Hub Administration

Loading configuration…
– –
– Opening page → Workspace →

Global configuration

This administration is the design and settings source for every Baltic Hub page. Landing Page is the first connected client.

In Azure, global save uses /api/hub-config. Until that API exists, Save stores a local preview in this browser and Export produces the deployable JSON file.

What is set right now

Live summary of the configuration in use.

Theme mode–
Typeface–
Visible modules–
Access control–

Your access

Sections are shown based on your Entra ID role. Anything you are not entitled to is not rendered at all.

–

Connected clients

Current rollout scope.

Landing Page
Branding, theme, typography and modules connected

Future Hub pages
Prepared through /shared/hub-core.js — call BalticHub.load()

Names, hero copy and logo assets used across the Hub. The preview on the right shows exactly how the Landing Page header will read.

Brand content

Everything here is global and applies to every connected Hub page.

Identity
Used in the browser tab title.
The product name, e.g. Baltic Hub.
Small text beside the logo.
Landing hero
Keep under ~45 characters so it stays on one line.
One or two short sentences.
Opening page

The first page everyone sees in the Hub: a background picture and two tiles — Baltic Yachts (company information for everyone) and the workspace.

Welcome to Baltic Yachts
No picture — the opening page uses Baltic Blue.
Uploaded pictures are resized to 2400 px and saved in Baltic Hub › Hub Data › branding.
More darkening keeps the white text readable on bright pictures.
Logos

Use root-relative paths (starting with /) so every Hub page loads the same asset from any folder depth.

–
–
Light surface logo
Dark surface logo

Live preview

Landing Page header and first cards, with your current type and colours.

Internal Apps

Baltic Yachts workspace

Your team's tools in one place.

Branding applies to all connected Hub pages.

Choose how the Hub renders. Selecting a mode applies it immediately so you can see the result before saving. The Baltic palette itself is locked — only the mode is configurable.

Theme mode

System is the Baltic default — it follows each person's laptop setting.

–

For everyone. This is the Hub-wide default. To change only your own light/dark mode use My style.

Primary palette Locked

The Baltic identity colours are fixed and cannot be changed here or through an imported configuration. Both theme modes are built from them.

Baltic Blue#002F5F
Frost White#F9F9F9
Carbon Black#2E2C2D

Restricted accent Locked

Small highlights only — never backgrounds or large surfaces.

Accent Orange#FF6319
Accent is reserved for active states, badges and hover underlines. Colour changes need a brand decision and a code release, not an administration setting.

Typography colour rule Locked

From the Baltic Yachts Brand Book & Guidelines (2026), “Colour values and uses”.

Text on Baltic Blue#FFFFFFPure White. Frost White is never used for typography.
Frost White#F9F9F9Backgrounds only.
Carbon Black#2E2C2DTitles, and may be a background.
Grey#4A4A4ABody copy. Never a background.

Secondary palette Locked

Drawn from the Café Racer palette — background colours used to change pace in digital and print.

Light Sand#EFECE6Background
Dark Sand#C7BCABBackground
Grey#4A4A4ABody copy only
Mode previews instantly; Save writes it to the configuration.

Every colour in the Hub is set here and published to each page as a variable. Pages no longer carry their own colour values. The eight brand colours are locked to the Brand Book; what you control is where each one is used.

Brand palette Locked

Baltic Yachts Brand Book & Guidelines 2026. These values cannot be changed here or through an imported configuration.

Colour roles

Assign a brand colour to each role. Only the eight brand colours are selectable, so nothing off-brand can enter the Hub. Contrast is checked against the Brand Book rule for typography.

RoleUsed forBrand colourResult

Status colours

Not brand colours — these signal state in the module apps (good, warning, danger, information, neutral), so a free value is allowed.

Baltic Dark surfaces

The only place dark values are defined. Brand and accent keep their locked values; the brand tint is the lighter Baltic Blue used where brand colour becomes text on a dark surface.

Data visualisation Exempt from the brand lock

A Gantt bar or chart series has to be told apart at a glance, which a four-colour brand palette cannot do — so these follow common charting practice instead. The series is the colour-blind-safe Okabe–Ito set, anchored on Baltic Blue. Milestones use Accent Orange, which the Brand Book permits as a highlight.

Series colours

Used for workstreams, chart series and categories, in this order.

Gantt elements

Preview

Colours apply to every connected Hub page.

The official Baltic Hub typeface is Manrope (Google Fonts). You can also load any other Google font, or a self-hosted/licensed font, and tune the type scale.

Typeface

Fonts are applied to every connected Hub page through CSS variables.

Font source
Google font
Semicolon separated. Fewer weights load faster.
Type scale
Used while the web font loads, and if the CDN is blocked on the yard network.

Live preview

Rendered with the fonts and scale selected — this page itself uses them too.

Baltic Yachts workspace

Engineering · Projects · Program Office

The Hub brings every internal tool together in one place. Sample text 0123456789 — hull #68, 2 400 kg, 68.5 m.

Light 300Regular 400Medium 500Semibold 600Bold 700Extrabold 800

Scale

Typography is global — it applies to the Landing Page and every future Hub page.

Company details used for document headers, exports, currency and date formatting across every Hub module.

Company profile

Legal entity
Shown to users when a module or integration is unavailable.
Regional defaults

How it renders

Preview of the formats modules will use.

SampleResult
Today's date–
Amount–
Document footer–
These values are Hub application settings. They are stored in the Hub's own configuration — never in Entra ID, which owns identity only.
Company profile applies Hub-wide.

The Hub does not manage people. Entra ID owns identity and group membership — this panel shows the role model and links out to the portal where membership is actually changed.

Access provider Prepared, not connected

Microsoft Entra ID, same tenant as company M365. No second tenant, no Hub-local user store, no passwords stored by the Hub.

Must be the existing Baltic Yachts M365 tenant.
Deep link used by the "Manage in Entra ID" buttons below.

App role ↔ security group mapping

The naming convention is HUB-{Module}-Admins ↔ {Module}Admin. Group membership is managed by IT in Entra ID; the Hub only reads the role claim from the signed-in user's token.

App roleSecurity groupGrantsMembers
Manage membership in Entra ID → Membership is never edited from inside the Hub.

Who holds each role

Read-only visibility list, populated from Microsoft Graph once sign-in is connected.

Not available yet — this list is read live from Entra ID via Graph (GET /groups/{id}/members) and stays empty until the App Registration and Graph permission GroupMember.Read.All are granted.
Identity settings are stored as configuration only — they grant nothing until the backend validates tokens.

App-level security settings, plus the Entra ID posture the Hub expects. Conditional Access, MFA and legacy-auth blocking are tenant policies owned by IT — shown here for confirmation, not editing.

Application session

Settings the Hub itself owns.

Re-authenticate before admin actionsPrompt for a fresh token before saving global configuration.

Entra ID posture Informational

Confirmed with IT, enforced in the tenant — not by this page.

MFA requiredConditional Access policyExpected
Legacy authentication blockedConditional Access policyExpected
Secrets in Key VaultCertificates preferred over client secretsBackend

Entra ID readiness

Outstanding work before sign-in can be switched on. Frontend items are in /auth/hub-auth.js; the rest is tenant and backend work.

Session settings take effect once the backend enforces them.

Searchable record of administration actions and authentication failures.

Audit log Local preview only

Until the backend exists, administration actions taken in this browser are recorded locally so the panel and its format can be reviewed. Authentication failures will only appear once sign-in is connected.

WhenWhoActionDetail

Manage the Landing Page cards — name, description, target, status, visibility and order.

Landing Page modules

Order is saved as 10, 20, 30 … so new modules can be slotted in later.

Delegated settings, scoped per module. A module administrator sees only their own module here; a global administrator sees all of them.

Module settings

Saved into the Hub configuration, scoped to the module.

Connection status and configuration reference for external systems. Credentials are never stored or shown here — they belong in Key Vault.

ERP Not configured

Used by Finance, Quality, Procurement and Projects.

Existing page-level connections keep their own method — the Entra ID layer is an additional gate in front, not a replacement.
No API key, password or certificate may be entered on this page. Secrets live in Azure Key Vault and are read by the backend only.

Microsoft 365 / Graph Not configured

SharePoint document libraries, Outlook and Teams notifications.

Same tenant as company M365Required — never create a second tenant for the Hub.
Keep to least privilege — add a scope only when a module needs it.

Per-module connection register

Living documentation required before the Entra ID migration — each module's external connection, how it authenticates today and whether it has been re-verified after the auth change.

ModuleExternal connectionCurrent authConfig / IDsVerified after auth change
Integration settings are reference and status only.

Company-wide defaults for which events raise an email or Teams alert, and whether individuals may override them.

Event defaults

EventEmailTeamsUser may override

Channels

EmailSent from the Hub service mailbox.
TeamsRequires the Graph scopes on the Integrations panel.

Personal overrides

Allow users to override defaultsIndividual preferences live in personal settings, not here.
Delivery is not wired yet — these defaults are stored in the configuration and will be read by the notification service when it is built.
Applies company-wide.

Personal style stays inside the Baltic framework: identity colours, logos and brand copy are always global. Each person may adjust only the options enabled below, and their choice is stored in their own browser.

My style

These settings affect only your view of the Hub.

Limited to the approved Baltic font list.
Reduce motionTurn off transitions and hover animation.

What people may personalise

Administrator control. Anything switched off here is locked to the global configuration for everyone.

Personal styleMaster switch for the whole feature.
Theme modeLight / dark / system.
TypefaceFrom the approved list only.
Text size14–20 px.
DensityComfortable or compact spacing.
Reduce motionAccessibility preference.
Comma separated. Manrope should stay first as the Baltic default.

Export the configuration for Azure Static Web Apps, or import one to restore.

Deployable configuration

Export replaces /config/hub-config.json in Azure when the API is not yet connected.

Import

Current JSON


      

    


    
    

      

        
Not available with your role

        
This section requires a different Entra ID role. If you need access, ask IT to add you to the matching HUB-* security group.