Skip to main content
Enterprise settings are the central configuration area for your ZEDEDA organization. From here, you control your enterprise identity, single sign-on configuration, session policy, certificate enrollment profiles, third-party integrations, and data streaming pipelines.

​
Prerequisites

  • You have the SysAdmin role in your enterprise. See Manage Roles.

​
How It Works

Enterprise settings are organized into a left-navigation sidebar with the following groups. Access them by selecting your profile avatar in the header, then selecting Enterprise Settings.

​
General: Settings

The Settings section has two cards. Identity configures your enterprise’s display and authentication properties: For parent enterprises, the Identity card also displays a read-only Child Enterprises table listing each child enterprise by name and its authentication profile inheritance status. Organization Overview is a read-only summary card showing current counts for users, projects, nodes, apps deployed, and active alerts, along with the enterprise creation date.

​
General: Branding

Branding lets you customize how your enterprise appears across the platform. You can upload a product logo (PNG, JPG, SVG, or WebP; maximum 1 MB; recommended dimensions approximately 200 × 60 pixels), set a product name, and choose a brand color. An experimental option applies the brand color to primary surfaces across the console, including buttons, tabs, sidebar navigation, and focus rings.

​
General: Alert Location

Alert Location sets where in-app toast notifications appear on screen. Select one of the following positions: Top Left, Top Center, Top Right, Bottom Left, Bottom Center, or Bottom Right. The default is Bottom Right. The new position takes effect immediately. There is no separate save step, and you do not need to reload the console. Alert Location is a personal preference rather than an enterprise-wide setting: it applies to your own account, is saved to it, and follows you to any browser you sign in from. It does not change the alert position for other users in your enterprise. Alert Location controls only where toast notifications appear. To choose which notifications you receive by email or text message, use Profile Settings > Preferences > Notifications. See Profile Settings.

​
Security & Access: Authentication

The Authentication section contains the following cards: Single Sign-On connects an external identity provider using OpenID Connect (OIDC) with either OAuth or SAML as the authentication type. When authentication profile inheritance is enabled in Settings, this card shows an “Inherited from parent” banner and the fields are read-only. See Enable Single Sign-On for the full procedure. Two-Factor Authentication contains:
  • Enforce For Current Enterprise: Requires all users in this enterprise to set up time-based one-time password (TOTP) 2FA. If a parent enterprise already enforces 2FA, this toggle is locked and reads as inherited.
  • Enforce For Child Enterprise: Available only to parent enterprises with child enterprises. Extends 2FA enforcement to all child enterprises.
See Configure Two-Factor Authentication for the full procedure. Sessions sets the session token expiry duration. You can configure the value in hours, days, or months. Content Visibility provides a toggle to hide sensitive content from users based on their role permissions.

​
Security & Access: Network Access

The Network Access section contains the Certificate Enrollment Profiles list. Certificate enrollment profiles define Simple Certificate Enrollment Protocol (SCEP) configurations used for 802.1X port-based network access control on nodes. See Certificate Enrollment Profiles for the full procedure.

​
Connections: Integrations

Integrations connect Edge Infrastructure Services to external platforms for event forwarding, remote orchestration, and monitoring. Supported integration types are:
  • Data integrations: Splunk (HTTP Event Collector), OpenTelemetry.
  • Remote orchestration: Rancher, VMware Cloud Orchestrator, VMware Tanzu Mission Control.
You configure each integration with a name, category, type, and type-specific connection settings such as tokens, endpoints, and TLS options.
Two remote orchestration types require an entitlement. Rancher requires the Rancher Integration entitlement and VMware Tanzu Mission Control requires the Tanzu Integration entitlement. Without the entitlement, the type does not appear in the Type list when you add an integration, and it does not appear in the Filter by Type menu on the integrations list. VMware Cloud Orchestrator is not gated and is always available. Entitlements are set per enterprise and must also be enabled at the root enterprise. See Admin Dashboard.

​
Connections: Data Streams

Data streams define pipelines that export platform data to a connected integration. Each stream specifies a data source type (Application Logs, Events, or Metrics), an optional linked integration, and an enabled state. You can pause and re-enable streams without deleting them.

​
Key Benefits

  • Centralizes all enterprise-level configuration in a single location.
  • Single sign-on (SSO) inheritance lets child enterprises reuse a parent’s identity provider without separate configuration.
  • 2FA enforcement at the enterprise level cascades to all users, including those in child enterprises.
  • Data streams and integrations enable real-time export of platform events and metrics to external SIEM, observability, and orchestration tools.

​
Next Steps

Enable Single Sign-On

Connect an OIDC, OAuth, or SAML identity provider.

Configure Two-Factor Authentication

Enforce 2FA across your enterprise.

Create Child Enterprises Using ZCLI

Provision sub-tenants for customers or managed environments (dedicated cluster deployments only).

Certificate Enrollment Profiles

Create SCEP profiles for 802.1X network access control.

Manage Roles

Define user permissions.

Manage Users

Invite and manage users.