Admin

General settings

Changes apply right away. A setting left at its default follows the value in wrangler.jsonc.

App name

Shown in the UI, share messages and authenticator apps.

Default link lifetime (minutes)

Preselected when an agent creates a link. 5–1440.

Reconnect window (hours)

How long a connected onsite device can rejoin after its link expires. 1–24.

Agent sign-in length (hours)

Applies to new sign-ins. 1–720.

Data retention (days)

Sessions and snapshots older than this are deleted daily. 1–3650.

Require two-factor authentication for all agents

Everyone, admins included, must set up an authenticator app or a passkey before they can use the app. Accounts without one are sent to their profile to set it up after they sign in.

Agents

Name	Email	Role	Last sign-in

Single sign-on (Microsoft Entra ID)

Agents sign in with their work account, and their role comes from Entra ID. Setup steps are in the README under Single sign-on with Microsoft Entra ID.

Allow sign-in with single sign-on

Issuer URL

Use the Directory (tenant) ID from the app registration's Overview page.

Client ID

The Application (client) ID from the same page.

Client secret

Stored as a Worker secret: npx wrangler secret put OIDC_CLIENT_SECRET

Redirect URI

Add this as a Web redirect URI in the app registration.

Button label

The login page shows "Sign in with …".

Role mapping

Claim

roles for app roles (recommended); groups for group object IDs.

Admin values

App role values or group IDs, separated by commas.

Agent values

People matching neither list can't sign in.

Create accounts automatically on first sign-in

When off, an admin must add the agent first (matched by email).

Allow password sign-in

When off, only admins can still sign in with a password, as a way back in if single sign-on stops working.

General settings

Agents

Single sign-on (Microsoft Entra ID)

Role mapping

Add agent

Edit agent

Account

Bulk import agents