> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/developer-machines/installation/settings.md).

# Settings

The **Settings** page manages organization-wide Dev Machine Guard configuration: the telemetry key that agents authenticate with, the scan schedule that controls how often devices run a full scan, the device-activity threshold that controls when a device is marked inactive, and whether the Linux environments (WSL distributions) on Windows devices are scanned.

These settings apply to every device in your organization.

### Telemetry Key

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2F1LIjzKiVyeozqNJVwx9x%2FScreenshot%202026-08-07%20at%2015.55.14.png?alt=media&amp;token=ae5da1c6-98fc-4ec3-bdb7-74777b2a7d4e" alt=""><figcaption></figcaption></figure>

Dev Machine Guard agents authenticate to the StepSecurity backend using a telemetry key. The key is used by all Dev Machine Guard agents on your tenant.

{% hint style="info" %}
Viewing or rotating the telemetry key requires the Dev Machine Guard **write** permission. Without it, this section shows a message in place of the key controls.

Access levels are set per feature on a role. See Roles for how permissions are assigned, or contact your admin.
{% endhint %}

The backend supports two keys, **Primary** and **Secondary**, and accepts either one. This lets you rotate keys without downtime: agents keep using their baked-in key until they are redeployed.

**Fields**

* **Key selector**: switch between the **Primary** and **Secondary** key.
* **Key value**: masked by default. Use the reveal (eye) icon to view it and the copy icon to copy it.
* **Rotate**: generate a new value for the selected key.
* **Last rotated**: shows when the selected key was last rotated (`Never` if it has not been rotated).

#### Rotating the telemetry key

Because the backend accepts either key, rotate in this order to avoid interrupting agents:

1. Rotate the **Secondary** key.
2. Redeploy your fleet with the new Secondary key so agents pick it up.
3. Rotate the **Primary** key.

Agents continue authenticating with their baked-in key until they are redeployed, so following this order ensures no device loses connectivity mid-rotation.

### Scan Schedule

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FueEDlx5X7iaIawByP0rT%2FScreenshot%202026-08-07%20at%2015.55.22.png?alt=media&amp;token=2ad9a5d9-3d43-4760-9897-c85e1a07baba" alt=""><figcaption></figcaption></figure>

Scan Schedule controls how often each device runs a full scan.

Agents check in with StepSecurity every few minutes and scan when one is due. A change here therefore reaches your whole fleet on the next check-in, without redeploying agents and without touching your MDM.

The default is a full scan every 4 hours.

{% hint style="warning" %}
Agents older than **1.15.0** ignore this schedule and scan on every launch. Upgrade to 1.15.0 or later for schedule changes to take effect on a device.
{% endhint %}

**Fields**

* **Full scan every (minutes)**: the interval between full scans. Enter a value in the **Minutes** field. A human-readable equivalent appears beside it, so `240` displays as *4 hours*. Between scans, agent launches check in and exit without scanning.
* **Add temporary boost**: opens the Temporary boost panel.
* **Save schedule**: applies your changes.

#### **Temporary boost**

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FUTUzIg3QPnPdGJa5Eeop%2FScreenshot%202026-08-07%20at%2015.55.29.png?alt=media&amp;token=168f26e6-5971-43ae-958e-cc27c4c583fc" alt=""><figcaption></figcaption></figure>

A temporary boost scans more aggressively for a limited period, for example during an incident, and then reverts to the regular schedule automatically at the end time. You do not need to remember to change it back.

Select **Add temporary boost**, then set:

* **Every (minutes)**: the scan interval to use while the boost is active. Defaults to `60`.
* **until**: the date and time the boost ends.

Select **Save schedule** to apply the boost. To end a boost before its scheduled end time, select **Remove boost** and then **Save schedule**.

### Device Activity

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FbFJOS702gWQ6mddzApPM%2FScreenshot%202026-08-07%20at%2015.55.37.png?alt=media&amp;token=55c2d479-7e95-49d2-bd18-328bbe31441a" alt=""><figcaption></figcaption></figure>

Device Activity controls when a device is marked inactive in the device list. This applies to every device in your organization.

**Current setting** shows the active threshold in plain language, for example: *Devices are marked inactive after 3 days without telemetry.*

**Inactive after (days)**: mark a device inactive once it has not reported telemetry for this many days. Enter a value in the **Days** field and select **Save device activity** to apply it.

{% hint style="info" %}
This is the same threshold exposed as **Inactive threshold** in Step 3 of the [Script](/developer-machines/installation/script.md) wizard. Changing it in either place updates the organization-wide setting.
{% endhint %}

This is the same threshold exposed as **Inactive threshold** in Step 3 of the Script wizard. Changing it in either place updates the organization-wide setting.

### WSL Scanning

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FHaHL032XD1LzD0W1clih%2FScreenshot%202026-09-30%20at%2014.16.59.png?alt=media&amp;token=d1856de6-a2c5-4d61-885a-7cdba4ce8d1d" alt=""><figcaption></figcaption></figure>

WSL Scanning controls whether Dev Machine Guard scans inside the Linux environments (WSL distributions) on your Windows devices. A distribution has its own packages, credentials, and AI tooling that a scan of the Windows host cannot see. Each scanned distribution appears as its own device, linked to its Windows host.

WSL Scanning is off by default. While it is off, WSL distributions are still detected on the Windows host but are not scanned. **Current setting** shows the active state in plain language, for example: *WSL distributions are detected but not scanned.*

To turn it on, enable **Scan WSL distributions** and select **Save WSL setting**. The setting applies to every Windows device in your organization.

{% hint style="info" %}
Only distributions that are already running are scanned. Dev Machine Guard never starts a stopped distribution, so coverage builds up as developers use their WSL environments. A running distribution is scanned on the same Scan Schedule as any other device, and distributions whose default user is root are skipped.
{% endhint %}

{% hint style="warning" %}
WSL Scanning requires agent **v1.17.0** or later on the Windows host.
{% endhint %}

### Credential Scanning

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FiJNolQqclNq49WqbObmH%2FScreenshot%202026-09-30%20at%2014.17.44.png?alt=media&amp;token=c1959d69-bc9e-4f95-ad7e-151639c453a4" alt=""><figcaption></figcaption></figure>

Credential Scanning controls whether devices collect the credential-location inventory shown on the Credentials page. It is on by default. **Current setting** shows the active state, for example: *Devices report where credentials are stored.*

To turn it off, disable **Collect credential inventory** and select the save button in this section. Supported agents apply the change on their next check-in.

While Credential Scanning is off:

* Devices skip the credential scan entirely. No credential file is read and no credential data is uploaded.
* Credential inventory is hidden across the console.
* Forced or on-demand scans still respect the setting, so a local override cannot turn credential scanning back on.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stepsecurity.io/developer-machines/installation/settings.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.