Org-level setting inheritance behavior when a Workspace Admin tries to override in Slack Enterprise Grid

Question

Goal: Determine how Slack Enterprise Grid handles an Org‑level setting when a Workspace Admin attempts to apply a conflicting local configuration.
Uncertainty: The documentation describes that Org‑level settings can be pushed to workspaces and that Workspace Admins retain local controls, but it does not specify whether the system blocks the override, silently reverts the change, or logs the conflict for Org Admin review.

Does the Org‑level setting enforce a hard block that prevents any local change by a Workspace Admin?
If a conflicting local value is saved, does the system retain the local value, revert to the Org value, or require Org Admin approval?
Are audit events or notifications generated when a Workspace Admin tries to override an Org‑mandated setting?

Tasadduq Burney · Answer

Direct Answer
If the Org Admin has marked the setting as an org‑wide policy (locked), Workspace Admins cannot change it; the UI shows a lock icon and any save attempt returns an error. If the setting is only an org default (unlocked), Workspace Admins may override it locally and the workspace value takes precedence.
Confirmed Facts

Locked settings appear read‑only with a lock icon in the Workspace Admin dashboard.
Attempting to modify a locked setting via the UI or the admin.workspaceSettings.set API results in an error response (commonly setting_locked_by_org or similar) and the change is not persisted.
Both successful changes and blocked attempts generate audit log entries (workspace_settings_changed and workspace_settings_change_failed or equivalent) visible in the Org Admin → Security → Audit Log.
Org Admins do not receive real‑time notifications by default; they must review the audit log or configure a SIEM alert on the audit log stream.

Steps to Verify (Safe, Read‑Only)

As an Org Admin, go to Org Admin dashboard → Settings → Org‑wide settings and note which settings display a lock toggle.
As a Workspace Admin, open the relevant Workspace Settings page and confirm that locked settings show a lock icon and are non‑editable.
Try to change a locked setting via the Web UI; observe the error message.
Check the Org Audit Log for the corresponding failed‑override event.

One Diagnostic Detail That May Change Recommendation
Is the setting governed by an external Identity Provider (SCIM/SAML/OIDC)? If SSO, provisioning, or session policies are enforced by the IdP, the effective value may be controlled outside Slack, and the lock behavior described above may not apply. Verify the IdP configuration and Slack's SCIM integration before assuming a Slack‑side lock is the cause.

Org-level setting inheritance behavior when a Workspace Admin tries to override in Slack Enterprise Grid

1 answer

Direct Answer

Confirmed Facts

Steps to Verify (Safe, Read‑Only)

One Diagnostic Detail That May Change Recommendation

Your perspective belongs here.

0 question comments