Workspace Configuration

The Workspaces page lists the PlaidCloud workspaces you can manage. Use it to create a workspace, edit workspace settings, open the workspace, open dashboards, open the SQL console, view logs and metrics, or apply bulk actions to selected workspaces.

Caution

Delete removes the workspace and its associated data. Confirm backups and retention requirements before deleting a workspace.

Workspace List

The workspace table includes name, unique ID, version, release channel, status, paused state, created date, provisioning state, cluster, maintenance day, and maintenance time. The table supports search, refresh, row actions, and bulk actions.

Available row actions include:

Action	Description
View	Open read-only workspace details.
Edit	Change workspace configuration.
Delete	Delete the workspace.
Home	Open the workspace application.
Dashboards	Open the workspace dashboard service.
SQL	Open the workspace SQL console.
Logs & Metrics	Open operational logs and metrics for the workspace.

The four service actions — Home, Dashboards, SQL, and Logs & Metrics — appear only on a workspace that is running and only for the services that workspace has enabled. A workspace still being created shows no service icons at all, so there is no link to click that leads nowhere.

Provisioning Status

Creating a workspace takes several minutes, and until it finishes the workspace exists but cannot be opened. The Created, Status, and Provisioning columns tell you where it got to, and the Provisioning tab on the workspace details dialog shows the same information for one workspace along with the service URLs currently published for it.

Column	What It Tells You
Created	When the workspace record was created. This is also when its first provisioning attempt started.
Status	The phase provisioning is on, such as activating. A finished workspace reads running.
Provisioning	The phase collapsed into one word: provisioning, running, failed, paused, trashed, or deleting.

A workspace that stays in the same phase for more than about half an hour has stalled, and one reading failed has stopped. Either way, contact PlaidCloud support with the workspace ID and the phase shown — the detail of what failed names PlaidCloud’s internal components, so it is held in the PlaidAdmin area rather than shown here.

Note

A workspace can look healthy in deployment tooling while still not being usable, because deployment finishing is not the same as the workspace finishing its own setup. The Provisioning column reports the workspace’s own setup, which is the one that decides whether you can sign in.

Single Sign-On

Let people sign in to a workspace with your company’s identity provider instead of a separate PlaidCloud password. On the Workspaces page, choose Single sign-on on the workspace. The dialog lists the current Sign-in options, each with its state (On or Off), Test sign-in, and Remove, and adds new ones under Add an identity provider.

Plans and Sign-In Methods

Every plan, including Free (Sandbox), includes password sign-in with multi-factor authentication (MFA) and social sign-in with Google, Microsoft (personal or organizational “common” sign-in), and GitHub. Higher plans add enterprise single sign-on with your own identity provider:

Plan	Adds
Free (Sandbox)	Nothing beyond the sign-in methods every plan includes
Starter	Nothing beyond the sign-in methods every plan includes
Team	SAML
Business	Microsoft Entra ID and Okta
Enterprise	Other OpenID Connect providers and SCIM

Each plan includes everything on the plans below it. On Free (Sandbox) and Starter, the Single sign-on dialog shows an upgrade note instead of the identity provider choices.

If you downgrade, providers you already added stay listed and you can still remove them, but you can’t add new ones the plan doesn’t include.

Add an Identity Provider

1. Choose the Identity provider: Microsoft Entra ID, Okta, or Other (OpenID Connect), as your plan allows.
2. Copy the Redirect URI with Copy and register it in your identity provider as described below.
3. Fill in the fields for your provider and choose Add provider.
4. Choose Test sign-in, which opens your workspace so you can sign in through the new provider in a private window. Test it before telling your team.

Provider	Register in your identity provider	Enter in PlaidCloud
Microsoft Entra ID	In the Microsoft Entra admin center, register an app (Web platform) with the redirect URI, add a client secret under Certificates & secrets, and add the optional email claim to the ID token under Token configuration.	Directory (tenant) ID, Client ID, Client secret
Okta	In the Okta Admin Console, create an OIDC Web Application with the redirect URI as its sign-in redirect URI, and assign the people who should have access.	Okta domain (for example acme.okta.com), Client ID, Client secret
Other (OpenID Connect)	Register a confidential web client with the redirect URI.	Button label, Discovery URL, Client ID, Client secret

For Other (OpenID Connect), PlaidCloud reads the endpoints from the discovery URL. If it can’t read a configuration from there, or the issuer is on a different site from the discovery URL, select Enter endpoints manually and fill in Issuer, Authorization URL, Token URL, JWKS URL, and optionally Userinfo URL (optional). Provider addresses must be public hosts that PlaidCloud can reach.

The Button label is the name people see on the sign-in page, for example Acme SSO.

Existing Accounts and Email Verification

• Someone who already has a PlaidCloud account with the same email links it by signing in to that account once. PlaidCloud never links accounts on the strength of a matching email alone.
• Trust email addresses from this provider (new people skip email verification) is off by default. New people verify their email address the first time they sign in. Turn it on only when your identity provider guarantees the addresses it sends.

Remove an Identity Provider

Choose Remove beside the provider. People can no longer sign in with it. Accounts they already have stay, and they can reset a password to sign in.

Bulk Actions

Select one or more workspaces to use bulk actions.

Bulk Action	Description
Set Version	Pins selected workspaces to a chosen version. All selected workspaces must use the same release channel.
Pause	Pauses selected workspaces.
Unpause	Restores selected paused workspaces.

Primary Settings

Primary settings identify the workspace, assign ownership, and control release behavior.

Setting	Description
Name	Display name for the workspace.
ID	Unique workspace identifier. This becomes part of the workspace identity and is set during creation.
Memo	Optional description or administrative note.
Organization	Organization that owns the workspace.
Owner	Owner email for the workspace.
Data Center (Cluster)	Data center or cluster where the workspace runs.
Release	Release channel: Rapid, Regular, Stable, or No Release (pinned).
Version	Specific deployed version.
Active	Marks the workspace as active.
Paused	Pauses workspace operation without deleting the workspace.
Invite Link Lifespan	How long new-user invitation links remain valid. Options are 12 hours, 1 day, 2 days, 3 days, 5 days, 7 days, 10 days, and 14 days.

Release Options

Release	Typical Use
Rapid	Receives updates earliest. Use for workspaces that can accept faster product change.
Regular	Default update cadence for most workspaces.
Stable	Slower cadence for workspaces that prioritize update stability.
No Release (pinned)	Keeps the workspace on the selected version until an administrator changes it.

The maintenance window determines when automatic release updates are applied.

Automatic Release Updates

PlaidCloud publishes new releases continuously and delivers them to your workspaces automatically. You don’t request or install an update — when a release reaches a workspace’s release channel, PlaidCloud upgrades the workspace during its maintenance window. The release channel decides how quickly a release arrives; the maintenance window decides what time of day the upgrade lands.

How a Release Reaches a Workspace

1. PlaidCloud publishes a release to a channel. Rapid receives it first, then Regular, then Stable.
2. Everyone in the organization receives an advance-notice email at least seven days before the upgrade, naming the release and the date it applies.
3. On the workspace’s first maintenance window after that notice, PlaidCloud upgrades the workspace to the release. The default maintenance window is Sunday at 02:00 UTC — set the day and time under Maintenance.
4. The workspace’s Version updates to the new release. No action is required from you or from workspace users.

Because a workspace only upgrades inside its own maintenance window, updates land at a predictable, low-traffic time, and the seven-day notice gives every organization time to plan around the change.

Opt Out by Pinning a Workspace

To hold a workspace on its current version, set its Release channel to No Release (pinned). Automatic upgrades skip a pinned workspace, and it stays on its selected version until an administrator picks a new version or moves it back onto a channel. Pin a workspace when it must stay fixed — for example, through a validation cycle or a regulated close.

Pinning stops future upgrades only; it doesn’t reverse an upgrade that already applied. To move a pinned workspace forward again, choose a specific Version or select the Rapid, Regular, or Stable channel, and the workspace rejoins the automatic schedule.

Theming

Theming settings customize branding across workspace entry points.

Setting	Description
App Logo	Logo shown in the workspace application.
Splash Screen Logo	Logo shown on the workspace splash or sign-in screen.
Superset Logo	Logo shown in the dashboard service.
Superset Custom Themes	Custom dashboard color themes available to the workspace.

Services

Service settings enable optional applications and supporting services inside the workspace.

Setting	Description
JupyterHub	Enables hosted notebook access for workspace users.
Web SQL Console (CloudBeaver)	Enables browser-based SQL access.
Dashboards (Apache Superset)	Enables the dashboard service.
User Forms & Workflows (Forms Flow)	Enables forms and workflow app support.
Changed Data Capture (Apache Flink)	Enables changed-data-capture processing.
SFTP Access and Web UI	Enables SFTP access and the SFTP web interface.
Use PlaidCloud Proxy Download	Routes downloads through the PlaidCloud proxy path.
Activate Vector Database (Weaviate)	Enables vector database support.
Activate Custom App Sandbox	Enables custom app sandbox support.
Activate Project Management App	Enables the project management application.

Some services may require additional provisioning outside the control-plane form before users can use them.

Lakehouse

Lakehouse settings control external database connectivity and extra database users.

Setting	Description
Enable External Database Access	Allows external clients to connect to the workspace lakehouse.
Allowed CIDRs	Comma-separated CIDR ranges that are allowed to connect. Leave blank if no allow list is needed.
Denied CIDRs	Comma-separated CIDR ranges that are denied.
Additional Lakehouse Users	Extra lakehouse usernames and passwords for database access.

Use the narrowest CIDR ranges that support your users and integrations. Remove unused lakehouse users when access is no longer needed.

Maintenance

Maintenance settings define the workspace’s preferred update window.

Setting	Description
Day	Day of week for maintenance: Sunday through Saturday.
Time	Time of day in 15-minute increments.

Release-channel upgrades use the workspace maintenance window. Pinned workspaces are skipped by automatic release-channel upgrades until an administrator selects a new version or channel.