Workspace Settings
Configuration that applies across your whole workspace rather than to one connection. Find it at Dashboard → Settings.
Organization
| Setting | What it does |
|---|---|
| Organization name | Your workspace's display name |
| Support contact email | Where your users are directed for help |
Preferences
| Setting | What it does |
|---|---|
| Timezone | The timezone timestamps are displayed in — Audit Log, Sessions, Metrics |
| Locale | Formatting for dates and numbers |
Worth setting the timezone early. Investigating an audit trail is materially harder when every timestamp needs mental conversion.
Access
Controls how people become members of your workspace.
Member provisioning
How new members join. Either you invite everyone explicitly, or members are created automatically when they first sign in successfully.
Automatic provisioning suits Tenant Delegated and Token Exchange connections, where your own directory or identity provider is already the gate — anyone who can authenticate there is someone you've decided should have access.
Explicit invitation gives tighter control and suits Identity Brokering, where LockMCP holds the accounts.
With automatic provisioning, anyone who can authenticate becomes a member. That's only as safe as your upstream directory — make sure the role they land in grants the minimum you're comfortable with. See Roles and Permissions.
Delegated role mapping
For Tenant Delegated connections, maps your application's role names onto LockMCP roles, so people arrive with the right access automatically.
Unmapped role names from your app are ignored — they don't fall back to a default. A user whose only role isn't mapped signs in successfully and can call nothing, which is a common and confusing failure. Keep the mapping current as your app's roles change.
Notifications
| Setting | What it does |
|---|---|
| Alert email | Where workspace alerts are sent |
| New member joins | Notify when someone joins |
| Signing key expiry warnings | Warn before a signing key expires |
Leave signing key expiry warnings on. An expired signing key stops authentication working, and the warning is the thing that prevents it becoming an outage. See Security.
Point the alert email at a monitored address — ideally a shared inbox rather than one person, so it survives holidays and departures.
Plan and billing
Settings → Plan covers your current plan, usage, and billing history. You can change plan from here, and enterprise arrangements are handled through Contact sales.
Usage is tracked against your plan's allowances. Reviewing it alongside Metrics tells you whether growth in tool calls is trending toward a plan change.
Where these settings apply
Settings here are workspace-wide — they affect every connection.
Per-connection configuration lives in the connection itself: identity model, base URL, credentials, and the onboarding wizard. See Create a Connection.
| Configure | Where |
|---|---|
| Organization name, timezone, notifications | Settings |
| How members join, delegated role mapping | Settings → Access |
| Plan and billing | Settings → Plan |
| Identity model, endpoints, credentials | The connection's wizard |
| Tool publishing and access | Tool Catalog |
| Members and roles | Members & Access |
Where to go next
- Roles and Permissions — what members can do once they join
- Security — keys, encryption and rotation
- Monitoring & Audit — what's happening in the workspace