Skip to main content

Settings

The Settings page provides centralised configuration for the Beak AI Security module. The subtitle reads "Configure global security module settings." The page is organised into three tabs. General and Deployment are described below. Notifications holds the tenant SMTP relay every Email alerting channel sends through, and is documented with the alerting stack it serves in AI Gateway — Settings; it appears only for tenants entitled to AI Governance. The active tab is preserved in the URL query string so links to specific sections can be shared or bookmarked.

Two areas that used to be tabs here now have menus of their own, and their old links redirect: connectors are on the Integrations page, and roles and role assignment are under Administration → Users & Roles.

General Tab​

The General tab is the landing tab for the Settings page. It provides the surface for global enforcement-level preferences and notification settings that apply across the entire security module. This is the central place to set tenant-wide defaults before configuring deployment channels; connectors are configured on the Integrations page.

Deployment Tab​

The Deployment tab is the operational hub for rolling out the Beak AI browser extension to user devices. It provides the Browser Extension download packages and step-by-step installation guides for every deployment channel.

Browser Extension​

The Browser Extension section opens with a description: "Install the Beak AI browser extension and pair users to this tenant. Each tenant gets one-time activation codes users paste into the extension popup." A Pair new user button in the top-right corner opens the same Pair User Dialog available from the Devices page.

Downloads​

The Downloads card provides extension packages for three distribution variants, each with two download options:

  • Chrome / Edge (Generic) — beak-aisec-generic.zip for self-service load-unpacked installs, and beak-aisec-generic.crx for enterprise push scenarios. Suitable for individual users who install by extracting the zip and selecting Load unpacked in chrome://extensions.
  • Microsoft Defender — beak-aisec-defender.zip and beak-aisec-defender.crx. Designed for enterprise push via Microsoft Intune using a force-list policy; supports silent activation and the auto-protect managed-schema setting.
  • Sophos — beak-aisec-sophos.zip and beak-aisec-sophos.crx. Designed for push via Sophos Central Device Management with SIEM forwarding support.

Note: The .zip download is recommended for self-service installs. The .crx is intended for enterprise push only; Chrome blocks drag-and-drop installation of self-signed CRX packages.

Installation Guides​

Four step-by-step installation guides are provided, covering every common deployment channel:

  • Self-service (individual users) — Download the Generic .zip, extract it, enable Developer mode in chrome://extensions, click Load unpacked, select the extracted folder, open the extension popup, and pair the device using a code issued from Devices.
  • Microsoft Intune (managed) — Create an Administrative Templates configuration profile in Intune, set the Extension install force list with the Defender extension ID and update URL, optionally configure the managed-schema policy (backend_url, auto_protect, allow_user_disable), assign to target groups, and issue activation codes for each user.
  • Sophos Central — In Sophos Central, go to Endpoint Settings → Web Control → Application Control, upload the Sophos variant .crx and managed policy JSON, enable SIEM forwarding using the siem-integration.json template, deploy to endpoint groups, and pair users using activation codes.
  • Group Policy (Windows Active Directory) — Copy the ExtensionInstallForcelist registry template from the chosen variant directory into a GPO, apply it to the target OU, and pair users individually via activation codes after the policy propagates.

Integrations​

Integrations are no longer a tab on this page. Anthropic inference hooks, Microsoft Copilot Studio, Power Platform, Agent 365, Defender XDR, Sentinel, Defender for Cloud Apps, Purview and Teams are all on the Integrations page, grouped by what each one does or by vendor. A link to Settings → Integrations redirects there.

Roles & Permissions​

Note: This is no longer a tab on the Settings page. It is now Administration → Users & Roles, which carries one tab per product; a link to Settings → Roles redirects there. The behaviour below is unchanged.

Roles and permissions control who may use Beak AI Security and what they are allowed to do inside it. Every management action in the module — editing a policy, resolving a review-queue item, running a red-team campaign, changing these settings — is checked against the permissions carried by the signed-in user's roles.

Access to the tab is itself permission-gated. Viewing it requires authz:read; without that permission the tab renders a notice to ask a Security administrator for access. Making changes requires authz:manage, and a user holding only authz:read sees the data read-only with the create, edit, assign, and delete controls hidden.

The tab is made up of three sections.

Roles​

Roles are named permission bundles scoped to this product. The table lists each role's name and description, and marks its provenance with badges — system for roles supplied and maintained by the platform catalog, and inactive for roles that exist but grant nothing.

  • System roles are read-only. They can be opened and inspected but neither edited nor deleted, because the catalog owns their definition and would overwrite any local change.
  • Custom roles are fully editable. Create one to grant a narrower set of permissions than any system role offers — for example a reviewer who may clear the review queue but may not change policies.

Deleting a custom role takes effect immediately: every user assigned to it loses its permissions at once, so confirm nobody depends on it first.

Users​

The Users section lists the platform users in this tenant alongside the Security roles each one holds. Each row shows the user's name, their email and internal user ID, and a badge per assigned role — or No roles when none are held.

Selecting a row (or Assign roles) opens the role-assignment dialog for that user. Beak AI Security does not create accounts or hold passwords; identity lives in Beak IAM, and a person appears in this list once they exist as a platform user in the tenant. What you manage here is their access, not their account.

Audit Trail​

The Audit trail section records the fifty most recent authorization-management changes — role creations, edits, deletions, and role assignments. Each entry names the change, the administrator who made it, and the timestamp. Hovering an entry reveals the full change detail.

This is the record to consult when someone's access changes unexpectedly. It covers changes to authorization itself; for security events — prompts blocked, policies fired — see the Audit Log instead.

Note: The two are easy to confuse. The Audit trail here answers "who changed permissions"; the Audit Log page answers "what did the module do to a request".

Best Practices​

  • Grant authz:manage sparingly — It is the permission that lets someone grant themselves anything else; treat it as the module's most privileged capability.
  • Prefer a custom role over broad system roles — When a person needs one narrow capability, a purpose-built role is easier to audit later than an over-broad assignment nobody remembers making.
  • Check the audit trail after any access change — It is the only record of who granted what, and it holds just the latest fifty entries.
  • Deploy the correct variant for each channel — Use generic for self-service installs, defender for Intune-managed Windows fleets, and sophos for Sophos Central-managed endpoints; mixing variants can cause unexpected policy application.
  • Choose the right installation channel — Use self-service load-unpacked for individual users, Intune force-list for managed Windows fleets, Sophos Central for Sophos-managed endpoints, and Group Policy for on-prem AD-joined devices.
  • Test integrations after every credential rotation — Use the Test connection button after rotating Entra app secrets or updating webhook URLs to confirm the dispatch pipeline is healthy before an incident occurs.
  • Set a minimum severity for Teams notifications — Without a min_severity filter, every block event generates a Teams message; set the minimum to high or critical to keep the channel signal-to-noise ratio manageable.
  • Pair the Sentinel integration with a retention policy — Beak forwards every moderation audit to the Log Analytics table; configure a suitable retention period in your Sentinel workspace to manage storage costs.
  • Re-check the Inference hooks policy after renaming a policy — The selection is stored by policy name, so renaming or deactivating the selected policy stops enforcement for Claude prompts. The field flags this state, but it is worth confirming after any policy rename.
  • Keep an organization-wide policy in place for Claude prompts — Only policies scoped to the whole organization are evaluated on this surface; a policy scoped to a user or group will never apply, however it is configured.
  • Overview — High-level product overview for Beak AI Security.
  • Devices — Issue activation codes and manage paired browser extensions.
  • Incidents — View incidents mirrored to Defender XDR and Teams; the dispatch status is visible in each incident's detail panel.
  • Shadow AI — Usage aggregates that can be surfaced in Defender for Cloud Apps once the MCAS integration is configured here.
  • Dashboard — Role-scoped security posture dashboards for the whole tenant.