Recommended configurations

Pick the profile closest to your risk appetite, apply it, and relax individual settings with a documented reason.

Setting	Strict	Balanced	Open
Sign-in	IdP, Enforce on	IdP, Enforce on	IdP
Auditor role	Yes, compliance	Yes	Optional
Rules	Detailed policy	Short policy	Tone only
Conversation retention	90 days	365 days	Keep
Saved workspace	0 days	14 days	30 days
Published pages	7 days	30 days	90 days
Sandbox internet	No internet	Only some domains	The internet
Web search	Off	Selected group	Everyone
Memory	Off, then pilot	On, shared proposals reviewed	On
Models	Fixed default, no picker	Pickers for selected groups	Everyone chooses
Agents	Off	Admins, then selected	Selected
Mail and Files connectors	Files read only	Mail, Files, Calendar	+ Send mail (approval)
Connector open catalog / member servers	Off / Off	Off / Off	On / Off
Tool permissions	Writes ask, sensitive deny	Defaults	Defaults
Local files and commands	Off	Read only	Read/write, ask
Desktop audit detail	detailed	metadata	metadata
Limits	Week + month per person, alerts	Month per person, alerts	Org budget only
Insights	Off	Off	Optional

Tip

Start Strict for a pilot group of 10 to 20 people, review the audit log and usage after two weeks, and widen by adding groups, not by loosening settings for everyone.

A rollout path

1. Week 0: configure Sign-in, rules, retention, sandbox and budget. Invite admins and auditors.
2. Week 1: pilot group with the Strict or Balanced profile.
3. Week 3: review usage, requests and audit entries. Adjust limits and rules.
4. Week 4: widen to departments, one group at a time, enabling connectors and memory as each team is ready.