> ## Documentation Index
> Fetch the complete documentation index at: https://sofiedocs.usetransfer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization settings

> Manage organization name, authentication policy, brand settings, and company-level Sofie configuration.

Organization settings control shared Sofie configuration. Only administrators with the right permissions can view or change these settings.

Depending on your environment, **Organization Settings** can include **General**, **Brand**, and **Integrations** tabs.

## General settings

Use **General** for organization-level settings such as:

* Organization name.
* Passkey policy for privileged users.
* Passkey policy for all users.
* Whether email magic links are disabled when SSO is configured.
* Whether every Orchestration owner can share owned Orchestrations.
* Sign-in configuration when your organization uses an external identity provider.

## Update organization name

<Steps>
  <Step title="Open Organization Settings">
    Go to the administration area and open **Organization Settings**.
  </Step>

  <Step title="Choose General">
    Open **General**.
  </Step>

  <Step title="Edit Organization Name">
    Enter the organization name users should see in Sofie.
  </Step>

  <Step title="Save changes">
    Review the page and click **Save Changes**.
  </Step>
</Steps>

## Configure passkey policy

Your organization may be able to require passkeys for:

* Privileged users.
* All users.

These settings are in **Authentication Policy**.

| Setting                                   | What it does                                                                                         |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| **Require passkeys for privileged users** | Requires users with elevated permissions to enroll at least one passkey before using Sofie normally. |
| **Require passkeys for all users**        | Requires passkey enrollment for every user account.                                                  |

Before enforcing passkeys:

* Confirm users have supported browsers and devices.
* Communicate the change.
* Decide how users should get help if blocked.
* Confirm administrators have passkeys enrolled first.
* Review the policy with the team that owns identity and access.

<Warning>
  Passkey enforcement can block users until they enroll. Do not enable broad enforcement without a rollout plan.
</Warning>

## Configure magic-link sign-in policy

Use **Disable magic links when SSO is enabled** to hide and block email magic-link sign-in when an external SSO provider is fully configured.

When this setting is on:

* Users sign in with SSO, passkey, or another available method.
* Email magic links are unavailable only after an external SSO provider is enabled and configured.
* Magic links stay available if no SSO provider is enabled, which helps prevent administrator lockout during setup.

In the current Sofie settings, Microsoft Entra ID is the external SSO provider shown in **Organization Settings**.

<Steps>
  <Step title="Open Organization Settings">
    Go to the administration area and open **Organization Settings**.
  </Step>

  <Step title="Choose General">
    Open **General**.
  </Step>

  <Step title="Find Authentication Policy">
    Review the passkey policy and **Disable magic links when SSO is enabled** setting together.
  </Step>

  <Step title="Save changes">
    Click **Save Changes**.
  </Step>
</Steps>

<Warning>
  Test SSO with an administrator account before disabling magic links. If SSO is incomplete, Sofie keeps magic links available, but users may still be confused by a partial rollout.
</Warning>

## Configure Microsoft Entra ID sign-in

Use **Microsoft Entra ID Authentication** when users should sign in with Microsoft.

Fields may include:

| Field                         | Use it for                                                                                                                           |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| **Enable Microsoft Entra ID** | Allows users to sign in with their Microsoft account.                                                                                |
| **Application (Client) ID**   | The application client ID from the Microsoft Entra app registration.                                                                 |
| **Directory (Tenant) ID**     | The directory tenant ID from the Microsoft Entra app registration.                                                                   |
| **Client Secret**             | The client secret from the Microsoft Entra app registration. Leave blank when rotating nothing and Sofie already has a saved secret. |

After Microsoft Entra ID is enabled, decide whether email magic links should remain available or be disabled through **Disable magic links when SSO is enabled**.

For the full setup workflow, see [Microsoft SSO](/admin/microsoft-sso).

## Configure Orchestration sharing

Use **Orchestration Sharing** in **General** to decide whether all Orchestration owners can share owned Orchestrations.

When **Allow unrestricted orchestration sharing** is on, owners can share their owned Orchestrations. When it is off, owners need **Share Orchestrations** through the **Publisher** role or a custom role before they can share.

<Steps>
  <Step title="Open Organization Settings">
    Go to the administration area and open **Organization Settings**.
  </Step>

  <Step title="Choose General">
    Open **General**.
  </Step>

  <Step title="Update Orchestration Sharing">
    Find **Orchestration Sharing** and turn **Allow unrestricted orchestration sharing** on or off.
  </Step>

  <Step title="Save changes">
    Review the setting and click **Save Changes**.
  </Step>
</Steps>

For the full rollout workflow, see [Orchestration sharing controls](/admin/orchestration-sharing-controls).

## Brand settings

Use **Brand** to configure company details used in Sofie-generated document styling.

Brand settings may include:

* Logo.
* Primary color.
* Secondary color.

Logo uploads may accept JPG, GIF, or PNG files and enforce the file size shown in the app.

Use brand settings for visual consistency. Do not use brand settings to imply a document is approved, controlled, or released.

Organization branding is the default. Group branding can override it for group members, and personal branding can override both when **Allow personal branding** is enabled.

For the full hierarchy and setup workflow, see [Document branding](/admin/document-branding).

## Enable personal branding

Use **Allow personal branding** when users should be able to set their own generated document logo and colors.

<Steps>
  <Step title="Open Organization Settings">
    Go to the administration area and open **Organization Settings**.
  </Step>

  <Step title="Choose General">
    Open **General**.
  </Step>

  <Step title="Turn on Allow personal branding">
    In **Branding**, enable **Allow personal branding**.
  </Step>

  <Step title="Save changes">
    Click **Save Changes**.
  </Step>
</Steps>

## Brand review checklist

Before saving brand settings, check:

* Logo is current.
* Logo is readable on light backgrounds.
* Colors have enough contrast in generated output.
* The organization name is spelled correctly.
* The brand does not conflict with project-specific document requirements.

## Related settings

Use these pages for adjacent administrator work:

* [Integration administration](/admin/integration-administration) for connected app availability.
* [Microsoft SSO](/admin/microsoft-sso) for Microsoft Entra ID sign-in setup.
* [Security Center](/admin/security-center) for security events and access review material.
* [Security and passkeys](/account/security-and-passkeys) for user-level passkey setup.