Clients
The canonical client list that billing groups by. Techs pick from this list when promoting meetings, so the same client can't sprout different spellings. Adding a client is a governed action — keep this list tidy. Use Import from board once to pull in the clients already in use, then curate.
Shared settings. A change here applies to every instance that uses this database, production included, within about 30 seconds.
Loading clients…
Add a client
Move clients out of tags
A card’s client used to be its first tag. This writes that client into the client field instead and removes the tag, so tags go back to being tags. Preview first and read it — anything this can’t decide safely is listed for you rather than guessed at, and a card whose client tag isn’t first is never moved automatically, because that would change what it bills to.
Company links
Shared links shown in the header Company Links menu. Pick or type a folder (a company, a vendor, whatever groups them), add labeled URLs (e.g. “Firewall admin”, “M365 admin”), and Save. Everyone on the team sees the same links.
Shared settings. A change here applies to every instance that uses this database, production included, within about 30 seconds.
Loading…
Add a folder
Connections — credential health
The health of every credential your environments authenticate with — the Azure DevOps token, each connected service's credentials, your Microsoft 365 calendar, and any key a module adds (an outside service's API key, for one). A credential that expires or is revoked shows here, and you'll get a notification on the bell the moment one starts failing. Checked automatically; use Re-check now to probe on demand.
Loading connections…
Board vocabulary
The work-item type and state names this instance is configured with, checked against what the board actually has. A wrong name fails silently — pickers and the planning board simply come up empty — so anything that doesn't match is called out here along with the setting to change.
Checking board vocabulary…
Priorities on the board
A priority set here also travels as a
priority-<n> tag on the work item, which is how any dashboard
reading that board can show it — each instance keeps its own private priorities, so
without the tag a priority set on a client's own dashboard is invisible here, and vice versa.
Priorities set since 7.13.0 tag as they go; this repairs the ones set before that.
Check only reports, and writes nothing. A card already carrying a
different priority tag is left alone — that value may be the newer one.
People — identity map
Links each person's identity across orgs so the Management dashboard can roll a person's work up everywhere they work. This builds itself: whoever configures an environment is auto-linked. Use this to rename people, merge duplicates, or assign identities seen on a board that couldn't be auto-linked (client-side staff, or a teammate who hasn't added that org). It stores who-is-who only — never another org's card data.
Shared settings. A change here applies to every instance that uses this database, production included, within about 30 seconds.
Loading people…
Access — roles and permissions
What each role may do here. Who holds which role is decided in Microsoft Entra, not on this page — roles arrive as a claim on the sign-in token, so removing someone in Entra removes them here and there is no separate list of people to keep in step. This page sets what those roles mean.
Shared settings. A change here applies to every instance that uses this database, production included, within about 30 seconds.
Permissions need a secret store (Azure Key Vault) configured on this instance to persist. Changes made here will be lost on restart.
Your access
…
Enforcement
TIMEKIT_ADMINS — the app refuses to enable it if that would leave
nobody able to turn it back off.
Permission grid
A grant includes everything below it, so Read/write/delete covers reading. “Delete” means destructive rather than the HTTP verb — it is what gates things like stripping a client from every card, or rebuilding the ledger. The Administrator column always has everything and can’t be narrowed; to restrict top-level access, widen Lead and assign Administrator to nobody.
Loading permissions…
The key is what an Entra app role value has to match, so it is built from the name unless you type one. Adding a role here grants nobody anything until somebody is assigned the matching app role in Entra; the table below shows the exact value to use.
Setting the roles up in Entra
In the Entra app registration for this instance → App roles, create one role per row below (Allowed member types: Users/Groups), then assign people under Enterprise applications → Users and groups. The Value is what this app matches on — the display name is yours to choose.
Branding
How this instance presents itself — the name, the images and the brand colors. Changes apply on the next page load; no redeploy needed.
Shared settings. A change here applies to every instance that uses this database, production included, within about 30 seconds.
Branding needs a secret store (Azure Key Vault) configured on this instance. Nothing here can be saved until it is.
Images
Pick a PNG, JPEG or GIF. Large images are scaled down in the browser before upload, so a full-size logo is fine to choose.
Identity
Brand colors
The colors that carry the brand, for each theme. The surface colors (backgrounds, text, borders) stay in deployed config — they are the ones that make the app unreadable if they go wrong.
Preview
The preview shows the light and dark values you have chosen applied to the shell; the rest of the app follows the same variables.