Workspace Settings

Settings → General starts with three workspace-wide switches. Owners and admins change them; everyone else sees them read-only. Platform staff change a customer’s settings from the admin console, not here. Every change is recorded in the audit log (workspace.settings.update).

Below them are personal switches that only affect you: your own two-factor authentication (managed in Profile), SCIM provisioning, the weekly fleet digest and email alerts.

Require 2FA for all members

When it’s on, a member who has neither TOTP nor a security key:

• is sent to Profile → Security right after signing in, with a banner explaining why;
• gets 403 {"error": "mfa_enrollment_required"} from the rest of the workspace API until they enrol.

They can still set up 2FA, see their profile, and switch to or leave the workspace. Their other workspaces are not affected.

The setting can’t lock owners out:

• You can only turn it on once your own account has two-factor authentication.
• It is only enforced while at least one owner of the workspace has 2FA. If no owner has it (for example, the only owner turned theirs off), the switch stays on but shows not enforced.

Staff impersonation sessions are not blocked; staff follow the platform’s own MFA policy.

Record terminal sessions

When it’s on, every terminal session opened on one of the workspace’s nodes through the Control Center is stored as an asciicast v2  transcript: what the node printed and every window resize, with timing. Keystrokes are not stored separately (what you type shows up only as far as the shell echoes it; passwords typed at a prompt are not echoed).

• Transcripts are kept for 30 days, then deleted.
• A single session is capped at 5 MB; beyond that the recording stops and is marked truncated.
• Owners, admins and platform staff (whoever may open the terminal, plus staff) see them on the node page: Fleet → node → Terminal → Recorded sessions, with the user, start time, length and size. Click one to replay it (play/pause, 1×/2×/4×, long pauses shortened) or download the .cast file for asciinema play.

Managers and viewers don’t see the recordings. Staff can’t open a shell from an impersonation session, so recordings always name the workspace member who opened the session.

Allow agent auto-update

Nodes check for Cloud OS updates and install them on the auto-update schedule set on the node (the Updates page in Cloud OS). This switch decides whether they may do that for this workspace:

• By default the workspace follows the platform default (set by Quazzar staff). The row says which one applies.
• Turning it on or off sets a workspace override. Use the platform default removes the override.
• When it’s off, nodes skip their scheduled automatic updates. Updates still happen when you run them yourself: from the node’s own UI, or from the Control Center with Staged Rollouts and Fleet Operations.

The setting reaches each node with its next heartbeat (every 30 seconds). When the workspace turns them off, the node’s Updates page says so above its schedule (and GET /api/updates/schedule on the node reports fleet_auto_update_allowed: false). Nodes connected to an older Control Center keep their own schedule.

API

The sign-in response (/api/auth/login), /api/auth/me and the workspace switch response carry "mfa_enrollment_required": true when the member must enrol first.