App management - Workspace access
The Workspace access feature allows an Organization admin to control which apps are available in the workspaces of an organization.
With this configuration, an Organization admin can make an app available to all workspaces by default, or allow/exclude specific workspaces by using Workspace exceptions.
What is Workspace access?
Workspace access defines whether an app can be used in the workspaces of an organization.
This setting controls app availability at the workspace level. It does not replace user-level permissions or workspace roles.
For example:
If a workspace is granted access to an app, the Workspace owner can manage the app within that workspace.
If a workspace is not granted access to an app, the app will not be available for use in that workspace.
When to use Workspace access
Use Workspace access when an Organization admin wants to:
Make an app available to all workspaces in the organization.
Allow only specific workspaces to use an app.
Exclude specific workspaces from accessing an app.
Manage app availability based on the organization’s internal policy.
Control which apps can appear and be used in each workspace.
Access permission
Only users with the Organization admin role or the required app management permission can configure Workspace access.
Organization admins can:
Access the app management page.
Enable or disable Default all workspace access.
Add workspaces to Workspace exceptions.
Control which workspaces can or cannot access an app.
How to access Workspace access
Step 1: Open App management
In Oten Admin, go to:
Apps → Management
The system displays the list of apps available in the organization.
Step 2: Select an app to manage
Find the app you want to configure and select Manage.
For example, select Manage for the KMS app.
Step 3: Open the Workspace access tab
On the app management page, select the Workspace access tab.
From this tab, Organization admins can configure app availability for workspaces in the organization.
Workspace access configuration
Workspace access includes two main settings:
Default all workspace access
Default all workspace access is the default policy applied to workspaces in the organization.
The meaning of this setting depends on whether it is enabled or disabled.
Workspace exceptions
Workspace exceptions are workspaces that follow a different access rule from the organization’s default policy.
The meaning of Workspace exceptions depends on the status of Default all workspace access.
Default all workspace accessMeaning of Workspace exceptionsEnabled
Workspaces in the exceptions list cannot access the app
Disabled
Workspaces in the exceptions list can access the app
Case 1: Default all workspace access is enabled
When Default all workspace access is enabled, the app is available to all workspaces by default.
This means:
All workspaces in the organization can access the app.
Workspace owners can see and manage the app in their workspace.
If some workspaces should not use the app, the Organization admin must add those workspaces to Workspace exceptions.
In this case, Workspace exceptions act as a list of excluded workspaces.
Example:
The KMS app is enabled by default for all workspaces. However, workspace HAPPY_002 should not be allowed to use KMS.
The Organization admin can enable Default all workspace access, then add HAPPY_002 to Workspace exceptions.
Result: KMS is available to all workspaces except HAPPY_002.
Case 2: Default all workspace access is disabled
When Default all workspace access is disabled, the app is not available to any workspace by default.
This means:
No workspace can access the app unless it is explicitly allowed.
If a workspace needs to use the app, the Organization admin must add that workspace to Workspace exceptions.
In this case, Workspace exceptions act as a list of allowed workspaces.
Example:
The KMS app should only be available in workspace HAPPY_001.
The Organization admin can disable Default all workspace access, then add HAPPY_001 to Workspace exceptions.
Result: only HAPPY_001 can use KMS.
How to add Workspace exceptions
Step 1: Select workspace
In the Workspace exceptions section, select the Select workspace field.
Step 2: Choose a workspace
Select the workspace that should be added as an exception.
The effect depends on the current Default all workspace access setting:
If default access is enabled, the selected workspace will be excluded from accessing the app.
If default access is disabled, the selected workspace will be allowed to access the app.
Step 3: Review the configuration
After adding workspace exceptions, the Organization admin should review:
The status of Default all workspace access.
The list of workspaces in Workspace exceptions.
Which workspaces are allowed to access the app.
Which workspaces are not allowed to access the app.
Result after configuration
After Workspace access is configured:
The app follows the organization’s workspace access policy.
Workspaces with access can use the app.
Workspaces without access cannot use the app.
Workspace owners can only manage the app in their workspace if the app is available for that workspace.
Notes
Workspace access controls app availability at the workspace level. It does not replace user permissions or workspace roles.
If the app should be available to most workspaces, enable Default all workspace access and only add exceptions for workspaces that should be excluded.
If the app should only be available to specific workspaces, disable Default all workspace access and add the allowed workspaces to Workspace exceptions.
An app being available in the organization does not mean it is automatically available in every workspace.
Workspace members can only use an app when their workspace has access to that app and they have the required permission to use it.
Last updated