Credential store folder access: how a tenant credential store can be limited to selected folders, how the assignment is inherited by subfolders, and where the limit applies.

Credential stores are created and managed at tenant level, and by default every folder in the tenant can use every store. Folder access is a setting on each store that narrows this: a store set to Selected folders only can be used solely in the folders it is assigned to. Teams that work in separate folders can therefore keep separate vaults, without a separate tenant for each team.

Folder access controls where a store can be used. It is not a guarantee that the credentials themselves are unreachable by other means.

The procedures for assigning stores to folders are described in Assigning credential stores to folders.

Each credential store is in one of two modes.

The Stores page reports the current mode for each store in the Restricted to folders column.

Folder assignments can be recorded while a store is still set to All folders, but they have no effect until the mode changes. Equally, setting a store back to All folders keeps its assignments, so they apply again if the store is later set to Selected folders only.

A store assigned to a folder is also available in every subfolder beneath it, however deep the hierarchy goes. A store assigned to a root folder is therefore available across that whole folder tree.

Inheritance cannot be interrupted. There is no way to assign a store to a folder while excluding its subfolders, and a subfolder cannot opt out of what it inherits.

Each folder's credential stores page shows where a store's access comes from, in the Access origin column.

A store can have more than one access origin at once. A store assigned both to a folder and to its parent, for example, shows as assigned and inherited.

A store can be made available to all personal workspaces at once, by assigning it to the personal workspaces folder. Individual personal workspaces cannot be assigned, and the credential stores page is not available inside a personal workspace.

Folder access is evaluated in the folder an operation runs in, at the moment the credentials are used.

Because the check happens when the credentials are used rather than when they are configured, setting a store to Selected folders only takes effect immediately for every resource already pointing at it.

There is no per-folder default store. The default stores for robots and assets are set once for the tenant, so a default store set to Selected folders only fails in any folder it is not assigned to.

Folder access introduces no new permission.

Folder administrators cannot assign stores to their own folders on their own: folder permissions alone are not enough, Edit on Settings is also required. This keeps the decision about which vaults enter a folder with the tenant administrator.