A Workspace Administrator has full administrative control within their assigned Workspace. They manage users, groups, partners, folders, automations, remote servers, syncs, notifications, event routing, security keys, and data governance settings, all within the boundary of their Workspace.

This access gives a team, department, or project lead self-service control over a complete set of resources without involving the Site Administrator for day-to-day work. If you're choosing how to delegate administration, see Comparing Administrative Access for the scope of each option.

Administrative Scope

Choose a Workspace around the files and integrations its administrators are trusted to manage. Workspace Administrators have full access to every file within their assigned Workspaces, including the ability to send files through Syncs and Automations. Folder permissions let them limit access for other Workspace users; those permissions do not narrow their own administrative access. Control over file movement is part of data access, even when an administrator's daily work is maintaining integrations rather than opening files.

For example, a support engineering team responsible for supplier transfers can administer a supplier Workspace containing the relevant folders, Remote Servers, Syncs, and Automations. Payroll files and their integrations can remain in a separate Workspace that the team does not administer or otherwise have access to. The team has full access to supplier data, while payroll remains outside its scope. Keep the resources for each process within its intended Workspace; creating a Workspace does not move existing files or integrations into it.

Delegate this work through Workspace Administrator access without retaining Site Administrator status for the same people. A Site Administrator has full access across the site, including every Workspace. Adding Workspace Administrator access to that account does not restrict its existing authority.

A Default Workspace user can receive Workspace Administrator access to one or more Custom Workspaces while keeping their Default Workspace account. That grant also provides Folder Admin directory visibility in the Default Workspace: they can see its users and groups without gaining authority to administer them. Default Workspace folder records remain subject to Folder Admin visibility rules.

Site Administrators can designate a user who belongs to the Custom Workspace as its administrator, or grant Admin permission on its root folder to a Default Workspace user or Group. Members of a Group with that root permission inherit the same Workspace Administrator authority as an individually assigned administrator. Each method grants administrative access to the whole Workspace. Workspace Access and Administration explains Group assignment and how membership changes affect access.

Comparing Administrative Access

Workspace Administrator access fills a gap between site-wide administration and narrower delegated permissions.

The Site Administrator can manage everything on the site, which is too broad for a team, department, or project lead.

The Folder Admin can manage a single folder's settings and permissions, which is too narrow for someone who needs to manage users, partners, and integrations.

The Group Admin manages users in one group using the capabilities enabled by Site Administrators. Group Admin access does not provide administration over the group's files, automations, or integrations.

The Partner Admin can manage users within their Partner organization but cannot manage folders, automations, or integrations.

The Workspace Administrator provides full operational control over a complete set of resources, scoped to a single Workspace.

What Workspace Administrators Can Manage

Workspace Administrators manage all resources within their Workspace on a self-service basis. They do not need to involve the Site Administrator for day-to-day operations.

User Management

Workspace Administrators handle the full user lifecycle within their Workspace: creating individual users, bulk creating users through CSV import, resetting passwords, disabling and re-enabling accounts, offboarding users, setting access expiration dates, configuring protocol privileges, managing IP whitelists, and creating user lifecycle rules to automatically disable or delete inactive accounts.

Group Management

Workspace Administrators create groups, update group memberships, and assign Group Admins within the Workspace.

Partner Management

Workspace Administrators onboard and offboard Partners, create and manage partner users, designate Partner Admins, and configure Partner Admin settings to control what Partner Admins can do within their Partner organization.

Folder and File Management

Workspace Administrators create folder structures and assign and manage folder permissions for users, groups, and partners. They designate Folder Admins for specific folders and apply folder settings for folders within their Workspace.

Data Governance

Workspace Administrators configure data governance policies within their Workspace through the Data Governance section. The following capabilities are available.

Data Retention

File Expiration: automatically remove folder contents after a specified period.
Archive Removed Files: archive files when they are removed rather than permanently deleting them.

Data Restrictions

File Extension Limits: restrict uploads to specified file extensions on a folder.
File Name Length Limits: limit the length of uploaded file names.
File Name Regex Limits: restrict file names to a regular expression pattern.
Folder Locks: prevent changes to the folder structure.
Malware Scanning: scan files uploaded to a folder and quarantine infected files.
Watermark Previews: apply watermarks to file previews.

Organization

Organize Files: automatically move uploaded files into subfolders based on rules.
Automatically Create New User Folders Here When Users Are Created: automatically create a personal folder for each user.
Metadata Categories: define custom metadata fields for files and folders.

Storage Regions

Storage Regions: assign a storage region to specific folders within the Workspace. Region selection is recursive.

Restore

Restore Files and Folders: restore deleted files and folders within the Workspace.
Restore Users: restore deleted users within the Workspace.

Automations and Integrations

Workspace Administrators create and manage automations, remote servers, remote server mounts, and syncs. They can configure these only on folders within their Workspace. They cannot create automations, syncs, or mounts on folders outside their current Workspace.

For a Remote Server using dedicated-IP routing, they can select an eligible Custom Domain assigned to their Workspace or shared from the Default Workspace. This lets them match a counterparty's source-address allowlist without administering the domain itself. See IP Addresses Used For Connection.

Workspace Administrators create and manage share links, configure share link permissions and expiration, create inboxes for receiving files from external parties, set up share groups, create custom forms, and configure public hosting for Workspace folders.

Encryption

Workspace Administrators manage keys for two different purposes within their Workspace: SFTP/SSH keys authenticate users, while GPG keys support file encryption and decryption.

SFTP/SSH Keys

Workspace Administrators create and manage SFTP/SSH keys for Workspace users, revoke keys, and configure SFTP/SSH Key Lifecycle Rules to automatically expire or rotate keys on a schedule.

GPG

Workspace Administrators manage GPG keys in the GPG Key Manager for use with folder-level encryption and decryption. They configure GPG Encryption, GPG Decryption, and GPG Recryption as folder settings within their Workspace, and set GPG Key Lifecycle Rules to expire or rotate GPG keys automatically.

AS2

Workspace Administrators create and manage AS2 identities, configure AS2 trading partners, and manage AS2 certificates for Workspace-level B2B file exchanges.

Notifications

Workspace Administrators create and manage email notifications, webhooks, Amazon SNS notifications, Google Pub/Sub notifications, Slack notifications, and Microsoft Teams notifications for events within the Workspace.

Event Channels

Workspace Administrators create and manage Event Channels Targets, Subscriptions, and Channels within their Workspace. They can view Events and Delivery Attempts scoped to their Workspace.

What Workspace Administrators Cannot Manage

Workspace Administrator authority is limited to the assigned Workspaces. The following site-wide resources remain under the exclusive control of Site Administrators:

Site-wide security and protocol settings, including FTP, SFTP, and WebDAV configuration, ciphers, host keys, certificates, and 2FA requirements.
Authentication, including SSO provider integrations and site-wide authentication configuration.
Monitoring and logging, including SIEM integrations, site-level logs, and usage reporting.
Billing and site administration, including billing, Workspace creation, child site creation, and clickwraps.
Site customization and infrastructure, including creating, editing, deleting, and allocating addresses for Custom Domains, site branding, custom SMTP, and all other site-level customization. Workspace Administrators can select available Custom Domains for outbound Remote Server routing, but cannot access the Custom Domains settings page.
File integrity, including checksum and file integrity settings.

When Root Folder Settings Apply to All Workspaces is enabled, a Workspace can inherit four site-root folder settings: File Expiration, Limit Uploaded Files to Certain File Extensions, Limit Uploaded Files to Regular Expression, and Malware Scanning. Workspace Administrators can see these inherited settings but cannot edit or remove the site root's own settings. They also cannot create, change, or remove exceptions that switch off an inherited site-root setting, such as Never delete files in this folder. Those actions require a Site Administrator.

Workspace Administrators can still configure different File Expiration, file-extension limit, or regular-expression limit values on their Workspace's root folder or any folder within it. This lets them adapt retention and naming requirements to their workflows without changing the shared site-root defaults. The Workspace's setting takes precedence within its scope, including when it is less restrictive than the site-root rule. Inherited Malware Scanning cannot be overridden or disabled. Restrict Root Folder Settings to Site Administrators on its own does not restrict settings on another Workspace's root folder; protection of inherited site-root settings reaches that Workspace only when Root Folder Settings Apply to All Workspaces is enabled.

Workspace Administrators coordinate with the Site Administrator when they need changes to anything above. Common examples include troubleshooting failures that require access to site-level logs, updating 2FA requirements, configuring SSO, setting up SIEM integrations, adjusting protocol settings, and creating new Workspaces.

Delegating Administration Within a Workspace

Workspace Administrators can further delegate administration within their Workspace by granting narrower administrative permissions to Workspace users. Folder Admins manage folder settings and permissions for specific folders within the Workspace. Group Admins manage users within their assigned group inside the Workspace, drawing on whichever user-management capabilities the Site Administrator has enabled site-wide (create, add/remove existing users, edit, enable/disable, delete, set and reset passwords, and exempt from User Lifecycle Rules). Partner Admins manage users within their Partner organization inside the Workspace.

Group Admin account-management capabilities never apply to Site Administrator or Workspace Administrator accounts, even when an administrator's Primary Group is one of the groups they manage. Enabling more Group Admin capabilities does not give them authority to manage those administrator accounts.

Delegation lets the Workspace Administrator distribute onboarding, offboarding, and day-to-day management responsibilities across their team without giving every user full Workspace administration.