Admin console overview

A map of the Strata admin console, who can reach it, and where to start when you take over your organization.

The admin console lives at /admin and is rendered only for users whose role grants the canAccessAdmin permission. The sidebar shows the Admin group only when that permission is present; a user without canAccessAdmin who types /admin/users in the URL bar is redirected to the chat page. (A user who has admin access but lacks a specific sub-page's permission sees an "Admin access required" message on that page.)

Who is an admin

Strata's permission system is role-based. Every organization is seeded with two built-in roles:

• admin — every administrative permission granted, with one deliberate exception: member-chat oversight (canViewMemberChats) is never auto-granted to the built-in admin role, since reading other people's conversations is a governance capability an org opts into by assigning a dedicated role. Cannot be edited.
• user — no administrative permissions; cannot be edited.

You can create additional custom roles that mix any subset of the granular permissions. The standard keys are:

Seven further permissions are owner-reserved. They carry organization-wide control, so an admin can only grant one if they already hold it themselves (enforced in the role editor and server-side):

A role without canAccessAdmin cannot reach /admin at all, even if other can_* keys are set. See Roles and permissions for the full model and how to author custom roles like "User manager" or "Compliance reader."

The admin pages

Each admin area lives at its own URL so you can deep-link, bookmark, and grant per-page review access. The sidebar only shows the pages your role has a permission for, so two admins can see different menus.

The Organization Settings page is itself split into sub-tabs: Defaults, Locks, Models, Branding & Policy, Database Connections, Agents, AI Engine, Provisioning (SCIM), Support, and Audit log. Several of them are permission-gated, so you may see fewer. Some admin areas live entirely inside those sub-tabs — org-wide SQL Server connections, bring-your-own Azure AI Foundry, organization deletion, the agent templates library, SCIM provisioning, and the audit log — and have their own articles. The direct URLs /admin/connections and /admin/audit still work for deep-linking.

Two things are not here. Invitations are sent from the Users page's Add user flow (/admin/invites redirects there). Which extensions your organization allows — and the Atlassian connection that covers Jira and Confluence — are governed on each extension's own page: Settings → Extensions → (extension) → Manage → Organization settings.

Choosing AI models

Strata no longer ships a fixed list of models. It runs a centrally-curated Model Catalog — a library of chat, voice, transcription, and embedding models that Kronisys provisions and maintains on Microsoft Azure AI Foundry, spanning OpenAI, Anthropic, xAI, DeepSeek, Mistral AI, Cohere, and Microsoft. As an admin you decide which of those models your organization can use.

Open Organization Settings → Models → Model Catalog to enable or disable models. For each one you can review its capabilities, context window, per-1M-token pricing, and Strata's own benchmark results before turning it on. The set you enable becomes the org's allowed list; chat, agents, voice, the Teams bot, and the API all honor it.

Note

The in-app Model Catalog is the live source of truth for which models exist and what they cost. Use it rather than memorizing a list — the catalog changes as new models are added.

The models a single member can actually pick are the intersection of three layers: the org's enabled models, their role's allowed list, and any per-user override. To narrow one person below the org default, open Users → (manage user) → Extensions & Data → AI models and uncheck models for that user; leaving it on "inherit" gives them every org-allowed model. See Roles and permissions and Users for the role and per-user layers.

How policies propagate

Most admin changes apply to every member of your organization the next time they make a request. The exceptions worth knowing:

• Role and permission changes rehydrate onto a session within about 30 seconds (the session refresh interval). Force-sign-out a user from the Sessions page if you need the change to land immediately.
• Model changes — disabling a model in the Model Catalog, or narrowing a role or per-user allowed list — take effect on the next chat, agent, voice, or API request once the session refreshes.
• Extension changes revoke access to newly-disallowed extensions on the next request — the user cannot keep using OneDrive or Outlook past their role's allowed list.
• Organization suspension is checked on the same ~30-second refresh. Once it lands, members get a 403 "Organization suspended" response on chat, scheduled agents stop running, and the voice button becomes unavailable. Admins can still reach /admin to lift the suspension.
• Bringing your own Foundry takes effect on the next AI request after Strata verifies the new endpoint and key.

Where to start as a new admin

If you have just taken over an organization, work through the console in this order:

1. Organization Settings → Defaults. Confirm the privacy defaults, rate limit, audit retention, and required mode are what you want.
2. Organization Settings → Models. Open the Model Catalog and enable the AI models you sanction. Then choose the extensions you allow org-wide from each extension's own page — Settings → Extensions → (extension) → Manage → Organization settings.
3. Organization Settings → Locks. Decide which of those defaults users may NOT override in their personal settings.
4. Roles. Add custom roles that match your org chart before inviting people. You can always change a user's role later, but you cannot retroactively assign a role that did not exist.
5. Database Connections. If your team queries a shared SQL Server, add it once here so every analyst inherits a vetted connection.
6. Invitations. Send invites with the right role pre-assigned.
7. Organization Settings → Audit. Bookmark this. Every admin mutation appears in the activity table here.

For each page, follow the cross-link in the table above for the full reference.

Related

• Users
• Roles and permissions
• Organization settings
• Models
• Audit log