When you create tenants from a template, you can decide ahead of time which integrations and custom MCP capabilities those new tenants should start with switched off. These access defaults are part of the template, so every tenant you create from it begins with the same starting restrictions instead of fully open access you then have to lock down by hand.
This article covers where to set the defaults, how they apply to new tenants, and how they work alongside your organization-wide policy.
Where to find it
In Admin, go to Workshop, then Templates, and open the template you want to edit. On the template's Settings page, choose Continue to move to the Integrations & Tools page, where you set the access defaults. When you are done, choose Publish template to save.
Saving happens in two steps: Continue on the Settings page saves the template's settings and takes you to the Integrations & Tools page, and Publish template on that page saves the access defaults (and the Beta features setting, which now lives here too). You can use Back to settings to return without losing what you have entered.
Available integrations
Each integration has a toggle. Turning an integration off here means it starts off in every tenant you create from this template, so the AI assistant in those tenants cannot connect to it or use its tools until a tenant admin turns it back on.
These are starting points, not permanent locks. After a tenant is created, its admin can adjust the tenant's own Integrations & Tools settings like any other tenant. The defaults only decide what the tenant looks like on day one.
Custom MCP defaults
Under Feature Access you can set two custom MCP defaults for new tenants, matching the controls on the live Integrations & Tools page:
Allow MCP creation decides whether users in the new tenant can register their own custom MCP servers.
Allow MCP use decides whether the new tenant can run, inspect, or authorize any registered custom MCP server.
For a full explanation of what these two controls do and how they interact, see Managing Integration & Custom MCP Access. If you previously used the single "Custom MCP" toggle on templates, it has been replaced by these two controls so template defaults line up exactly with the live policy page.
How defaults work with your global policy
Template defaults are additional starting restrictions layered on top of your organization-wide policy. They can only add restrictions to a new tenant; they can never loosen something your global policy denies.
Anything your global policy already denies shows as locked here, labeled "Locked by global policy." You cannot toggle those rows from the template, because the global policy already applies to every tenant automatically and always wins.
Defaults apply at creation only. They are copied into a tenant when it is created from the template. Editing a template's defaults later does not change tenants that already exist.
Your global policy keeps applying live. If you later deny an integration org-wide, it is denied in every tenant immediately, regardless of what any template's defaults said.
Troubleshooting
A row is locked and says "Locked by global policy": your organization-wide policy already denies it for every tenant, so it cannot be changed from the template. To allow it, re-enable it on the global Integrations & Tools page in Admin Settings.
A new tenant came out more restricted than expected: check both the template's access defaults and your global policy. The tenant starts with whichever restrictions either of those applied. The tenant's admin can relax the template-seeded defaults, but not anything the global policy denies.
Editing a template did not change an existing tenant: that is expected. Defaults are applied only when a tenant is created. Adjust an existing tenant from its own Integrations & Tools settings.