App management - Workspace access
Last updated
Last updated
The Workspace access feature allows an Organization admin to control which apps are available in the workspaces of an organization.
With this configuration, an Organization admin can make an app available to all workspaces by default, or allow/exclude specific workspaces by using Workspace exceptions.
Workspace access defines whether an app can be used in the workspaces of an organization.
This setting controls app availability at the workspace level. It does not replace user-level permissions or workspace roles.
For example:
If a workspace is granted access to an app, the Workspace owner can manage the app within that workspace.
If a workspace is not granted access to an app, the app will not be available for use in that workspace.
Use Workspace access when an Organization admin wants to:
Make an app available to all workspaces in the organization.
Allow only specific workspaces to use an app.
Exclude specific workspaces from accessing an app.
Manage app availability based on the organization’s internal policy.
Control which apps can appear and be used in each workspace.
Only users with the Organization admin role or the required app management permission can configure Workspace access.
Organization admins can:
Access the app management page.
Enable or disable Default all workspace access.
Add workspaces to Workspace exceptions.
Control which workspaces can or cannot access an app.
In OXU Admin, go to:
Apps → Management
The system displays the list of apps available in the organization.
Find the app you want to configure and select Manage.
For example, select Manage for the KMS app.
On the app management page, select the Workspace access tab.
From this tab, Organization admins can configure app availability for workspaces in the organization.
Workspace access includes two main settings:
When Default all workspace access is enabled, the app is available to all workspaces by default.
This means:
All workspaces in the organization can access the app.
Workspace owners can see and manage the app in their workspace.
If some workspaces should not use the app, the Organization admin must add those workspaces to Workspace exceptions.
In this case, Workspace exceptions act as a list of excluded workspaces.
Example:
The Organization admin can enable Default all workspace access, then add HAPPY_002 to Workspace exceptions.
When Default all workspace access is disabled, the app is not available to any workspace by default.
This means:
No workspace can access the app unless it is explicitly allowed.
If a workspace needs to use the app, the Organization admin must add that workspace to Workspace exceptions.
In this case, Workspace exceptions act as a list of allowed workspaces.
Example:
The Organization admin can disable Default all workspace access, then add HAPPY_001 to Workspace exceptions.
Result: only HAPPY_001 can use KMS.
In the Workspace exceptions section, select the Select workspace field.
Select the workspace that should be added as an exception.
The effect depends on the current Default all workspace access setting:
If default access is enabled, the selected workspace will be excluded from accessing the app.
If default access is disabled, the selected workspace will be allowed to access the app.
After adding workspace exceptions, the Organization admin should review:
The status of Default all workspace access.
The list of workspaces in Workspace exceptions.
Which workspaces are allowed to access the app.
Which workspaces are not allowed to access the app.
After Workspace access is configured:
The app follows the organization’s workspace access policy.
Workspaces with access can use the app.
Workspaces without access cannot use the app.
Workspace owners can only manage the app in their workspace if the app is available for that workspace.
Workspace access controls app availability at the workspace level. It does not replace user permissions or workspace roles.
If the app should be available to most workspaces, enable Default all workspace access and only add exceptions for workspaces that should be excluded.
If the app should only be available to specific workspaces, disable Default all workspace access and add the allowed workspaces to Workspace exceptions.
An app being available in the organization does not mean it is automatically available in every workspace.
Workspace members can only use an app when their workspace has access to that app and they have the required permission to use it.
Default all workspace access
Default all workspace access is the default policy applied to workspaces in the organization.
The meaning of this setting depends on whether it is enabled or disabled.
The KMS app is enabled by default for all workspaces. However, workspace HAPPY_002 should not be allowed to use KMS.
Result: KMS is available to all workspaces except HAPPY_002.
The KMS app should only be available in workspace HAPPY_001.
Workspace exceptions
Workspace exceptions are workspaces that follow a different access rule from the organization’s default policy.
The meaning of Workspace exceptions depends on the status of Default all workspace access.
Enabled
Workspaces in the exceptions list cannot access the app
Disabled
Workspaces in the exceptions list can access the app