Set-PSUSetting

SYNOPSIS

Configures PowerShell Universal server settings.

SYNTAX

All options are optional. Specify only the settings you want to change:

Set-PSUSetting [-LogLevel <String>] [-MicrosoftLogLevel <String>] [-LoggingFilePath <String>] [-DefaultEnvironment <String>] [-GroomDays <Int32>] [-ConcurrentJobLimit <Int32>] [-Telemetry] [-HideApi] [-HideHomePage] [-HideAutomation] [-HideDashboard] [-DisableCodeFirst] [-SecurityEnvironment <String>] [-ApiEnvironment <String>] [-DefaultPage <String>] [-RateLimitClientAllowList <String[]>] [-RateLimitIpAddressAllowList <String[]>] [-RateLimitEndpointAllowList <String[]>] [-DisableUpdateCheck] [-ScriptBaseFolder <String>] [-AdminConsoleLogo <String>] [-AdminConsoleTitle <String>] [-GroomInterval <Int32>] [-NotificationLevel <NotificationLevel>] [-ProxyUri <String>] [-ProxyCredential <Variable>] [-JobHandshakeTimeout <Int32>] [-HideRunAs] [-FallbackLanguageId <String>] [-Splatting] [-FavIcon <String>] [-ExperimentalFeatures <ExperimentalFeatures>] [-DisabledFeatures <Features>] [-LimitIdentities] [-DontLoadProfile] [-EnhancedAppTokenSecurity] [-DefaultDashboardTheme <String>] [-UseLogoSize] [-DarkTheme] [-HideEnvironment] [-HideRunOn] [-DisableFormatOnSave] [-ContentSecurityPolicy <String>] [-LogGroomDays <Int32>] [-Branding <OldBranding>] [-PreformattedJobOutput] [-ModuleDiscoveryFrequency <String>] [-DebuggerEnvironment <String>] [-FileEncoding <String>] [-MaxJobMemory <Int32>] [-LargeJobOutputBehavior <LargeJobOutputBehavior>] [-MaxJobOutputSizeKB <Int32>] [-JobRunId] [-ApiBaseFolder <String>] [-AbandonedJobGroomDays <Int32>] [-CheckForModuleUpdates] [-DisableRequiredModuleInstallation] [-HideRunLater] [-AnonymousApiDocumentation] [-MaximumTokenLifetime <Int32>] [-PortalDisabled] [-PortalRole <String[]>] [-DefaultTokenLifetime <Int32>] [-ApiSecurityModel <ApiSecurityModel>] [-DefaultRunOn <String>] [-SessionTimeout <Int32>] [-DisableFirstRun] [-DebugPreference <ActionPreference>] [-VerbosePreference <ActionPreference>] [-InformationPreference <ActionPreference>] [-WarningPreference <ActionPreference>] [-ErrorPreference <ActionPreference>] [-ProgressPreference <ActionPreference>] [-DisableDatabaseVault] [-PasswordExpirationDays <Int32>] [-PasswordLength <Int32>] [-DisableDevolutionsAccountLogin] [-RedactSensitiveJobOutput] [-SensitiveJobOutputKeys <String[]>] [-McpToolRateLimitPerMinute <Int32>] [-McpToolConcurrentJobLimit <Int32>] [<ConnectionOptions>] [<CommonParameters>]

<ConnectionOptions>: [-ComputerName <String>] [-AppToken <String>] [-Credential <PSCredential>] [-UseDefaultCredentials] [-Integrated] [-TrustCertificate] [-Cookies].

DESCRIPTION

Updates server settings. When called against a running instance, only explicitly supplied settings are changed; configuration-file use creates a settings object. Job output controls include -LargeJobOutputBehavior, -MaxJobOutputSizeKB, -PreformattedJobOutput, and -JobRunId. -RedactSensitiveJobOutput is opt-in and off by default; when enabled, PSU masks values for built-in sensitive keys in common JSON, form/query-string, and key: value output before persistence or display. -SensitiveJobOutputKeys adds keys to redact. Redaction is best effort, not a complete secret scanner. MCP tool controls include -McpToolConcurrentJobLimit and -McpToolRateLimitPerMinute.

EXAMPLE

Set-PSUSetting -RedactSensitiveJobOutput -SensitiveJobOutputKeys 'tenant_secret','service_token' -LargeJobOutputBehavior Compress -MaxJobOutputSizeKB 10240

PARAMETERS

Logging and execution

Parameter	Description
-LogLevel	PSU logging level; when updated at runtime, also updates the Microsoft logging level.
-MicrosoftLogLevel	Microsoft framework logging level in configuration-file mode.
-LoggingFilePath	Log file path.
-DefaultEnvironment	Default PowerShell execution environment.
-GroomDays	Retention period in days for groomed records; default 30.
-ConcurrentJobLimit	Maximum concurrent jobs; default 1000.
-Telemetry	Enables telemetry.
-SecurityEnvironment	Environment for security processes.
-ApiEnvironment	Default API execution environment.
-ScriptBaseFolder	Root folder for scripts.
-GroomInterval	Grooming interval; default 1.
-NotificationLevel	Notification severity level.
-ProxyUri	URI for outbound proxy.
-ProxyCredential	PSU variable containing the proxy credential.
-JobHandshakeTimeout	Job handshake timeout; default 30.
-Splatting	Enables parameter splatting in execution settings.
-DontLoadProfile	Skips loading PowerShell profiles.
-LogGroomDays	Log retention period in days; default 7.
-ModuleDiscoveryFrequency	Cron expression controlling module discovery; default */15 * * * *.
-DebuggerEnvironment	Execution environment for the debugger.
-FileEncoding	Encoding used for files.
-MaxJobMemory	Maximum job memory setting.
-LargeJobOutputBehavior	Handling of oversized job output; default Warn.
-MaxJobOutputSizeKB	Maximum job-output size in KB; default 10240.
-JobRunId	Enables job run IDs.
-ApiBaseFolder	Root folder for API endpoints.
-AbandonedJobGroomDays	Days to retain abandoned jobs; default 7.
-CheckForModuleUpdates	Checks installed modules for updates.
-DisableRequiredModuleInstallation	Disables automatic installation of required modules.
-PreformattedJobOutput	Stores or presents job output in preformatted form.
-RedactSensitiveJobOutput	Enables best-effort masking of sensitive job output (off by default).
-SensitiveJobOutputKeys	Additional key names whose values should be masked in job output.
-McpToolRateLimitPerMinute	Maximum MCP tool calls allowed per minute.
-McpToolConcurrentJobLimit	Maximum concurrent jobs started by MCP tools.

Console, apps, and interface

Parameter	Description
-HideApi	Hides API navigation in the console.
-HideHomePage	Hides the home page.
-HideAutomation	Hides automation navigation in the console.
-HideDashboard	Hides app/dashboard navigation in the console.
-DisableCodeFirst	Disables code-first auto-reload (alias -DisableAutoReload).
-DefaultPage	Default console page.
-DisableUpdateCheck	Disables update checking.
-AdminConsoleLogo	Admin console logo.
-AdminConsoleTitle	Admin console title.
-HideRunAs	Hides Run As controls.
-FallbackLanguageId	Fallback language ID; default en.
-FavIcon	Favicon.
-ExperimentalFeatures	Experimental features to enable.
-DisabledFeatures	Features to disable.
-DefaultDashboardTheme	Default app theme; default AntDesign.
-UseLogoSize	Applies configured logo sizing.
-DarkTheme	Enables dark theme.
-HideEnvironment	Hides execution-environment controls.
-HideRunOn	Hides Run On controls.
-DisableFormatOnSave	Disables formatting scripts on save.
-Branding	Legacy branding configuration object.
-HideRunLater	Hides Run Later controls.
-PortalDisabled	Disables the portal.
-PortalRole	Roles allowed to access the portal.
-DefaultRunOn	Default run target.
-DisableFirstRun	Disables the first-run flow.

Security, tokens, and API

Parameter	Description
-RateLimitClientAllowList	Client identifiers exempt from rate limits.
-RateLimitIpAddressAllowList	IP addresses exempt from rate limits.
-RateLimitEndpointAllowList	Endpoint paths exempt from rate limits.
-ContentSecurityPolicy	Content Security Policy value.
-LimitIdentities	Restricts identity usage according to server settings.
-EnhancedAppTokenSecurity	Enables enhanced app-token security.
-AnonymousApiDocumentation	Allows unauthenticated access to API documentation.
-MaximumTokenLifetime	Maximum app-token lifetime setting.
-DefaultTokenLifetime	Default app-token lifetime; default 30.
-ApiSecurityModel	Security model for API requests.
-SessionTimeout	Session timeout; default 25.
-DisableDatabaseVault	Disables database-backed secrets vault.
-PasswordExpirationDays	Password expiration period in days; default 90.
-PasswordLength	Required password length; default 12.
-DisableDevolutionsAccountLogin	Disables Devolutions Account login.

Preferences and management connection

Parameter	Description
-DebugPreference	Default action preference for debug output.
-VerbosePreference	Default action preference for verbose output.
-InformationPreference	Default action preference for information output.
-WarningPreference	Default action preference for warnings.
-ErrorPreference	Default action preference for errors.
-ProgressPreference	Default action preference for progress output.
-ComputerName	PSU Management API URL or host name (alias -Uri).
-AppToken	Management API app token.
-Credential	Management API credentials.
-UseDefaultCredentials	Uses current Windows credentials.
-Integrated	Uses the in-process management client.
-TrustCertificate	Ignores certificate validation errors.
-Cookies	Reuses session authentication cookies.

PERMISSIONS

The access token requires settings.general/update to run this cmdlet remotely.