> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/administration/settings-hierarchy.md).

# Settings Hierarchy

**Settings Hierarchy**

With Material, you can configure feature settings at the Global, Tenant, Group, or Account level for maximum flexibility. This allows you to implement protections and controls at your own pace and for just the users or teams that need them.

### Hierarchy and Overrides <a href="#h-hierarchy-and-overrides" id="h-hierarchy-and-overrides"></a>

Material supports configuring settings at four levels. Each level is listed below from broadest to narrowest. By default, each level inherits the settings specified at a broader level.

#### Global <a href="#h-global" id="h-global"></a>

These settings apply to all accounts across all tenants within Material.

To configure Global settings, from the top toolbar, click **Settings**, then click **Default Account Settings**.

#### Tenant <a href="#h-tenant" id="h-tenant"></a>

These settings apply to all accounts within the specified tenant and override any Global settings.

To configure Tenant settings, from the top toolbar, click **Settings**, then click **Default Account Settings**. Use the dropdown at the top right of the page to select a tenant.

#### Group <a href="#h-group" id="h-group"></a>

These settings apply to all accounts within the specified group and override any Global or Tenant settings. Material leverages existing groups within your directory and/or identity provider. The currently supported group types are:

* Google Group
* Google OU
* Microsoft Groups
* Okta Groups

To configure Group settings, navigate to Groups, select a group, and click **Edit Settings**. You can also view which groups have existing settings overrides by using the **Settings Override** filter.

#### Account <a href="#h-account" id="h-account"></a>

These settings apply to a specific account and override any Global, Tenant, or Group settings.

**To configure Account settings:**

1. From the left navigation, expand **Explorer** then click **Accounts.**
2. Select an account.
3. Click **All Actions.**

From here you can perform the following actions:

* Edit Settings
* Edit Roles
* Edit Delegates
* Force Unlock Messages
* Revoke user sessions

You can also view which accounts have existing settings overrides here by using the **Overrides** filter.

### Conflicting Settings <a href="#h-conflicting-settings" id="h-conflicting-settings"></a>

When two settings of the same level conflict, Material defaults to the most secure setting. For feature settings, this means enabling a feature is picked over disabling a feature. For advanced settings such as Grace Periods, Material picks the stricter option (e.g. shorter grace period).

For example, the following table shows the resulting settings for an account that is part of two groups (Group A and Group B) which have conflicting settings.

|                              | Group A (“Strict”) | Group B (“Relaxed”) | Merged Settings |
| ---------------------------- | ------------------ | ------------------- | --------------- |
| Mailbox Syncing              | On                 | On                  | On              |
| Email Redaction              | On                 | Off                 | On              |
| Default Locking Grace Period | 1 Year             | 6 months            | 6 months        |
| Email Identity Protection    | Off                | On                  | On              |

### FAQs <a href="#h-faqs" id="h-faqs"></a>

#### How would I disable Global settings so they do not apply to a new tenant I am about to enroll? <a href="#h-how-would-i-disable-global-settings-so-they-do-not-apply-to-a-new-tenant-i-am-about-to-enroll" id="h-how-would-i-disable-global-settings-so-they-do-not-apply-to-a-new-tenant-i-am-about-to-enroll"></a>

**Disable Global Settings**

For each existing tenant:

1. Navigate to the Global Default Account Settings and then use the dropdown at the top right of the page to select the tenant.
2. Select **Override** for each setting you plan to disable Globally.
3. After reviewing each tenants' settings, you can begin to disable the various Global Default Account Settings you don't wish to apply.

For most Material deployments, the only Global setting enabled is Account Connection.

#### What's the best way to opt some users out of Material? <a href="#h-whats-the-best-way-to-opt-some-users-out-of-material" id="h-whats-the-best-way-to-opt-some-users-out-of-material"></a>

**Opting accounts out**

If the set of users is fixed (e.g. it’s a handful of 3-4 people), the best option is to set all features to disabled at the Account level. If the set of users will change over time, we suggest creating a group of these users, disabling all features for that group, and leveraging tenant level settings for other users.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.material.security/administration/settings-hierarchy.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.