Deliver server-managed settings

Use server-managed settings to deliver organization policy when a user signs in to Glean Tau. Work with your Glean representative to configure delivery and confirm the supported client release.

Choose server-managed delivery

Server-managed settings suit account-based restrictions and preferences that should follow the signed-in Glean account. Use protected device policy when a restriction must apply before the first successful sign-in or remain in effect after sign-out.

Server-managed delivery doesn't enroll the device, install the app, assign a mobile device management profile, or grant macOS privacy permissions. It doesn't provide a self-service policy editor in every Admin console.

Before rollout, confirm the following with Glean:

• The accounts and organizations that receive the policy
• The client versions that understand every setting
• The intended result when a device also has local policy
• The update and recovery process for your deployment

Combine account and device policy

For ordinary preferences, protected device sources take priority over server-managed settings. For security restrictions, every applicable source contributes to the final limit.

For example, a server policy that permits Full access can't override a device policy that excludes it. An account change doesn't clear a device restriction.

See Policy precedence for the complete order.

Understand refresh and outage behavior

Glean Tau checks server-managed settings at sign-in and polls for updates every 10 minutes. A successful response records a new acceptance time.

The response or failure determines what happens next:

Condition	Result
Valid policy response	Applies the accepted account policy
Valid empty response	Removes account overrides from this source. Device restrictions remain.
Temporary connection failure	Keeps the accepted policy for at most 30 minutes from the last successful response
Authentication rejection or invalid policy content	Blocks affected work rather than accept an untrusted replacement
Cached nonempty policy expires	Blocks agent work until a valid response restores policy health
Empty optional policy expires	Remains optional, with stale policy health

Glean Tau doesn't keep a durable offline copy of account policy. Don't assume that restarting the app preserves an account-policy cache or permits indefinite offline operation.

A device that hasn't yet fetched optional account policy can't rely on it for first-launch protection. Use protected enrollment for that requirement. See Require policy on a device.

Handle sign-out and account changes

Signing out clears account policy. Signing in with another account loads policy for that account. Protected device policy and enrollment remain in place across both operations.

If a policy problem starts after an account switch, verify the active account and policy source before changing device management. Signing in again can resolve an authentication problem. It doesn't repair a malformed file, unsafe registry permissions, or an incompatible sandbox requirement.

Test changes before broad rollout

Use a pilot account and a managed device to test the complete lifecycle:

1. Sign in and verify a managed preference and a security restriction.
2. Change policy and verify the new result after refresh.
3. Test a temporary network outage and policy recovery.
4. Sign out, switch accounts, and confirm device restrictions remain.
5. Restart and confirm the intended startup behavior.

Coordinate restrictive changes with users. A new restriction can block further work or withdraw feature access. It can't reverse a change already made in a connected service.

See also

• Troubleshoot managed settings — find policy failures and restore a valid configuration