Enterprise Advanced Settings

Enterprise admins can use Advanced settings to apply account-wide policies to Workspaces, members, Agent, published apps, and source control.

Replit configures these settings with security-conscious defaults. Enterprise admins can adjust or opt out of them to meet their organization’s requirements.

Open Advanced settings

Open Settings for your Enterprise account.
Under Account, select Advanced.

You can also open Advanced settings directly. Available controls depend on your account’s enabled features and your permissions.

Authentication

Setting	What it controls
SAML single sign-on	Requires members to authenticate with your identity provider. Contact Replit to enable SAML SSO for your account.
Idle session timeout	Sets how long an inactive authenticated session can remain open before the member must sign in again. Shortening the timeout signs out all existing members, including you.

For identity provider setup instructions, see SAML authentication.

Identity and governance

Setting	What it controls
Automatic member provisioning (SCIM)	Provisions and deprovisions members from your identity provider.
Audit logs	Enables access to account audit events and, when configured, audit log streaming.

These controls require the corresponding Enterprise service and permissions. For details, see SCIM and Audit logs.

Security

For scan workflows, Auto-Protect billing, and alert delivery, see Security.

Setting	Options and behavior
Auto-Protect for security vulnerabilities	Automatically creates an Agent task to fix new dependency vulnerabilities at or above the selected severity. Options range from Off to All severity levels. Tasks consume Agent credits, and the policy applies to all Workspaces on the billing account.
Require security scan	Off lets members choose whether to scan when publishing. Require requires scans for all publishing. Require for non-admins lets only admins skip scans. This policy does not apply to existing published apps.
Block publishing at severity	Sets the minimum vulnerability severity that blocks publishing when a scan runs: Critical, High & Critical, Medium, High, & Critical, All, or Disabled. The global CVE blocklist still applies when this setting is disabled.
Security alert recipients	Configures recipients for vulnerability notifications and the minimum severity that sends an alert. Availability and accepted email domains depend on your account policy.

Privacy settings

For publishing access, preview limitations, and deployment geography guidance, see Privacy and deployment settings.

Private deployments

Use this setting to prevent apps from being published publicly by default.

Option	Behavior
Off	Allows public and private publishing.
Require	Makes all new published apps private.
Require for non-admins	Allows only admins to publish publicly.

Existing published apps are unchanged.

Public publishing exceptions

Review and revoke existing project exceptions to the public publishing policy across the account.

Password-protected deployments

Use this setting to control whether members can share published apps with a password.

Option	Behavior
Enabled	Permits password-protected deployments.
Disabled	Blocks password-protected deployments for everyone.
Disabled for non-admins	Permits only admins to create password-protected deployments.

Existing apps are unchanged.

On-device PII filter for Agent chat

Use this setting to check messages for personal information before sending them to Agent.

Option	Behavior
Off	Sends messages as typed.
Detect	Warns when a message may contain personal information.
Redact	Removes detected personal information before sending.

Detection runs in the browser as a best-effort safeguard and does not catch every case.

Require private development URLs

Require authentication for all development URLs, including SSO when SAML is enabled.

This setting applies retroactively to existing apps. Private previews are not supported for mobile apps in Expo Go, simulators, or the Replit mobile app.

Ban source code export

Prevent members from exporting project source code as a ZIP file. This does not prevent code from leaving through other routes.

Ban attachment uploads

Prevent members from uploading attachments in Agent chat or importing files.

Agent modes and model providers

Use this section to choose which model providers and Agent modes are available across Workspaces on the billing account. For provider policies, per-Workspace model access, and Intelligent Model Routing, see Enterprise model controls.

Setting	What it controls
Model providers	Configures provider policies and model access for each Workspace.
Fast mode models	Enables or disables Fast mode models across the billing account.
Extra High and Max Effort	Enables or disables the Extra High and Max effort levels. Auto mode is not affected by this limit.

The Fast mode models and Extra High and Max Effort controls may appear under Disable features instead. In that section, turn a toggle on to disable the corresponding feature.

Deployment settings

Setting	What it controls
Deployment geography	Allows publishing to all enabled geographies or restricts members to one selected geography. The available geography list is account-specific.
Deployment feedback widget	Uses the normal per-deployment default, or enables the feedback widget by default for new deployments. Members can still change it per deployment.

Access requests

Admins with permission to manage approval requests can configure which request flows are available in each Workspace:

Request a usage limit increase lets a member request a higher personal usage or credit limit.
Request a workspace usage limit increase lets a member request a higher default usage limit for a Workspace.
Request public publish enablement lets a publisher request an exception when Workspace policy blocks public publishing.

Disable features

These account-wide controls remove or disable features for organization members:

Setting	What it controls
Import Code or Design	Hides the import feature in the sidebar.
Integrations	Prevents members from connecting or configuring integrations and hides integration suggestions from Agent.
Developer Frameworks	Hides Developer Frameworks in the sidebar.
Memory	Disables Agent memory across all Workspaces on the billing account.

Source control settings

These account-level controls define publishing and repository requirements. Configure the provider and target allowlist separately; changing one does not change the other.

Setting	Options and behavior
Require Git remote	Off permits publishing without a remote. Require requires all local changes to be pushed before publishing. Require for non-admins lets only admins publish without a remote. Existing published apps are unchanged.
Private remotes	Off permits public and private repositories. Require permits only private repositories. Require for non-admins lets only admins create public repositories.
Allowed Git provider	Allows all providers or restricts members to GitHub, GitLab, or Bitbucket.
Whitelisted organizations	Restricts repository creation to a comma-separated list of GitHub organizations, GitLab group paths, or Bitbucket workspaces. Personal repositories are disabled. This requires Allowed Git provider to be set. Matching is case-insensitive.

Allowed Git remote targets

The target allowlist, labeled Whitelisted organizations in some versions of Advanced settings, applies only when Allowed Git provider is set to GitHub, GitLab, or Bitbucket. With Any provider, the allowlist is not enforced. For GitLab, use exact group paths and list each subgroup separately; allowing team does not allow team/backend.

Privacy and deployment settings—Configure publishing privacy, previews, exports, and deployment geography.
Security—Monitor vulnerabilities and configure scan policies.
Information Security—Learn about Replit’s security practices and compliance standards.
SAML authentication—Configure single sign-on.
Audit logs—Review account activity.
Groups and permissions—Manage member access with roles and groups.

Overview

Workspace Essentials

Enterprise

Warehouse Connectors

Identity and Access Management

Billing for Enterprise

Enterprise Advanced Settings

Open Advanced settings

Authentication

Identity and governance

Security

Privacy settings

Private deployments

Public publishing exceptions

Password-protected deployments

On-device PII filter for Agent chat

Require private development URLs

Ban source code export

Ban attachment uploads

Agent modes and model providers

Deployment settings

Access requests

Disable features

Source control settings

Allowed Git remote targets

​Open Advanced settings

​Authentication

​Identity and governance

​Security

​Privacy settings

​Private deployments

​Public publishing exceptions

​Password-protected deployments

​On-device PII filter for Agent chat

​Require private development URLs

​Ban source code export

​Ban attachment uploads

​Agent modes and model providers

​Deployment settings

​Access requests

​Disable features

​Source control settings

​Allowed Git remote targets

​Related resources

Open Advanced settings

Authentication

Identity and governance

Security

Privacy settings

Private deployments

Public publishing exceptions

Password-protected deployments

On-device PII filter for Agent chat

Require private development URLs

Ban source code export

Ban attachment uploads

Agent modes and model providers

Deployment settings

Access requests

Disable features

Source control settings

Allowed Git remote targets

Related resources