….
Workspaces are created by people from their account menu (Create new workspace), as long as Allow self-service workspace creation is on (see System settings). A workspace is deleted by its Owner from Workspace info → Delete workspace. Deleting a workspace never deletes the workspaces below it: they move up to its parent.
Nested departments
A company is rarely flat. Contoso has a head office and branches in Hanoi, Da Nang and Ho Chi Minh City. In Genie, each branch or department can be its own workspace, placed under a parent workspace, so the list mirrors the organization chart:
Contoso
├── Contoso Hanoi
├── Contoso Da Nang
└── Contoso Ho Chi Minh CityTo place a workspace under another one:
- Open Settings → Workspaces.
- In the row of the workspace (for example Contoso Da Nang), open Manage → Move….
- Choose the Parent workspace (Contoso), or Top level (no parent), and click Move.
The workspaces below it move with it. Genie refuses to put a workspace under itself or under one of its own children, and keeps the tree at most 6 levels deep. Admins and Owners see where their workspace sits in Settings → Workspace info → Place in the company tree, and the workspace switcher shows everyone their workspaces as a tree.
The tree changes nothing by itself. A parent passes something down only when you switch it on:
- In the row of the parent (Contoso), open Manage → Inheritance….
- Turn on what it should pass down to every workspace below it, then click Save.
| Switch | What it does for the workspaces below |
|---|---|
| Share knowledge bases and agents down, read-only | The parent's admins can share a knowledge base or an agent with the space named after the parent (shown as Child workspaces in the share dialog). Every workspace below can then search it, ask it and use it in agents, but never change it. Nothing is shared until the admins do. Siblings never see each other's knowledge bases. |
| Its admins administer the workspaces below (Off, Admin or Owner) | Admins and Owners of the parent get that role in every workspace below, without being added as members. Admin lets them manage settings, knowledge bases and agents there; Owner also members, API keys and deleting the workspace. |
| Roll up usage, cost and analytics | The parent's admins can tick Include the 3 workspace(s) below on Analytics (its Usage & cost tab included) to see the whole sub-tree. The questions, ratings and people of the workspaces below become visible to them. |
| Its budget caps the workspaces below | The parent's monthly budget counts what every workspace below uses too. When it runs out, all of them stop, even where their own budget is left. See Usage, analytics and audit. |
All switches are off by default and cover the whole sub-tree, including workspaces moved under the parent later. The tags Shares down, Admins → Admin, Roll-up and Budget cap on a row show what it passes down. Every move and every change is recorded in the platform Audit log and in the audit log of the workspaces concerned.
Document permissions still apply inside a shared knowledge base: people from a child workspace see only the documents their groups and attributes allow (see Document permissions). To give a role in a whole sub-tree to an Entra group, tick Sub-tree on an SSO workspace rule.
Apply a template
Set up a new department workspace from an existing one in a few clicks:
- In the row of the new workspace, open Manage → Apply template….
- Choose the Template workspace and click Apply.
Genie copies the template's knowledge bases (empty, with the same settings), its agents (pointed at the copies), the model choices of the built-in agents, and its retrieval and conversation settings. Documents are not copied. Settings that point at something only the template owns (its private models, sandboxes, MCP services or search services of its own) are cleared and listed under Cleared, check these settings. Items whose name already exists in the target are listed under Already here, skipped, so applying a template twice is harmless.
System settings
Settings → System settings holds the platform-wide settings. A save applies at once to every workspace. The settings are grouped in tabs; this section covers the ones you act on.
A setting saved on this page shows the Overridden badge. Reset on its row removes your value and goes back to the default your Genie provider set.
Accounts & access
Besides System administrators, Reset user password, Disable or re-enable an account and Create user (see above), this tab holds:
| Setting | What it does for users |
|---|---|
| Registration mode | Self-service (anyone can register): anyone who reaches Genie can create an account. Invitation registration (valid link required): only people with an invite link or an invitation can. Registration disabled (existing accounts can accept invitations): nobody can sign up; an emailed invitation still lets that person create their account. It also decides whether a first sign-in with Microsoft creates an account, unless the sign-in method says otherwise. |
| Email verification of sign-ups | Required (confirm the email before the first sign-in): someone who signs up by themselves must open a link sent to their email before they can sign in; the link works once, for 24 hours. Off (sign in right after signing up). It applies only while outgoing email is set up. Accounts created by an administrator, through single sign-on or with an invitation need no check. |
| Require complex password | New and changed passwords must contain upper- and lowercase letters, digits and special characters. Existing passwords are not affected until they change. |
| Two-step verification for password sign-ins | Who must use an authenticator app after their password: Optional (each person decides), Required for admins or Required for everyone. See Two-step verification. |
| Remember a browser after two-step verification (days) | How many days a browser may skip the code. 0 turns it off. |
| Single sign-on session length (hours) | How long a Microsoft (or SAML) sign-in lasts before Genie checks with the identity provider again. Also on Sign-in methods. |
| Default workspace provisioning | Create personal workspace gives each new account its own workspace. Do not create a workspace leaves new people without one until they are invited or placed by the SSO workspace rules. For a company rollout, choose Do not create a workspace. |
| SSO workspace rules | Place people in workspaces by their Entra ID groups or app roles. See Group-to-role mapping. |
| SSO profile attributes | Store job title, department and office from Entra ID on each person. See SSO profile attributes. |
| Allow self-service workspace creation | Off: people can only join workspaces they are invited to, and cannot create their own. |
| Max workspaces owned per user | The most workspaces one person may create. 0 means the built-in limit of 10. |
Switching Registration mode to self-service asks you to confirm, because anyone who can reach your Genie could then create an account.
Workspace defaults
| Setting | What it does for users |
|---|---|
| Default storage quota for new workspaces (GB) | Storage given to each new workspace. Existing workspaces keep theirs, unless you click Apply to all existing workspaces. |
| Auto-join invited registered users | On: inviting someone who already has an account adds them at once, without waiting for them to accept. |
| Automatically create an API key for new workspaces | For old integrations only. Leave it off; workspace Owners create API keys under API (see API keys and the API). |
New workspaces also start with the company's values from Assistant and conversations.
Security & privacy
This tab holds the platform limits for conversation and document retention, the antivirus policy, and the SSRF protection allowlist of internal hosts Genie may connect to. They are explained where they are used: Privacy and retention, Knowledge bases and Network and antivirus.
Enable Docker sandbox and the Background tasks tab are technical settings that belong to your Genie provider. Leave them as they are unless your Genie provider asks you to change them.
Other
Advanced settings.
| Setting | What it does |
|---|---|
| Gallery image attributes (advanced) | Image attributes the Gallery filters, searches and sorts by, such as text in the image or charts. Leave it empty for the default. |
Assistant and conversations
Settings → Assistant & conversations, right below Model catalog, sets once for the whole company how Genie works in every workspace. Workspace owners and admins no longer change these settings; they just use them. The page has four parts:
| Part | What it sets | Details |
|---|---|---|
| Genie's limits and routing | Steps per answer, Time per answer, Tokens per answer, Time per lookup, Look further when documents are not enough and Use route cards | Limits and routing |
| Long-term memory | Whether Genie remembers what people tell it, how memories are written and which models it uses | Long-term memory |
| Message Management | Whether messages are indexed so that conversation search finds them by meaning, and the embedding model | Message management |
| Search Settings | How Genie searches knowledge bases and messages: the rerank model, how many passages it keeps, the thresholds and hybrid search | Search settings |
Each workspace still picks Genie's sources and specialist agents itself, in Default assistant settings on the Agents page (see Agents and the default assistant). Conversation retention is on System settings (see Privacy and retention).
How saving works:
- Genie's limits and routing: change the values and click Save changes. Genie confirms how many workspaces received them, for example Saved and applied to 12 workspaces.
- The other three parts save each change as soon as you make it.
- A save writes the whole part into every workspace, and workspaces created later start with it. Until a part is saved for the first time, each workspace keeps the values it had and the page shows Genie's defaults, so check every setting of a part before you change one of them.
- A workspace can keep its own values as an exception. Under each part, Workspaces with their own setting lists them: click Add a workspace, pick it and set its own values in the panel that opens. Saving the company's value skips these workspaces. Edit changes a workspace's own values, and Use the company's value puts it back. You do not need to be a member of that workspace.
- Every save is recorded in the platform Audit log as System setting changed.
Search settings
Search Settings tunes how Genie finds passages in knowledge bases and in past messages, for every workspace. The defaults suit most companies: change one value at a time, then try a few real questions.
| Setting | What it does |
|---|---|
| Rerank Model | Re-orders the passages found so the most relevant come first. Required: search needs it |
| Vector Search Top K | How many passages the search by meaning brings back, 1 to 100 |
| Vector Similarity Threshold, Keyword Match Threshold | How close a passage must be, from 0 to 1, to count as found by its meaning or by its words. Higher values find fewer, closer passages |
| Rerank Top K | How many passages are kept after reranking, 1 to 100 |
| Rerank Threshold | The lowest rerank score a passage needs to be kept, from -10 to 10 |
| Hybrid search (Qdrant) | For knowledge bases whose vectors live in Qdrant: Keyword search (Qdrant native hybrid search (recommended) or ParadeDB BM25), Fusion (how word and meaning results are merged), Diversity (MMR) (fewer top results from the same document) and In-query boosts (expired documents ranked lower, recently updated documents and documents matching the asker's profile slightly higher) |
In the Search box (⌘K on Mac, Ctrl+K on Windows), system administrators also get a gear that opens the same Search Settings. Nobody else sees it.
Web search
Settings → Web search, right below Assistant & conversations, sets up Genie Search (the web search every workspace uses) and sets for the whole company whether to search the web, the searches per question, the results per search and the sites to avoid or prefer. Exceptions for one workspace work as on Assistant & conversations. At the bottom, Search services of a workspace adds search services of its own to the workspace you pick, tried in order; Genie Search still answers in every workspace. See Web search settings.
When web search is on for the company, each workspace's admins can still turn it off for their workspace under Settings → Features. When you turn it off, it is off in every workspace that has no setting of its own, and their switch shows Turned off by your system administrators. Running code works the same way, from Sandbox (see Settings of one workspace).
Settings of one workspace
Most of what a system administrator sets applies to every workspace. When one workspace needs something else, give it its own value. The workspace's Owners and Admins do not see these settings; they just use them.
| What | Where | Details |
|---|---|---|
| Genie's limits, long-term memory, message search and search settings | Assistant & conversations: Workspaces with their own setting, under each part | Assistant and conversations |
| Web search | Web search: Workspaces with their own setting | Web search settings |
| The workspace's own search services | Web search → Search services of a workspace | A workspace's own search service |
| Fallback models and personal data masking | Data protection: Workspaces with their own setting | Models and data protection |
| Whether code may run | Sandbox → Running code in every workspace: Workspaces with their own setting | Sandbox and skills |
| The workspace's sandbox configurations | Sandbox | Sandbox and skills |
| The workspace's vector database and storage | Vector database, Storage | Maintained by your Genie provider |
| What code in the System default sandbox may reach | Network & antivirus → System default sandbox network → Per workspace | Network and antivirus |
| The workspace's monthly budget | Usage & cost → Workspaces, on the workspace's row | Budgets |
| The workspace's own default budget per member, instead of the company's | Analytics → Usage & cost → Set an exception, in that workspace | Budgets |
| The networks the workspace may be used from | Workspace info → Network access, in that workspace | Network and antivirus |
On Search services of a workspace, Vector database, Storage and Sandbox, choose the workspace in the Workspace box at the top: the settings below it apply to that workspace only. You do not need to switch to the workspace or be a member of it, and the same is true for every row except the last two. Those are set inside the workspace:
- Open the account menu at the bottom of the sidebar and pick the workspace under Switch workspace.
- Open Settings → Analytics or Workspace info. You need to be an Admin or Owner of that workspace to see these pages: being a system administrator does not make you a member of every workspace (see System administrators).
A workspace's admins have only one control over these settings: under Settings → Features they can turn Web search and Run code off for their workspace, as long as the system administrators have them on. When a workspace admin follows a shortcut to a page that only system administrators may change, Genie tells them to ask their system administrator instead.
Sign-in methods
Settings → Sign-in methods lets people sign in with their company account instead of a Genie password. It has three tabs:
- OpenID Connect: Microsoft Entra ID (or Keycloak, Google Workspace, Okta). The sign-in page shows a Sign in with Microsoft button.
- LDAP / Active Directory: an on-premises domain. The sign-in page gets a Company account tab.
- SAML 2.0: AD FS, Okta or another SAML identity provider. The sign-in page gets a Continue with … button.
Above the tabs, Sign in again through the identity provider after sets how long a single sign-on lasts. Step-by-step setup, group-to-role mapping and SCIM provisioning are on Members and sign-in.
Model catalog
The model catalog is the list of model names that system administrators pick from when they add a model in Model management, with defaults such as the context window and reasoning support. A change here applies at once, but never rewrites a model that is already saved.
Open Settings → Model catalog, right below Model management. The Source column shows where each entry comes from: Built-in (shipped with Genie), Deployment (set by your Genie provider) or Admin change (made on this page). Tick Modified only to see your own changes.
- Hide a model from the picker: click Edit on its row, turn on Hide from picker, and click Save and apply. Models already added keep working.
- Correct a default, such as the Context window or Max output: click Edit, change the value, and click Save and apply. Restore defaults removes your changes for that model.
- Add a model the catalog does not list yet: click Add model, choose the provider, and enter the Model ID the provider uses and a Display name.
- Undo a change: open More → Version history. The last 20 versions are kept; Restore applies one at once.
More → Edit JSON edits all your changes at once, for bulk changes. The models themselves, with their credentials, prices and defaults, are in Model management; the model data policy is on Models and data protection.
Platform API keys
Platform API keys let tools act across workspaces, such as Microsoft Entra ID provisioning accounts with SCIM, or your own automation. They are not tied to one workspace; the capabilities you choose limit what each key can do. (Keys for one workspace are created by its Owner under API; see API keys and the API.)
To create one:
- Open Settings → Platform API keys and click Create platform API key.
- Enter a Name that says what it is for, for example
Entra ID provisioning. - Under Capabilities, tick only what the tool needs. For SCIM, tick only SCIM provisioning.
- Create the key and click Copy key. The full key is shown only once.
The list shows each key's capabilities, when it was Last used and when it was created. Deleting a key stops every tool that uses it at once. Creating and deleting keys is recorded in the platform Audit log.
Version info
Settings → Version info (the last item of the System administration group) shows which Genie version runs: App Version and UI Version, when it was built, when the service last started and for how long it has been running, and the Database Version. Only system administrators see it.
Give these values to your Genie provider when you report a problem. If Mismatch with app version or Migration failed appears, ask your Genie provider.
Other System administration pages
| Page | What it is for | Explained in |
|---|---|---|
| Model management | The models every workspace uses, their prices and the default of each type, the model for background tasks, voice input in chat and moving the knowledge bases of every workspace to another embedding model | Models and data protection |
| Data protection | Which models may receive data from sensitive knowledge bases, the fallback models and personal data masking every workspace uses, and the models the policy blocks in every workspace | Models and data protection |
| Sandbox | Whether code may run in every workspace, and the sandbox configurations of the workspace you pick | Sandbox and skills |
| Usage & cost | Usage and cost of every workspace, the company's default budget per member, and the monthly workspace budgets | Usage, analytics and audit |
| Outgoing email for invitations, password reset links and reminders | Privacy and retention | |
| Network & antivirus | IP allowlist, virus scanning of uploads and the network of the System default sandbox | Network and antivirus |
| Audit log | Platform events: sign-ins, setting changes, accounts created, disabled and deleted, system administrators granted | Usage, analytics and audit |
Vector database, Storage and Task queues are maintained by your Genie provider. Leave them as they are unless the provider asks you to change them.
Good to know
- Only system administrators see the System administration group. A workspace Owner cannot change models, platform settings, other people's accounts, or the search services, data protection, network access, vector database, storage and sandbox configurations of their workspace. Under Features they can only turn web search and running code off.
- Platform settings apply to every workspace at once. Change them outside working hours when they affect sign-in, and tell workspace owners beforehand.
- You cannot disable, delete or reset the password of your own account here, and a system administrator must lose that role before their account can be disabled or deleted.
- Generated passwords and API keys are shown only once. Hand them over through a secure channel.
- Disabling an account is reversible; deleting it is not. Disable first, delete when the handover is settled.
- Changes to accounts, system administrators, platform settings, Assistant & conversations, the workspace tree, sign-in methods and platform API keys are recorded in the platform Audit log.