> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/identity-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/identity-support/user-guide/organization-admin-app/app-management-workspace-access.md).

# App management - Workspace access

The **Workspace access** feature allows an Organization admin to control which apps are available in the workspaces of an organization.

With this configuration, an Organization admin can make an app available to all workspaces by default, or allow/exclude specific workspaces by using **Workspace exceptions**.

***

### What is Workspace access?

**Workspace access** defines whether an app can be used in the workspaces of an organization.

This setting controls app availability at the workspace level. It does not replace user-level permissions or workspace roles.

For example:

* If a workspace is granted access to an app, the Workspace owner can manage the app within that workspace.
* If a workspace is not granted access to an app, the app will not be available for use in that workspace.

***

### When to use Workspace access

Use **Workspace access** when an Organization admin wants to:

* Make an app available to all workspaces in the organization.
* Allow only specific workspaces to use an app.
* Exclude specific workspaces from accessing an app.
* Manage app availability based on the organization’s internal policy.
* Control which apps can appear and be used in each workspace.

***

### Access permission

Only users with the **Organization admin** role or the required app management permission can configure **Workspace access**.

Organization admins can:

* Access the app management page.
* Enable or disable **Default all workspace access**.
* Add workspaces to **Workspace exceptions**.
* Control which workspaces can or cannot access an app.

***

### How to access Workspace access

{% embed url="<https://app.supademo.com/demo/cmr0je5aj19pwqm4ifuc6dm9q?utm_source=link>" %}

#### Step 1: Open App management

In Oten Admin, go to:

**Apps → Management**

The system displays the list of apps available in the organization.

#### Step 2: Select an app to manage

Find the app you want to configure and select **Manage**.

For example, select **Manage** for the `KMS` app.

#### Step 3: Open the Workspace access tab

On the app management page, select the **Workspace access** tab.

From this tab, Organization admins can configure app availability for workspaces in the organization.

***

### Workspace access configuration

Workspace access includes two main settings:

1. **Default all workspace access**

   Default all workspace access is the default policy applied to workspaces in the organization.

   The meaning of this setting depends on whether it is enabled or disabled.
2. **Workspace exceptions**

   Workspace exceptions are workspaces that follow a different access rule from the organization’s default policy.

   The meaning of **Workspace exceptions** depends on the status of **Default all workspace access**.

   | Default all workspace access | Meaning of Workspace exceptions                         |
   | ---------------------------- | ------------------------------------------------------- |
   | Enabled                      | Workspaces in the exceptions list cannot access the app |
   | Disabled                     | Workspaces in the exceptions list can access the app    |

***

#### Case 1: Default all workspace access is enabled

When **Default all workspace access** is enabled, the app is available to all workspaces by default.

This means:

* All workspaces in the organization can access the app.
* Workspace owners can see and manage the app in their workspace.
* If some workspaces should not use the app, the Organization admin must add those workspaces to **Workspace exceptions**.

In this case, **Workspace exceptions** act as a list of excluded workspaces.

Example:

The `KMS` app is enabled by default for all workspaces. However, workspace `HAPPY_002` should not be allowed to use `KMS`.

The Organization admin can enable **Default all workspace access**, then add `HAPPY_002` to **Workspace exceptions**.

Result: `KMS` is available to all workspaces except `HAPPY_002`.

***

#### Case 2: Default all workspace access is disabled

When **Default all workspace access** is disabled, the app is not available to any workspace by default.

This means:

* No workspace can access the app unless it is explicitly allowed.
* If a workspace needs to use the app, the Organization admin must add that workspace to **Workspace exceptions**.

In this case, **Workspace exceptions** act as a list of allowed workspaces.

Example:

The `KMS` app should only be available in workspace `HAPPY_001`.

The Organization admin can disable **Default all workspace access**, then add `HAPPY_001` to **Workspace exceptions**.

Result: only `HAPPY_001` can use `KMS`.

***

### How to add Workspace exceptions

#### Step 1: Select workspace

In the **Workspace exceptions** section, select the **Select workspace** field.

***

#### Step 2: Choose a workspace

Select the workspace that should be added as an exception.

The effect depends on the current **Default all workspace access** setting:

* If default access is enabled, the selected workspace will be excluded from accessing the app.
* If default access is disabled, the selected workspace will be allowed to access the app.

***

#### Step 3: Review the configuration

After adding workspace exceptions, the Organization admin should review:

* The status of **Default all workspace access**.
* The list of workspaces in **Workspace exceptions**.
* Which workspaces are allowed to access the app.
* Which workspaces are not allowed to access the app.

***

### Result after configuration

After Workspace access is configured:

* The app follows the organization’s workspace access policy.
* Workspaces with access can use the app.
* Workspaces without access cannot use the app.
* Workspace owners can only manage the app in their workspace if the app is available for that workspace.

***

### Notes

* **Workspace access** controls app availability at the workspace level. It does not replace user permissions or workspace roles.
* If the app should be available to most workspaces, enable **Default all workspace access** and only add exceptions for workspaces that should be excluded.
* If the app should only be available to specific workspaces, disable **Default all workspace access** and add the allowed workspaces to **Workspace exceptions**.
* An app being available in the organization does not mean it is automatically available in every workspace.
* Workspace members can only use an app when their workspace has access to that app and they have the required permission to use it.