Settings holds your organization’s configuration. Console Access is where Settings opens, at its own address
/settings/console-access. API Tokens also has its own address, /settings/api-tokens. The other tabs are carried in the URL as ?tab=.
What’s on the page
Tabs
Console Access
Who can sign in to the console, and the roles they hold, in two sub-tabs: People and Roles.People
Everyone with console access, with their Role and Status. The columns are Email, Role, Connected Tools and Status. An Admin adds people with Add Users, changes a Role or Status in place or in bulk, and can move someone back to Member, which removes their console access. Any other role reads the list without the controls. Add Users opens a dialog. Pick the Role first - Built-in Roles and your Custom Roles are listed side by side. Then choose Existing Users, to give current Members access from a searchable, filterable list of Email, Department, Manager and Status, or Invite by Email. Grant Access applies it; Cancel backs out. Members cannot sign in; their AI use is monitored from Policies → Users.Roles
Admin only. Lists every role, built-in and custom, with an editor for the selected one. New Role creates a custom role, starting at None on every area with Organization scope.
A built-in role opens read-only, marked Built-in. Create Role or Save Changes applies the card. Delete Role asks you to confirm first; a role people still hold cannot be deleted, and the card tells you to move them to another role on the People tab.
A Preview panel beside the editor lists what the role as drafted reaches - each console page and each CLI command, read Allowed, Blocked or Allowed, content hidden - and Recent Changes below it lists who changed the role, when, and what moved. What each area and level opens is on the role table.
Devices
Import Devices brings in a list of machines in one step, such as an export from your MDM. The file is CSV or Excel (
.csv, .xlsx, .xls), up to 10 MB, dropped on the dialog or browsed for.
Header names are matched loosely — capitalization, spaces and dashes make no difference, so
Serial Number, serial-number and serial_number all work. A header spelled any other way is not recognized, and its values do not arrive. A row without a serial and a valid email address is skipped, and only the first sheet of an Excel workbook is read. The dialog previews the first five rows with the total, so you can confirm the file read correctly before anything is imported — Change File goes back. Importing reports N devices added, N devices updated and, where they occur, the devices that could not be reached and the ones skipped, each skipped row listed with its reason. Retry N Failed re-runs just the rows that did not land.
Integrations
Connects Unbound to the tools around it, split into Connected and Available:
A connected card shows when it last synced — Okta also shows how many directory users matched, with a tooltip listing what the last run updated, suspended and synced as user groups, and Slack shows the workspace it is connected to. Anthropic — which requires a Claude Enterprise plan — connects with Enter API Key. Manage Anthropic integration reopens its dialog, where a separate control stops importing and deletes the stored key.
Edit Okta attribute mapping lets you pick the Okta profile attribute behind each value — the Team Manager, Department and Employee Title attributes — or keep the defaults. Each field reports how many of a sample of users have it, and a preview shows what the sync would write before you save. Okta adds a Sync button, and the first import runs as soon as you connect.
What Okta sync does
If the API token is revoked or expires, the card shows the integration as Inactive and syncing stops. Reconnect with a fresh token and it resumes at the next sync.
Policy Enforcement
If Unbound is unreachable decides what your agents do when the policy check cannot run — Choose what your connected agents do when the policy check can’t run:
The choice is staged until you press Save — an Unsaved changes badge marks the gap, and your browser asks before you close or reload the tab with changes unsaved.
Show Unbound Attribution on Blocks and Warnings adds a last line — Enforced by Unbound · Trace ID … — to every block and warning, so developers can see which product acted and you can find the event in Logs. It is off by default and saves as soon as you flip it; your own enforcement messages are unchanged.
API Tokens
Your own tokens for the Unbound CLI, where API access is enabled for your organization: the onesunbound login created, and any you generate here with a name, an expiry of 7 to 90 days, and Full Access or a level per area, never above your own. Each token is shown once; Revoke stops it immediately. Every signed-in person has this page, a Member by its address. The fields and messages are on CLI Authentication.
Webhooks
Sends Unbound events to your own systems — a SIEM, a chat channel, or anything accepting an HTTP POST. Each endpoint carries its own signing secret to reveal and copy, a Show all subscribed events control where it lists many, can be enabled or disabled, and keeps a delivery history you can read alongside a Send test event control.Filters and controls
Search events… finds events when subscribing a webhook endpoint. The Devices table has its own search.What you can do
Every tab other than API Tokens needs Configuration · View to read. Every action below needs Configuration · Edit - a role at View sees the contents without the controls that change them. Webhooks and the Slack integration also need Logs · View, since what they deliver can carry logged content.
Budgets are not set here — they are cost policies, under Policies → Usage.