> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> The Security tab contains security settings that are applied globally.

The security settings on this tab are applied globally.

<Frame>
  <img src="https://mintcdn.com/cdata/-CG7rbvPUnfqNHru/en/images/settings_security.png?fit=max&auto=format&n=-CG7rbvPUnfqNHru&q=85&s=3f6a4459024eb239cb0276d1ad5bac48" alt="Settings security" width="862" height="575" data-path="en/images/settings_security.png" />
</Frame>

## Personal Access Token Expiration

This section allows you to set a global Personal Access Token (PAT) expiration (such as **30 Days**, **60 Days**, or **Never Expire**). Shorter durations improve security. When the PAT expires, the PAT displays **Expired** in the **Security** tab of **Settings**, and any authentication using the PAT fails with an `"Invalid personal access token"` error.

To create a PAT, see [Personal Access Tokens](/en/Settings/Personal-Access-Tokens).

## Default Connection & Workspace Permissions

From the drop-down list, select the default permissions granted to new users for all connections and workspaces. Options include **No Permissions** to connections and workspaces by default or **Select Only** permissions to connections and workspaces by default.

<Note>This setting does not affect the connection and workspace access of existing users.</Note>

## Playground Access

Toggle this feature off if you do not want your users to have access to [Playground](/en/Playground).

## MCP Connectivity

Toggle this feature off if you do not want your users to have access to any MCP-related functionality.

## SSO

**Just-in-Time (JIT) User Provisioning** automatically provisions new users the first time they sign in to an SSO-enabled domain.

<Frame>
  <img src="https://mintcdn.com/cdata/BVI_pWskwfkvIuSe/en/images/settings_sso.png?fit=max&auto=format&n=BVI_pWskwfkvIuSe&q=85&s=b60c22f0afbb495ad9c766a58034d345" alt="Settings SSO" width="1447" height="281" data-path="en/images/settings_sso.png" />
</Frame>

To enable JIT user provisioning:

<Steps>
  <Step>
    Enable the toggle for a domain to turn on JIT provisioning.
  </Step>

  <Step>
    Select the **JIT User Role** for new JIT users.
  </Step>

  <Step>
    Select the **JIT Access Role** for new JIT users.
  </Step>

  <Step>
    Click **Save Changes**.
  </Step>
</Steps>

See [User Provisioning and SSO](/en/SCIM) for more information about JIT. See [Roles](/en/Roles) for more information about user roles and access roles.