Owners and admins, you can enable or disable these enhanced security features. Take our course on Configure Advanced Settings and Permissions in ClickUp University.

To set individual permissions by user role, read our Manage user permissions article.

What you'll need

• These advanced permissions are only available on the Enterprise Plan:
  • Make new Spaces private
  • Allow admins to manage private Spaces
  • Allow admins to manage private Custom Fields
  • Block public sharing
• These advanced permissions are available on all plans:
  • Request Access 
  • Private attachments
• Owners and admins can enable and disable these advanced permissions: 
  • Request Access 
  • Make new Spaces private
  • Private attachments
  • Block public sharing
• Only owners can enable and disable the following advanced permissions:
  • Allow admins to manage private Spaces
  • Allow admins to manage private Custom Fields permissions

Configure advanced permissions

You can choose which permissions to enable or disable. 

To configure advanced permissions:

1. In the upper-left corner, click your Workspace avatar.
2. Select Settings, then Security & Permissions.
3. Scroll down to the Advanced permissions section.
4. Click the toggle to the left of the permission to enable or disable it for your Workspace. 

Request Access

This setting is enabled by default. When enabled, members and guests can request access to a task.

Make new Spaces private

New Spaces are public by default. After this advanced permission is enabled, all newly created Spaces will be private.

Once enabled, only the Private option is available when creating a new Space.

After a new Space has been created, only Workspace owners and admins can make it public.

To make a private Space public:

1. In the Sidebar, hover over the private Space and click the ellipsis... icon.
2. Select Sharing & Permissions.
3. Click Make Public.
   

Allow admins to manage private Spaces

Allow admins to transfer Space ownership, add people, and remove people from newly-created private Spaces by enabling this setting. Admins can see the names of all private Spaces created after this setting is enabled.

By default, admins cannot manage private Spaces created before this permission was enabled unless the admin manually turns on the setting within the Space's Sharing & Permissions modal.

This permission is Workspace-wide and cannot be overridden when creating new Spaces.

Once enabled, an email will be sent to everyone in the Workspace to let them know that admins can manage private Spaces.

To manage private Spaces:

1. In the upper-left corner, click your Workspace avatar.
2. Select Settings, then Spaces.
3. Click the Inaccessible Spaces tab.
4. Transfer ownership, add people, or remove people from the Space.

Read more about transferring ownership of inaccessible Spaces.

Allow admins to manage private Custom Fields

To allow admins to see and edit all private Custom Fields in the Workspace:

1. In the upper-left corner, click your Workspace avatar and select Settings.
2. In the sidebar, click Security & Permissions.
3. Scroll down to Advanced Permissions.
4. Enable Allow admins to manage private Custom Fields.

If there are existing private Custom Fields, the creator of those fields will be notified that this setting has been applied and their fields are now accessible to admins.

Private attachments

Enable Private attachments to make attachment links automatically expire one hour after the link has been generated.

New links to an attachment will be generated each time that a task has been opened or exported to ensure that no unwanted links remain accessible after your work is complete.

Setting attachments as private only applies to new attachments added after the feature has been enabled.

If the Delete Items custom role permission is enabled and the Only if created checkbox is checked, you must be the task creator to delete attachments you previously uploaded. You cannot delete attachments others uploaded.

Block public sharing

Enable Block public sharing to increase security in three different ways:

• Disable sharing links over one year.
• Disable never-expiring links.
• Disable public template sharing.

Blocking public sharing does not prevent the sharing of attachment URLs.