> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/reference/commands/admin-settings-licenses-gateways.md).

# Administration: settings, licenses, and gateways

Every option of the devo admin commands for system settings, authentication modes, licenses, Devolutions Gateway, server caches, and privileged access.

This page describes the `devo admin` commands that look after the workspace itself: system settings, authentication modes, and two-factor configuration, licenses, Devolutions Gateway, server caches, and privileged access (PAM) accounts and providers. Each command works with one workspace type only, Devolutions Cloud or Devolutions Server, as the **Workspace** line under it says. A command run on another workspace type stops with `operationNotSupportedBySource` and names the type you need.

For the list of all commands, see [Commands](/cli/reference/commands.md). For related tasks, see [Manage users, groups, and access](/cli/for-devops-and-administrators/manage/users-and-access.md). The options every command accepts, such as `--context` or `--output json`, are described in [Global options](/cli/reference/global-options.md) and aren't repeated here.

{% hint style="info" %}
Commands that change something refuse to run without `--yes` (aliases `-y` and `--confirmed`) and stop with `confirmationRequired`. Secret values, such as a license serial, are read from an environment variable or a file, never from the command line, and are hidden in the output.
{% endhint %}

## devo admin settings get

Shows the system settings of the Devolutions Cloud organization, without secrets.

**Workspace:** Devolutions Cloud.

```bash
devo admin settings get
```

This command has no options of its own.

## devo admin settings update

Changes system settings of the Devolutions Cloud organization. Settings you don't mention keep their value, and you must change at least one. Most settings come as a pair of options, one to turn the setting on and one to turn it off: passing both options of a pair stops the command with `conflictingOptions`.

**Workspace:** Devolutions Cloud.

```bash
devo admin settings update [options] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--allow-devolutions-account-login</code></td><td>Off</td><td>Allows users to sign in with a Devolutions account. Opposite of <code>--disable-devolutions-account-login</code>.</td></tr><tr><td><code>--disable-devolutions-account-login</code></td><td>Off</td><td>Stops users from signing in with a Devolutions account.</td></tr><tr><td><code>--allow-sso-login</code></td><td>Off</td><td>Allows single sign-on (SSO). Opposite of <code>--disable-sso-login</code>. This change is applied after the other settings of the same command. If it fails after the other settings were saved, the error says so.</td></tr><tr><td><code>--disable-sso-login</code></td><td>Off</td><td>Turns off single sign-on (SSO). Applied after the other settings, like <code>--allow-sso-login</code>.</td></tr><tr><td><code>--force-sso-login</code></td><td>Off</td><td>Forces SSO for all users. If your SSO identity provider is down, users can't sign in to Devolutions Cloud. Opposite of <code>--no-force-sso-login</code>.</td></tr><tr><td><code>--no-force-sso-login</code></td><td>Off</td><td>Stops forcing SSO sign-in.</td></tr><tr><td><code>--force-two-factor-authentication</code> (<code>--force-two-factor</code>)</td><td>Off</td><td>Makes two-factor authentication mandatory. Opposite of <code>--no-force-two-factor-authentication</code>.</td></tr><tr><td><code>--no-force-two-factor-authentication</code> (<code>--no-force-two-factor</code>)</td><td>Off</td><td>Stops making two-factor authentication mandatory.</td></tr><tr><td><code>--allow-user-vault</code></td><td>Off</td><td>Allows access to user vaults. Opposite of <code>--disable-user-vault</code>.</td></tr><tr><td><code>--disable-user-vault</code></td><td>Off</td><td>Turns off access to user vaults.</td></tr><tr><td><code>--block-tor-traffic</code></td><td>Off</td><td>Blocks connections that come from the Tor network. Opposite of <code>--allow-tor-traffic</code>.</td></tr><tr><td><code>--allow-tor-traffic</code></td><td>Off</td><td>Allows connections that come from the Tor network.</td></tr><tr><td><code>--enable-gateway-recording</code></td><td>Off</td><td>Turns on Devolutions Gateway session recording. Opposite of <code>--disable-gateway-recording</code>.</td></tr><tr><td><code>--disable-gateway-recording</code></td><td>Off</td><td>Turns off Devolutions Gateway session recording.</td></tr><tr><td><code>--enable-devolutions-send</code></td><td>Off</td><td>Turns on Devolutions Send. Opposite of <code>--disable-devolutions-send</code>.</td></tr><tr><td><code>--disable-devolutions-send</code></td><td>Off</td><td>Turns off Devolutions Send.</td></tr><tr><td><code>--enable-encryption-service</code></td><td>Off</td><td>Turns on the encryption service setting. Opposite of <code>--disable-encryption-service</code>.</td></tr><tr><td><code>--disable-encryption-service</code></td><td>Off</td><td>Turns off the encryption service setting.</td></tr><tr><td><code>--enable-ip-allow-list</code></td><td>Off</td><td>Turns on the IP allowlist, which restricts access to the IP ranges it contains. Opposite of <code>--disable-ip-allow-list</code>. This option turns the list on or off; it doesn't change the ranges in it.</td></tr><tr><td><code>--disable-ip-allow-list</code></td><td>Off</td><td>Turns off the IP allow list.</td></tr><tr><td><code>--send-usage-data</code></td><td>Off</td><td>Turns on sending usage data. Opposite of <code>--no-send-usage-data</code>.</td></tr><tr><td><code>--no-send-usage-data</code></td><td>Off</td><td>Stops sending usage data.</td></tr><tr><td><code>--system-message &#x3C;text></code></td><td></td><td>New system message shown to users. Pass an empty value (<code>--system-message ""</code>) to clear it.</td></tr><tr><td><code>--inactivity-logout-time &#x3C;value></code></td><td></td><td>New inactivity logout time. Devolutions Cloud offers Off, 5, 10, 15, 30, or 60 minutes, or 2, 4, 6, 8, 12, or 24 hours. Devolutions CLI sends the value as you type it, without checking it: write it in the form <code>devo admin settings get</code> shows. Spaces around the value are removed, and an empty value is refused.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

## devo admin settings auth-modes get

Shows which authentication modes are turned on in Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin settings auth-modes get
```

This command has no options of its own.

## devo admin settings auth-modes set

Turns the Azure AD, custom, or domain authentication mode of Devolutions Server on or off. Devolutions CLI reads the current modes first and changes only the ones you pass; the others keep their value. At least one primary authentication mode must stay on: a change that would turn them all off is refused with `invalidOperation`.

**Workspace:** Devolutions Server.

```bash
devo admin settings auth-modes set [--azure-ad true|false] [--custom true|false] [--domain true|false] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--azure-ad &#x3C;true|false></code></td><td></td><td>Turns Microsoft Entra ID (Azure AD) authentication on (<code>true</code>) or off (<code>false</code>).</td></tr><tr><td><code>--custom &#x3C;true|false></code></td><td></td><td>Turns custom Devolutions Server authentication on (<code>true</code>) or off (<code>false</code>).</td></tr><tr><td><code>--domain &#x3C;true|false></code></td><td></td><td>Turns domain (Active Directory) authentication on (<code>true</code>) or off (<code>false</code>).</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the change. Required.</td></tr></tbody></table>

Pass at least one of `--azure-ad`, `--custom`, and `--domain`. Any value other than `true` or `false` is refused.

## devo admin settings two-factor get

Shows the two-factor authentication configuration of Devolutions Server: the methods users can choose, the default method, and related settings.

**Workspace:** Devolutions Server.

```bash
devo admin settings two-factor get
```

This command has no options of its own.

## devo admin license list

Lists the licenses of Devolutions Server, with their serial numbers partly hidden. Alias: `devo admin license ls`.

**Workspace:** Devolutions Server.

```bash
devo admin license list
```

This command has no options of its own.

## devo admin license register

Registers a license on Devolutions Server, from a license serial or a license token read from an environment variable or a file.

**Workspace:** Devolutions Server.

```bash
devo admin license register --serial-env <variable> [--auto-assign true|false] [--replace] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--serial-env &#x3C;variable></code> (<code>--license-jwt-env</code>)</td><td></td><td>Name of the environment variable that holds the license serial or license token. Pass this option or <code>--serial-file</code>: one of them is required, not both. Spaces and line breaks around the value are removed, and an empty value is refused.</td></tr><tr><td><code>--serial-file &#x3C;path></code> (<code>--license-jwt-file</code>)</td><td></td><td>File that holds the license serial or license token.</td></tr><tr><td><code>--auto-assign &#x3C;true|false></code></td><td><code>false</code></td><td>Whether licenses that support it are assigned automatically to new users. Any other value is refused.</td></tr><tr><td><code>--replace</code></td><td>Off</td><td>Removes the existing licenses before saving the new one.</td></tr><tr><td><code>--specific-serial-env &#x3C;variable></code></td><td></td><td>When the license token holds several licenses: name of the environment variable that holds the one serial to save. Use this option or <code>--specific-serial-file</code>, not both.</td></tr><tr><td><code>--specific-serial-file &#x3C;path></code></td><td></td><td>When the license token holds several licenses: file that holds the one serial to save.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the registration. Required.</td></tr></tbody></table>

## devo admin license trial start

Starts a trial license on Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin license trial start [--requester-email <email>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--requester-email &#x3C;email></code></td><td></td><td>Email address of the person who requests the trial. Sent only when you pass it; pass it when the server asks for one.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the trial start. Required.</td></tr></tbody></table>

## devo admin license users list

Lists the users assigned to one Devolutions Server license. Alias: `devo admin license users ls`.

**Workspace:** Devolutions Server.

```bash
devo admin license users list --serial-env <variable>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--serial-env &#x3C;variable></code></td><td></td><td>Name of the environment variable that holds the license serial. Pass this option or <code>--serial-file</code>: one of them is required, not both. An empty serial is refused.</td></tr><tr><td><code>--serial-file &#x3C;path></code></td><td></td><td>File that holds the license serial.</td></tr></tbody></table>

## devo admin gateway list

Lists the Devolutions Gateway instances of the Devolutions Cloud organization, without their secrets. Alias: `devo admin gateway ls`.

**Workspace:** Devolutions Cloud.

```bash
devo admin gateway list
```

This command has no options of its own.

## devo admin gateway get

Shows one Devolutions Gateway instance, without its secrets.

**Workspace:** Devolutions Cloud.

```bash
devo admin gateway get --gateway-id <id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--gateway-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID of the gateway, as a GUID. Get it from <code>devo admin gateway list</code>.</td></tr></tbody></table>

## devo admin gateway delete

Deletes a Devolutions Gateway instance from the Devolutions Cloud organization. Alias: `devo admin gateway rm`.

**Workspace:** Devolutions Cloud.

```bash
devo admin gateway delete --gateway-id <id> --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--gateway-id &#x3C;id></code> (<code>--id</code>)</td><td></td><td>Required. ID of the gateway, as a GUID.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the deletion. Required.</td></tr></tbody></table>

## devo admin gateway settings get

Shows the Devolutions Gateway settings of the Devolutions Cloud organization, without secrets.

**Workspace:** Devolutions Cloud.

```bash
devo admin gateway settings get
```

This command has no options of its own.

## devo admin gateway revocation-list publish

Publishes the revocation list of one Devolutions Gateway, or of every gateway, from Devolutions Server.

**Workspace:** Devolutions Server.

```bash
devo admin gateway revocation-list publish [--gateway-id <id>] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--gateway-id &#x3C;id></code></td><td>All gateways</td><td>ID of the gateway, as a GUID. Leave it out to publish the revocation lists of all gateways.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the publication. Required.</td></tr></tbody></table>

## devo admin cache reset

Clears selected caches of Devolutions Server, so it reloads the data.

**Workspace:** Devolutions Server.

```bash
devo admin cache reset --element <element> [--element <element> ...] --yes
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--element &#x3C;element></code> (<code>-e</code>)</td><td></td><td>Cache to clear. Repeat the option to clear several. At least one is needed. Values, without case sensitivity: <code>all</code>, <code>connections</code>, <code>domain</code>, <code>repositories</code> (or <code>vaults</code>), <code>roles</code> (or <code>groups</code>), <code>office365</code> (or <code>office-365</code>), and <code>users</code>. An unknown value is refused.</td></tr><tr><td><code>--yes</code> (<code>-y</code>, <code>--confirmed</code>)</td><td>Off</td><td>Confirms the reset. Required.</td></tr></tbody></table>

## devo admin pam account list

Lists privileged accounts of Devolutions Server, without their secrets. Alias: `devo admin pam account ls`.

**Workspace:** Devolutions Server.

```bash
devo admin pam account list [--vault-id <id>] [--page <number>] [--page-size <size>]
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--vault-id &#x3C;id></code> (<code>--folder-id</code>)</td><td>All</td><td>Lists only the accounts of this privileged access vault or folder. The ID is a GUID.</td></tr><tr><td><code>--page &#x3C;number></code></td><td><code>1</code></td><td>Page to fetch, starting at 1.</td></tr><tr><td><code>--page-size &#x3C;size></code></td><td><code>100</code></td><td>Number of accounts per page, from 1 to 500.</td></tr></tbody></table>

## devo admin pam provider list

Lists the privileged access providers of Devolutions Server, without their secrets. Alias: `devo admin pam provider ls`.

**Workspace:** Devolutions Server.

```bash
devo admin pam provider list
```

This command has no options of its own.

## devo admin pam provider get

Shows one privileged access provider, without its secrets.

**Workspace:** Devolutions Server.

```bash
devo admin pam provider get --provider-id <id>
```

<table><thead><tr><th width="300">OPTION</th><th width="130">DEFAULT</th><th>WHAT IT DOES</th></tr></thead><tbody><tr><td><code>--provider-id &#x3C;id></code></td><td></td><td>Required. ID of the provider, as a GUID. Get it from <code>devo admin pam provider list</code>.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/reference/commands/admin-settings-licenses-gateways.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.