Add an Identity Governance section to the docs (#55483)

Move Identity Governance-related how-to guides into a dedicated documentation sidebar section so readers are aware of this product as a top-level offering. This is part of a broader initiative to add a top-level documentation section for each Teleport product.
2026-10-12 02:15:01 +00:00 · 2025-06-09 18:02:05 +00:00
parent 43d15d355f
commit 3e4814a612
95 changed files with 483 additions and 283 deletions
@@ -130,7 +130,7 @@ environment variable `TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE`.
 Opsgenie plugin users, role annotations must now contain
 `teleport.dev/notify-services` to receive notification on Opsgenie.
 `teleport.dev/schedules` is now the label used to determine auto approval flow.
-See [the Opsgenie plugin documentation](docs/pages/admin-guides/access-controls/access-request-plugins/opsgenie.mdx)
+See [the Opsgenie plugin documentation](docs/pages/identity-governance/access-request-plugins/opsgenie.mdx)
 for setup instructions.

 #### Teleport Assist has been removed
@@ -489,7 +489,7 @@ within the cluster.
 As the feature is being developed, future Teleport releases will add support for
 periodic audit reviews and deeper integration of Access Lists with Okta.

-You can find existing Access Lists documentation [here](docs/pages/admin-guides/access-controls/access-lists/guide.mdx).
+You can find existing Access Lists documentation [here](docs/pages/identity-governance/access-lists/guide.mdx).

 #### Unified resources view

@@ -3264,7 +3264,7 @@ Other updates:

 * We now provide local user management via `https://[cluster-url]/web/users`, providing the ability to edit, reset and delete local users.
 * Teleport Node & App Install scripts. This is currently an Enterprise-only feature that provides customers with an 'auto-magic' installer script. Enterprise customers can enable this feature by modifying the 'token' resource. See note above.
-* We've added a Waiting Room for customers using Access Workflows. [Docs](docs/pages/admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx)
+* We've added a Waiting Room for customers using Access Workflows. [Docs](docs/pages/identity-governance/access-request-plugins/access-request-plugins.mdx)

 ##### Signed RPM and Releases

@@ -3527,12 +3527,12 @@ Teleport's Web UI now exposes Teleport’s Audit log, letting auditors and admin

 ##### Teleport Plugins

-Teleport 4.3 introduces four new plugins that work out of the box with [Approval Workflow](docs/pages/admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx). These plugins allow you to automatically support role escalation with commonly used third party services. The built-in plugins are listed below.
+Teleport 4.3 introduces four new plugins that work out of the box with [Approval Workflow](docs/pages/identity-governance/access-request-plugins/access-request-plugins.mdx). These plugins allow you to automatically support role escalation with commonly used third party services. The built-in plugins are listed below.

-*   [PagerDuty](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx)
-*   [Jira](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx)
-*   [Slack](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx)
-*   [Mattermost](docs/pages/admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx)
+*   [PagerDuty](docs/pages/identity-governance/access-request-plugins/ssh-approval-pagerduty.mdx)
+*   [Jira](docs/pages/identity-governance/access-request-plugins/ssh-approval-jira.mdx)
+*   [Slack](docs/pages/identity-governance/access-request-plugins/ssh-approval-slack.mdx)
+*   [Mattermost](docs/pages/identity-governance/access-request-plugins/ssh-approval-mattermost.mdx)

 #### Improvements

@@ -3727,7 +3727,7 @@ This is a minor Teleport release with a focus on new features and bug fixes.
 ### Improvements

 * Alpha: Enhanced Session Recording lets you know what's really happening during a Teleport Session. [#2948](https://github.com/gravitational/teleport/issues/2948)
-* Alpha: Workflows API lets admins escalate RBAC roles in response to user requests. [Read the docs](docs/pages/admin-guides/access-controls/access-requests/access-requests.mdx). [#3006](https://github.com/gravitational/teleport/issues/3006)
+* Alpha: Workflows API lets admins escalate RBAC roles in response to user requests. [Read the docs](docs/pages/identity-governance/access-requests/access-requests.mdx). [#3006](https://github.com/gravitational/teleport/issues/3006)
 * Beta: Teleport provides HA Support using Firestore and Google Cloud Storage using Google Cloud Platform. [Read the docs](docs/pages/admin-guides/deploy-a-cluster/deployments/gcp.mdx). [#2821](https://github.com/gravitational/teleport/pull/2821)
 * Remote tctl execution is now possible. [Read the docs](./docs/pages/reference/cli/tctl.mdx). [#1525](https://github.com/gravitational/teleport/issues/1525) [#2991](https://github.com/gravitational/teleport/issues/2991)

@@ -187,7 +187,7 @@
    },
    {
      "source": "/application-access/okta/hosted-guide/",
-      "destination": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/okta/",
      "permanent": true
    },
    {
@@ -237,12 +237,12 @@
    },
    {
      "source": "/access-controls/device-trust/guide/",
-      "destination": "/admin-guides/access-controls/device-trust/guide/",
+      "destination": "/identity-governance/device-trust/guide/",
      "permanent": true
    },
    {
      "source": "/access-controls/access-request-plugins/",
-      "destination": "/admin-guides/access-controls/access-request-plugins/",
+      "destination": "/identity-governance/access-request-plugins/",
      "permanent": true
    },
    {
@@ -282,42 +282,42 @@
    },
    {
      "source": "/enroll-resources/application-access/okta/hosted-guide/",
-      "destination": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/okta/",
      "permanent": true
    },
    {
      "source": "/enroll-resources/application-access/okta/scim-only/",
-      "destination": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/okta/scim-integration/",
      "permanent": true
    },
    {
      "source": "/enroll-resources/application-access/okta/sync-scim/",
-      "destination": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/okta/scim-integration/",
      "permanent": true
    },
    {
      "source": "/enroll-resources/application-access/okta/app-and-group-sync/",
-      "destination": "/admin-guides/access-controls/okta/app-and-group-sync/",
+      "destination": "/identity-governance/okta/app-and-group-sync/",
      "permanent": true
    },
    {
      "source": "/enroll-resources/application-access/okta/guided-sso/",
-      "destination": "/admin-guides/access-controls/okta/guided-sso/",
+      "destination": "/identity-governance/okta/guided-sso/",
      "permanent": true
    },
    {
      "source": "/enroll-resources/application-access/okta/",
-      "destination": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/okta/",
      "permanent": true
    },
    {
      "source": "/enroll-resources/application-access/okta/scim-integration/",
-      "destination": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/okta/scim-integration/",
      "permanent": true
    },
    {
      "source": "/enroll-resources/application-access/okta/user-sync/",
-      "destination": "/admin-guides/access-controls/okta/user-sync/",
+      "destination": "/identity-governance/okta/user-sync/",
      "permanent": true
    },
    {
@@ -369,6 +369,171 @@
      "source": "/enroll-resources/agents/introduction/",
      "destination": "/enroll-resources/agents/",
      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-lists/",
+      "destination": "/identity-governance/access-lists/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-lists/guide/",
+      "destination": "/identity-governance/access-lists/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-lists/nested-access-lists/",
+      "destination": "/identity-governance/access-lists/nested-access-lists/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-monitoring/",
+      "destination": "/identity-governance/access-monitoring/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/",
+      "destination": "/identity-governance/access-request-plugins/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/datadog-hosted/",
+      "destination": "/identity-governance/access-request-plugins/datadog-hosted/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/notification-routing-rules/",
+      "destination": "/identity-governance/access-request-plugins/notification-routing-rules/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/opsgenie/",
+      "destination": "/identity-governance/access-request-plugins/opsgenie/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/servicenow/",
+      "destination": "/identity-governance/access-request-plugins/servicenow/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-discord/",
+      "destination": "/identity-governance/access-request-plugins/ssh-approval-discord/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-email/",
+      "destination": "/identity-governance/access-request-plugins/ssh-approval-email/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-jira/",
+      "destination": "/identity-governance/access-request-plugins/ssh-approval-jira/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost/",
+      "destination": "/identity-governance/access-request-plugins/ssh-approval-mattermost/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-msteams/",
+      "destination": "/identity-governance/access-request-plugins/ssh-approval-msteams/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty/",
+      "destination": "/identity-governance/access-request-plugins/ssh-approval-pagerduty/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-request-plugins/ssh-approval-slack/",
+      "destination": "/identity-governance/access-request-plugins/ssh-approval-slack/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/access-request-configuration/",
+      "destination": "/identity-governance/access-requests/access-request-configuration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/",
+      "destination": "/identity-governance/access-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/automatic-reviews/",
+      "destination": "/identity-governance/access-requests/automatic-reviews/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/oss-role-requests/",
+      "destination": "/identity-governance/access-requests/oss-role-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/resource-requests/",
+      "destination": "/identity-governance/access-requests/resource-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/access-requests/role-requests/",
+      "destination": "/identity-governance/access-requests/role-requests/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/device-management/",
+      "destination": "/identity-governance/device-trust/device-management/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/",
+      "destination": "/identity-governance/device-trust/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/enforcing-device-trust/",
+      "destination": "/identity-governance/device-trust/enforcing-device-trust/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/guide/",
+      "destination": "/identity-governance/device-trust/guide/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/device-trust/jamf-integration/",
+      "destination": "/identity-governance/device-trust/jamf-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/guides/locking/",
+      "destination": "/identity-governance/locking/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/app-and-group-sync/",
+      "destination": "/identity-governance/okta/app-and-group-sync/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/guided-sso/",
+      "destination": "/identity-governance/okta/guided-sso/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/",
+      "destination": "/identity-governance/okta/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/scim-integration/",
+      "destination": "/identity-governance/okta/scim-integration/",
+      "permanent": true
+    },
+    {
+      "source": "/admin-guides/access-controls/okta/user-sync/",
+      "destination": "/identity-governance/okta/user-sync/",
+      "permanent": true
    }
  ]
 }
@@ -9,7 +9,7 @@ policies for who can perform certain actions against specific resources. For
 example, you can allow analytics team members to SSH into a MongoDB read
 replica, but not the main database. You can also allow SREs to access a
 production server only when using a [trusted hardware
-device](./device-trust/guide.mdx), or if approved by someone else from the same
+device](../../identity-governance/device-trust/guide.mdx), or if approved by someone else from the same
 team.

 <DocCardList />
@@ -22,7 +22,7 @@ government agencies.
 | [AC-07 Unsuccessful Logon Attempts]((=fedramp.control_url=)AC-07) |  Teleport supports two types of users: local and SSO-based accounts (GitHub, Google Apps, Okta, etc). For local accounts, by default, Teleport locks accounts for 30 minutes after 5 failed login attempts. For SSO-based accounts, the number of invalid login attempts and lockout time period is controlled by the SSO provider. |
 | [AC-08 System Use Notification]((=fedramp.control_url=)AC-08) | Teleport integrates with Linux Pluggable Authentication Modules (PAM). PAM modules can be used to display a custom message on login using a message of the day (MOTD) module within the Session management primitive. |
 | [AC-10 Concurrent Session Control]((=fedramp.control_url=)AC-10) | Teleport administrators can define concurrent session limits using Teleport’s RBAC. |
-| [AC-12 Session Termination]((=fedramp.control_url=)AC-12) | Admins can terminate active sessions with [session locking](../../access-controls/guides/locking.mdx). Teleport terminates sessions on expiry or inactivity. |
+| [AC-12 Session Termination]((=fedramp.control_url=)AC-12) | Admins can terminate active sessions with [session locking](../../../identity-governance/locking.mdx). Teleport terminates sessions on expiry or inactivity. |
 | [AC-17 Remote Access]((=fedramp.control_url=)AC-17) | Teleport administrators create users with configurable roles that can be used to allow or deny access to system resources. |
 | [AC-20 Use of External Information Systems]((=fedramp.control_url=)AC-20) | Teleport supports connecting multiple independent clusters using a feature called [Trusted Clusters](../../management/admin/trustedclusters.mdx). When allowing access from one cluster to another, roles are mapped according to a pre-defined relationship of the scope of access. |

@@ -58,10 +58,10 @@ Each principle has many "Points of Focus" which will apply differently to differ
 | CC6.1 - Manages Credentials for Infrastructure and Software | New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use. | [Invite nodes to your cluster with short lived tokens](../../../enroll-resources/agents/join-token.mdx) | 
 | CC6.1 - Uses Encryption to Protect Data | The entity uses encryption to supplement other measures used to protect data at rest, when such protections are deemed appropriate based on assessed risk. | Teleport Audit logs can use DynamoDB encryption at rest. | 
 | CC6.1 - Protects Encryption Keys | Processes are in place to protect encryption keys during generation, storage, use, and destruction. | Teleport acts as a Certificate Authority to issue SSH and x509 user certificates that are signed by the CA and are (by default) short-lived. SSH host certificates are also signed by the CA and rotated automatically  | 
-| CC6.2 - Controls Access Credentials to Protected Assets | Information asset access credentials are created based on an authorization from the system&#39;s asset owner or authorized custodian. | [Request Approval from the command line](../../../reference/cli/tctl.mdx) <br/><br/> [Build Approval Workflows with Access Requests](../access-requests/access-requests.mdx) <br/><br/> [Use Plugins to send approvals to tools like Slack or Jira](../access-requests/access-requests.mdx) |
-| CC6.2 - Removes Access to Protected Assets When Appropriate | Processes are in place to remove credential access when an individual no longer requires such access. | [Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window](../access-requests/access-requests.mdx) | 
+| CC6.2 - Controls Access Credentials to Protected Assets | Information asset access credentials are created based on an authorization from the system&#39;s asset owner or authorized custodian. | [Request Approval from the command line](../../../reference/cli/tctl.mdx) <br/><br/> [Build Approval Workflows with Access Requests](../../../identity-governance/access-requests/access-requests.mdx) <br/><br/> [Use Plugins to send approvals to tools like Slack or Jira](../../../identity-governance/access-requests/access-requests.mdx) |
+| CC6.2 - Removes Access to Protected Assets When Appropriate | Processes are in place to remove credential access when an individual no longer requires such access. | [Teleport issues temporary credentials based on an employees role and are revoked upon job change, termination or end of a maintenance window](../../../identity-governance/access-requests/access-requests.mdx) | 
 | CC6.2 - Reviews Appropriateness of Access Credentials | The appropriateness of access credentials is reviewed on a periodic basis for unnecessary and inappropriate individuals with credentials. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | 
-| CC6.3 - Creates or Modifies Access to Protected Information Assets | Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner. | [Build Approval Workflows with Access Requests](../access-requests/access-requests.mdx) to get authorization from asset owners. | 
+| CC6.3 - Creates or Modifies Access to Protected Information Assets | Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner. | [Build Approval Workflows with Access Requests](../../../identity-governance/access-requests/access-requests.mdx) to get authorization from asset owners. | 
 | CC6.3 - Removes Access to Protected Information Assets | Processes are in place to remove access to protected information assets when an individual no longer requires access. | Teleport uses temporary credentials and can be integrated with your version control system or even your HR system to [revoke access with the Access requests API](../../api/api.mdx) | 
 | CC6.3 - Uses Role-Based Access Controls | Role-based access control is utilized to support segregation of incompatible functions. | [Role based access control (&quot;RBAC&quot;) allows Teleport administrators to grant granular access permissions to users.](../access-controls.mdx) | 
 | CC6.3 - Reviews Access Roles and Rules | The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals with access and access rules are modified as appropriate. | Teleport maintains a live list of all nodes within a cluster. This node list can be queried by users (who see a subset they have access to) and administrators any time. | 
@@ -74,23 +74,23 @@ Each principle has many "Points of Focus" which will apply differently to differ
 | CC7.2 - Designs Detection Measures | Detection measures are designed to identify anomalies that could result from actual or attempted (1) compromise of physical barriers; (2) unauthorized actions of authorized personnel; (3) use of compromised identification and authentication credentials; (4) unauthorized access from outside the system boundaries; (5) compromise of authorized external parties; and (6) implementation or connection of unauthorized hardware and software. | [Use Enhanced Session Recording to catch malicious program execution, capture TCP connections and log programs accessing files on the system the should not be accessing.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
 | CC7.3 - Communicates and Reviews Detected Security Events | Detected security events are communicated to and reviewed by the individuals responsible for the management of the security program and actions are taken, if necessary. | [Use Session recording to replay and review suspicious sessions](../../../reference/architecture/session-recording.mdx). | 
 | CC7.3 - Develops and Implements Procedures to Analyze Security Incidents | Procedures are in place to analyze security incidents and determine system impact. | [Analyze detailed logs and replay recorded sessions to determine impact. See exactly what files were accessed during an incident.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
-| CC7.4 - Contains Security Incidents | Procedures are in place to contain security incidents that actively threaten entity objectives. | [Use Teleport to quickly revoke access and contain an active incident](../../access-controls/guides/locking.mdx) <br/><br/> [Use Shared Sessions so Multiple On-Call Engineers can collaborate and fight fires together.](../../../connect-your-client/tsh.mdx) |
-| CC7.4 - Ends Threats Posed by Security Incidents | Procedures are in place to mitigate the effects of ongoing security incidents. | [Use Teleport to quickly revoke access and contain an active incident](../../access-controls/guides/locking.mdx)   | 
+| CC7.4 - Contains Security Incidents | Procedures are in place to contain security incidents that actively threaten entity objectives. | [Use Teleport to quickly revoke access and contain an active incident](../../../identity-governance/locking.mdx) <br/><br/> [Use Shared Sessions so Multiple On-Call Engineers can collaborate and fight fires together.](../../../connect-your-client/tsh.mdx) |
+| CC7.4 - Ends Threats Posed by Security Incidents | Procedures are in place to mitigate the effects of ongoing security incidents. | [Use Teleport to quickly revoke access and contain an active incident](../../../identity-governance/locking.mdx)   | 
 | CC7.4 - Obtains Understanding of Nature of Incident and Determines Containment Strategy | An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach. | [Use Teleport’s Session Recording and Replay along with logs to understand what actions led to an incident.](../../../reference/monitoring/audit.mdx) | 
 | CC7.4 - Evaluates the Effectiveness of Incident Response | The design of incident-response activities is evaluated for effectiveness on a periodic basis. | [Use audit logs and session recordings to find pain points in your incident response plan and improve effectiveness](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx). | 
 | CC7.4 - Periodically Evaluates Incidents | Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes. | [Use Session recording and audit logs to find patterns that lead to incidents.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx)  | 
 | CC7.5 - Determines Root Cause of the Event | The root cause of the event is determined. | [Use Session recording and audit logs to find root cause.](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
 | CC7.5 - Improves Response and Recovery Procedures | Lessons learned are analyzed and the incident-response plan and recovery procedures are improved. | [Replay Session recordings at your &#39;after action review&#39; or postmortem meetings](../../../enroll-resources/server-access/guides/bpf-session-recording.mdx) | 
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Manages changes throughout the system life cycle. | Enables a documented software development lifecycle through its integrations with [infrastructure as code tools](../../infrastructure-as-code/infrastructure-as-code.mdx). |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Authorizes Changes, Identifies and Evaluates System Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations enable you to authorize changes using GitOps platforms. [Access Requests](../access-requests/access-requests.mdx) enable authorization for elevated privileges. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Authorizes Changes, Identifies and Evaluates System Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations enable you to authorize changes using GitOps platforms. [Access Requests](../../../identity-governance/access-requests/access-requests.mdx) enable authorization for elevated privileges. |
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Designs and Develops Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations allow you to specify infrastructure access controls as code. |
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Documents Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations allow for documenting configuration changes in version control system logs, and a [notification system](../../../connect-your-client/notifications.mdx) allows you to inform end users of system changes. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Tracks System Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations and audit logging allow you to track the history of configuration changes and [Access Request](../access-requests/access-requests.mdx) approvals in a Teleport cluster. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Tracks System Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) integrations and audit logging allow you to track the history of configuration changes and [Access Request](../../../identity-governance/access-requests/access-requests.mdx) approvals in a Teleport cluster. |
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Configures Software. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to track dynamic resource configurations. [Helm support](../../../reference/helm-reference/helm-reference.mdx) allows you to track configurations for Teleport services on Kubernetes. You can also use version control to manage Teleport [YAML configuration files](../../../reference/config.mdx).|
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Tests System Changes. | Teleport's infrastructure as code support and [gRPC API](../../api/api.mdx) make it possible to set up staging environments and automated tests for changes in a Teleport configuration. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Approves System Changes. | [Access Requests](../access-requests/access-requests.mdx) allow approvals to proposed permissions changes, and infrastructure as code support enables you to set up an approval system for configurations. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Approves System Changes. | [Access Requests](../../../identity-governance/access-requests/access-requests.mdx) allow approvals to proposed permissions changes, and infrastructure as code support enables you to set up an approval system for configurations. |
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Deploys System Changes. | [RBAC protections](../../../reference/access-controls/roles.mdx#rbac-for-dynamic-teleport-resources) for API resources allow you to restrict configuration changes to an authorized continuous deployment runner. |
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Identifies Changes in the Infrastructure, Data, Software, and Procedures Required to Remediate Incidents. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to revert changes. It is also possible for you to [back up the Auth Service backend](../../management/operations/backup-restore.mdx) on self-hosted clusters.|
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Creates Baseline Configuration of IT Technology. |[Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables you to set up a baseline configuration in a code repository. |
-| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Provides Changes Necessary in Emergency Situations. | Admins can use [Access Requests](../access-requests/access-requests.mdx) to obtain temporarily elevated permissions in order to provide changes in emergency situations. |
+| CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Provides Changes Necessary in Emergency Situations. | Admins can use [Access Requests](../../../identity-governance/access-requests/access-requests.mdx) to obtain temporarily elevated permissions in order to provide changes in emergency situations. |
 | CC8.1 - Authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to its infrastructure, data, software, and procedures to meet its objectives. | Manages Patch Changes. | [Infrastructure as code](../../infrastructure-as-code/infrastructure-as-code.mdx) support enables regular patch changes to configurations. |
@@ -14,7 +14,7 @@ In this guide, we will set up Teleport's Just-in-Time Access Requests to require
 the approval of two team members for a privileged role `elevated-access`.

 The steps below describe how to use Teleport with Mattermost. You can also
-[integrate with many other providers](../access-requests/access-requests.mdx).
+[integrate with many other providers](../../../identity-governance/access-requests/access-requests.mdx).

 <Admonition type="warning">

@@ -360,7 +360,7 @@ enrolls the user's device in their next Teleport (`tsh`) login.

 For auto-enrollment to work, the following conditions must be met:
 - A device must be registered. Registration may be [manual](#implement-cluster-wide-device-trust) or performed using an
-integration, like the [Jamf Pro integration](../device-trust/jamf-integration.mdx).
+integration, like the [Jamf Pro integration](../../../identity-governance/device-trust/jamf-integration.mdx).
 - Auto-enrollment must be enabled in the cluster setting.

 ### Step 1/2. Enable auto-enrollment in your cluster settings
@@ -489,6 +489,6 @@ Update the `cluster_auth_preference` definition to include the following content
 For additional cluster hardening measures, see:

 - [Passwordless Authentication](./passwordless.mdx): Provides passwordless and usernameless authentication.
- [Locking](./locking.mdx): Lock access to active user sessions or hosts.
+- [Locking](../../../identity-governance/locking.mdx): Lock access to active user sessions or hosts.
 - [Moderated Sessions](./joining-sessions.mdx): Require session auditors and allow fine-grained live session access.
 - [Hardware Key Support](./hardware-key-support.mdx): Enforce the use of hardware-based private keys.
@@ -31,7 +31,7 @@ reading data from the OAuth 2.0 access token. In particular, the Auth Service:
 GitHub usernames are not formatted as email addresses. As a result, any Teleport
 plugin that expects to send email to a user based on their Teleport username
 will not work as expected. For example, the [PagerDuty Access Request
-plugin](../access-request-plugins/ssh-approval-pagerduty.mdx) has this
+plugin](../../../identity-governance/access-request-plugins/ssh-approval-pagerduty.mdx) has this
 limitation.

 </Admonition>
@@ -18,7 +18,7 @@ Teleport administrators to define policies like:

 In Teleport Enterprise Cloud and Self-Hosted Teleport Enterprise, Teleport can
 automatically configure an SSO connector for you when as part of [enrolling the
-hosted Okta integration](../okta/okta.mdx).
+hosted Okta integration](../../../identity-governance/okta/okta.mdx).

 You can enroll the Okta integration from the Teleport Web UI.

@@ -3,12 +3,12 @@ title: How to Build an Access Request Plugin
 description: Manage Access Requests using custom workflows with the Teleport API
 ---

-With Teleport [Access Requests](../access-controls/access-requests/access-requests.mdx), you can
+With Teleport [Access Requests](../../identity-governance/access-requests/access-requests.mdx), you can
 assign Teleport users to less privileged roles by default and allow them to
 temporarily escalate their privileges. Reviewers can grant or deny Access
 Requests within your organization's existing communication workflows (e.g.,
 Slack, email, and PagerDuty) using [Access Request
-plugins](../access-controls/access-request-plugins/access-request-plugins.mdx).
+plugins](../../identity-governance/access-request-plugins/access-request-plugins.mdx).

 You can use Teleport's API client library to build an Access Request plugin that
 integrates with your organization's unique workflows. 
@@ -17,7 +17,7 @@ the same API.
 Here is what you can do with the Go Client:

 - Integrate with external tools, e.g., to write an [Access Request
-   plugin](../access-controls/access-request-plugins/access-request-plugins.mdx). Teleport
+   plugin](../../identity-governance/access-request-plugins/access-request-plugins.mdx). Teleport
   maintains Access Request plugins for tools like Slack, Jira, and Mattermost.
 - Perform CRUD actions on resources, such as roles, authentication connectors,
   and provisioning tokens.
@@ -477,13 +477,13 @@ resource "teleport_user" "bob" {
 - Allow users with the `manager` role to grant access to production servers to
  some `engineers` via Access Lists. Manager will need to justify and review
  granted access periodically.
-  See [the AccessList documentation](../../access-controls/access-lists/access-lists.mdx) for
+  See [the AccessList documentation](../../../identity-governance/access-lists/access-lists.mdx) for
  a high-level explanation of the feature,
  and [the AccessList IaC guide](access-list.mdx) for a step by step IaC
  AccessList setup.
 - Allow users with the `engineer` role to request temporary access to
  production, and have users with the `manager` role validate the requests.
-  See [the Access Requests documentation](../../access-controls/access-requests/access-requests.mdx)
+  See [the Access Requests documentation](../../../identity-governance/access-requests/access-requests.mdx)
 - You can see all supported fields in the references
  of [the user resource](../../../reference/resources.mdx)
  and [the role resource](../../../reference/resources.mdx).
@@ -12,8 +12,8 @@ With the AWS Identity Center integration, you can manage AWS access by granting
 ## How it works

 The Identity Center integration builds on top of Teleport's [role-based access controls](../../../access-controls/guides/guides.mdx),
-[just-in-time Access Requests](../../../access-controls/access-requests/access-requests.mdx)
-and [Access Lists](../../../access-controls/access-lists/access-lists.mdx) to manage
+[just-in-time Access Requests](../../../../identity-governance/access-requests/access-requests.mdx)
+and [Access Lists](../../../../identity-governance/access-lists/access-lists.mdx) to manage
 the creation and deletion of Identity Center _Account Assignments_. 

 An _account assignment_ is the combination of a specific AWS Permission Set on a 
@@ -20,7 +20,7 @@ your Teleport cluster before turning the integration on to avoid access
 interruption. If your Identity Center already uses external identity source,
 you can configure the corresponding [SSO connector](../../../access-controls/sso/sso.mdx)
 in Teleport or, if you're using Okta, enable the
-[Okta integration](../../../access-controls/okta/okta.mdx).
+[Okta integration](../../../../identity-governance/okta/okta.mdx).

 ## Step 1/6. Configure AWS integration

@@ -274,7 +274,7 @@ among their role grants to Identity Center.
 ### How does it work with nested Access Lists?

 Identity Center does not support nested groups. As such, Teleport recursively 
-flattens any [nested Access Lists](../../../access-controls/access-lists/nested-access-lists.mdx)
+flattens any [nested Access Lists](../../../../identity-governance/access-lists/nested-access-lists.mdx)
 into a single Identity Center group containing all members reachable from the 
 top-level Access List.

@@ -315,9 +315,9 @@ Provider and its role from your AWS IAM console as well.

 - Take a deeper dive into fundamental Teleport concepts used in Identity Center
  integration such as [RBAC](../../../access-controls/guides/guides.mdx),
-  [JIT Access Requests](../../../access-controls/access-requests/access-requests.mdx),
-  [Access Lists](../../../access-controls/access-lists/access-lists.mdx) 
+  [JIT Access Requests](../../../../identity-governance/access-requests/access-requests.mdx),
+  [Access Lists](../../../../identity-governance/access-lists/access-lists.mdx) 
  and the [Teleport SAML IdP](../../../access-controls/idps/idps.mdx).
- Learn how to enable the [Okta integration](../../../access-controls/okta/okta.mdx)
+- Learn how to enable the [Okta integration](../../../../identity-governance/okta/okta.mdx)
  to sync apps, users and groups from Okta in conjunction with Identity Center
  integration.
@@ -214,7 +214,7 @@ Two `user`s can grant elevated privileges to another `user` temporarily without
 - [Per-session MFA](../../access-controls/guides/per-session-mfa.mdx)
 - [Dual authorization](../../access-controls/guides/dual-authz.mdx)
 - [Role templates, allow/deny rules, and traits](../../access-controls/guides/role-templates.mdx)
- [Access Requests](../../access-controls/access-requests/access-requests.mdx)
+- [Access Requests](../../../identity-governance/access-requests/access-requests.mdx)

 ### Background reading
 - [Authentication connectors](../../../reference/access-controls/authentication.mdx)
@@ -29,4 +29,4 @@ sessions where the lock applies are terminated and new sessions are rejected
 while the lock remains in force.

 For more information, read our
-[Session and Identity Locking Guide](../../access-controls/guides/locking.mdx).
+[Session and Identity Locking Guide](../../../identity-governance/locking.mdx).
@@ -331,7 +331,7 @@ In general, you can migrate Teleport plugins using the following steps:

 For specific plugins running in your infrastructure, read the full documentation
 on:
- [Access Request plugins](access-controls/access-request-plugins/access-request-plugins.mdx)
+- [Access Request plugins](../identity-governance/access-request-plugins/access-request-plugins.mdx)
 - The [Teleport Event Handler](management/export-audit-events/export-audit-events.mdx)

 ## Step 4/4. Verify end user access and performance
@@ -15,7 +15,7 @@ Crown Jewels, and how to see permission changes for these resources.
 <Admonition type="tip">

 For an improved experience, we recommend using Crown Jewels in conjunction with Teleport local users or integrating with
-[Okta](../access-controls/okta/okta.mdx) or [Microsoft Entra ID](./integrations/entra-id.mdx).
+[Okta](../../identity-governance/okta/okta.mdx) or [Microsoft Entra ID](./integrations/entra-id.mdx).
 This setup helps minimize the number of access path change entries generated when highly privileged ephemeral users
 log in via Teleport Auth Connectors.

@@ -52,6 +52,6 @@ Select the "Set up new integration" button.
 Teleport can also import and grant access to resources from Okta organizations,
 such as user profiles, groups and applications. You can view connection data in
 Access Graph. Enroll the Teleport [Okta
-integration](../../access-controls/okta/okta.mdx) in your
+integration](../../../identity-governance/okta/okta.mdx) in your
 cluster.

@@ -42,7 +42,7 @@ Teleport's `tsh` CLI tool can scan users' laptops for SSH private keys.
 It goes through the specified directories, defaulting to `/Users` on macOS, `/home` on Linux, and `C:\Users` on Windows,
 by peeking into files to identify SSH private keys.

-The `tsh` tool authenticates with the Teleport cluster through the [Device Trust](../../access-controls/device-trust/device-trust.mdx) feature,
+The `tsh` tool authenticates with the Teleport cluster through the [Device Trust](../../../identity-governance/device-trust/device-trust.mdx) feature,
 which guarantees that only enrolled devices can submit private keys to the cluster. By utilizing the device's Secure
 Enclave or TPM private key, it confirms that the device is the same one that was enrolled, enabling Teleport to trust
 and accept the private key reports without requiring further authentication or credentials thus allowing scanning operations
@@ -68,7 +68,7 @@ It also never sends the private key path or any other sensitive information.
 - A running Teleport Enterprise cluster v15.4.16/v16.2.0 or later.
 - Identity Security enabled for your account.
 - A Linux/macOS server running the Teleport SSH Service.
- Devices enrolled in the [Teleport Device Trust feature](../../access-controls/device-trust/device-trust.mdx).
+- Devices enrolled in the [Teleport Device Trust feature](../../../identity-governance/device-trust/device-trust.mdx).
 - For Jamf Pro integration, devices must be enrolled in Jamf Pro and have the signed `tsh` binary installed.
 - For self-hosted clusters:
  - Ensure that an up-to-date `license.pem` is used in the Auth Service configuration.
@@ -106,7 +106,7 @@ and local users.

 ## Step 2/3. Scan for SSH private keys

-On devices enrolled in the Teleport, you can use the `tsh` CLI tool to scan for SSH private keys. Check [Device Trust](../../access-controls/device-trust/device-trust.mdx)
+On devices enrolled in the Teleport, you can use the `tsh` CLI tool to scan for SSH private keys. Check [Device Trust](../../../identity-governance/device-trust/device-trust.mdx)
 for details on how to enroll devices in Teleport, specially if you are using Jamf Pro.

 To scan for SSH private keys, run the following command from any enrolled device:
@@ -174,7 +174,7 @@ Below are a few example queries demonstrating how the `ssh_keys` view can be use
 ## Jamf Pro Integration

 If you are using Jamf Pro to manage your devices, you can integrate it with Teleport to automate the device enrollment
-process and periodically scan for SSH private keys. Check the [Jamf Pro Integration](../../access-controls/device-trust/jamf-integration.mdx)
+process and periodically scan for SSH private keys. Check the [Jamf Pro Integration](../../../identity-governance/device-trust/jamf-integration.mdx)
 page for details on how to set up the device enrollment and scanning process.

 On your Jamf Pro page navigate to Settings > Scripts and create a new script command that runs the `tsh scan keys` command
@@ -204,7 +204,7 @@ Cluster. The keys will be imported and displayed in the Access Graph.
 ### `"device not enrolled"` error

 If you see the `device not enrolled` error when running the `tsh scan keys` command, it means that the device is not enrolled
-in the Teleport Device Trust feature. Check the [Device Trust](../../access-controls/device-trust/device-trust.mdx) page for details on how to enroll devices
+in the Teleport Device Trust feature. Check the [Device Trust](../../../identity-governance/device-trust/device-trust.mdx) page for details on how to enroll devices
 in Teleport.

 ### `"binary missing signature or entitlements"` error
@@ -38,7 +38,7 @@ If you are a self-hosted Teleport customer, you will need to [deploy the Access
 - [Discover AWS Access Patterns and CloudTrail events with Teleport Identity Security](./integrations/aws-sync.mdx) guide.
 - [Analyze and correlate Teleport Audit Logs](./integrations/teleport.mdx) guide.
 - [Analyze and correlate GitHub Audit Logs and Access Paths](./integrations/github.mdx) guide.
- [Analyze and correlate Okta Audit Logs and Access Paths](../access-controls/okta/okta.mdx#syncing-system-logs-and-api-keys-with-teleport-identity-security-activity-center) guide.
+- [Analyze and correlate Okta Audit Logs and Access Paths](../../identity-governance/okta/okta.mdx#syncing-system-logs-and-api-keys-with-teleport-identity-security-activity-center) guide.


 ## Identity Security guides
@@ -428,7 +428,7 @@ a user set up an agent and then lock the user out of removing the agent.

 To instantly revoke access to agents that have already joined the cluster, look for nodes labeled
 with the `teleport.dev/connect-my-computer/owner` label and then [place
-locks](../admin-guides/access-controls/guides/locking.mdx) on those nodes.
+locks](../identity-governance/locking.mdx) on those nodes.

 ```code
 $ tctl nodes ls -v --query='labels["teleport.dev/connect-my-computer/owner"] != ""'
@@ -226,8 +226,8 @@ teleport-azure-access-agent-0   1/1     Running   0          99s
  your Teleport users can only manage Azure resources temporarily, with no
  longstanding admin roles for attackers to hijack. View our documentation on
  [Role Access
-  Requests](../../../admin-guides/access-controls/access-requests/role-requests.mdx) and
-  [Access Request plugins](../../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+  Requests](../../../identity-governance/access-requests/role-requests.mdx) and
+  [Access Request plugins](../../../identity-governance/access-request-plugins/access-request-plugins.mdx).
 - Consult the Azure documentation for information about [Azure managed
  identities](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
  and how to [manage user-assigned managed
@@ -223,8 +223,8 @@ Application Service host.
  your Teleport users can only manage Azure resources temporarily, with no
  longstanding admin roles for attackers to hijack. View our documentation on
  [Role Access
-  Requests](../../../admin-guides/access-controls/access-requests/role-requests.mdx) and
-  [Access Request plugins](../../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+  Requests](../../../identity-governance/access-requests/role-requests.mdx) and
+  [Access Request plugins](../../../identity-governance/access-request-plugins/access-request-plugins.mdx).
 - Consult the Azure documentation for information about [Azure managed
  identities](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
  and how to [manage user-assigned managed
@@ -643,8 +643,8 @@ command.
  ensure that your Teleport users can only manage Google Cloud resources
  temporarily, with no longstanding admin roles for attackers to hijack. View
  our documentation on [Role Access
-  Requests](../../../admin-guides/access-controls/access-requests/role-requests.mdx) and [Access
-  Request plugins](../../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+  Requests](../../../identity-governance/access-requests/role-requests.mdx) and [Access
+  Request plugins](../../../identity-governance/access-request-plugins/access-request-plugins.mdx).
 - You can proxy any `gcloud` or `gsutil` command via Teleport. For a full
  reference of commands, view the Google Cloud documentation for
  [`gcloud`](https://cloud.google.com/sdk/gcloud/reference) and
@@ -11,7 +11,7 @@ Some of the things you can do with database access:
 - Enable users to retrieve short-lived database certificates using a Single Sign-On
  flow, thus maintaining their organization-wide identity.
 - Configure role-based access controls for databases and implement custom
-  [Access Request](../../admin-guides/access-controls/access-requests/access-requests.mdx) workflows.
+  [Access Request](../../identity-governance/access-requests/access-requests.mdx) workflows.
 - Capture database activity in the Teleport audit log.

 Teleport protects databases through the Teleport Database Service, which is a
@@ -452,8 +452,8 @@ RBAC configurations.

 Now that you know how to configure Teleport's RBAC system to control access to
 Kubernetes clusters, learn how to set up [Resource Access
-Requests](../../admin-guides/access-controls/access-requests/resource-requests.mdx)
+Requests](../../identity-governance/access-requests/resource-requests.mdx)
 for just-in-time access and [Access Request
-plugins](../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx) so you can manage
+plugins](../../identity-governance/access-request-plugins/access-request-plugins.mdx) so you can manage
 access with your communication workflow of choice.

@@ -48,7 +48,7 @@ backend, and embeds a copy of the counter in the certificate.

 If the counter embedded in your bot certificate doesn't match the counter
 stored in Teleport's Auth Service, the renewal will fail and the bot user will
-be automatically [locked](../../admin-guides/access-controls/guides/locking.mdx).
+be automatically [locked](../../identity-governance/locking.mdx).

 Renewable certificates are exclusively stored in the bot's internal data
 directory, by default `/var/lib/teleport/bot`. It's possible to trigger this by
@@ -122,7 +122,7 @@ To get a new certificate with the new role set, the user will need to log out
 and log back in.

 Revocation of Teleport access should be done with Teleport's
-[session and identity locks](./admin-guides/access-controls/guides/locking.mdx),
+[session and identity locks](identity-governance/locking.mdx),
 not by removing roles.

 ## Does Teleport support provisioning users via SCIM?
@@ -131,7 +131,7 @@ Teleport supports [SCIM](https://scim.cloud/) provisioning for Okta via the
 hosted Okta integration, available in the Enterprise (Cloud) and Enterprise
 (Self-Hosted) versions of Teleport.

-Refer to the [hosted Okta integration guide](./admin-guides/access-controls/okta/okta.mdx)
+Refer to the [hosted Okta integration guide](identity-governance/okta/okta.mdx)
 for details on setting up and configuring SCIM support.

 ## Why do I see an alert that some agents are out of date?
@@ -79,7 +79,7 @@ across distributed infrastructures.
 | [Teleport VNet](./connect-your-client/vnet.mdx) | ✔ | ✔ | ✔ |
 |**Short-lived privileges.** Ephemeral authorization granted through short-lived certificates:||||
 | [Role-Based Access Control](./admin-guides/access-controls/guides/role-templates.mdx) | ✔ | ✔ | ✔ |
-| [Just-in-Time Access Requests & Reviews](./admin-guides/access-controls/access-requests/resource-requests.mdx) | Available in Teleport Identity Governance | Available in Teleport Identity Governance | Only can request roles through CLI  |
+| [Just-in-Time Access Requests & Reviews](identity-governance/access-requests/resource-requests.mdx) | Available in Teleport Identity Governance | Available in Teleport Identity Governance | Only can request roles through CLI  |
 |**Session recording and interactive controls.** Record, replay, join, and moderate interactive sessions:||||
 | [Session Recording with Playback](./reference/architecture/session-recording.mdx) | ✔ | ✔ | ✔ |
 | [Enhanced Session Recording](./enroll-resources/server-access/guides/bpf-session-recording.mdx) | ✔ | ✔ | ✔ |
@@ -124,12 +124,12 @@ and non-human identities.
 |---|:---:|:---:|:---:|
 | [JIT Access Requests](./admin-guides/access-controls/guides/dual-authz.mdx): Grant only those privileges necessary to complete the task at hand. Remove the need for super-privileged accounts. | ✔ | ✔ | Only can request roles through CLI  |
 | Automatic Access Requests & Approvals: Automate pre-defined workflows based on RBAC, ABAC, or context-based authorization. | ✔ | ✔ | ✖ |
-| [Access Lists & Access Reviews](./admin-guides/access-controls/access-lists/access-lists.mdx): Review access requests using Slack, PagerDuty, Microsoft Teams, Jira and ServiceNow. Assign managers, automate mandatory reviews, and implement custom review logic using our API and Go SDK. Integrates with AWS Identity Center. | ✔ | ✔ | ✖ |
-| [Session & Identity Locks](./admin-guides/access-controls/guides/locking.mdx): Lock suspicious or compromised identities and stop all their activity across all protocols and services. | ✔ | ✔ | ✖ |
-| [Device Trust](./admin-guides/access-controls/device-trust/guide.mdx): Require an up-to-date, registered device for each authentication. Teleport uses TPMs and secure enclaves to give every device a cryptographic identity. Restrict further by resource or MDM-authorization. | ✔ | ✔ | ✖ |
+| [Access Lists & Access Reviews](identity-governance/access-lists/access-lists.mdx): Review access requests using Slack, PagerDuty, Microsoft Teams, Jira and ServiceNow. Assign managers, automate mandatory reviews, and implement custom review logic using our API and Go SDK. Integrates with AWS Identity Center. | ✔ | ✔ | ✖ |
+| [Session & Identity Locks](identity-governance/locking.mdx): Lock suspicious or compromised identities and stop all their activity across all protocols and services. | ✔ | ✔ | ✖ |
+| [Device Trust](identity-governance/device-trust/guide.mdx): Require an up-to-date, registered device for each authentication. Teleport uses TPMs and secure enclaves to give every device a cryptographic identity. Restrict further by resource or MDM-authorization. | ✔ | ✔ | ✖ |
 | User & Group Provisioning & Deprovisioning (SCIM & Custom Protocols), including Okta and Entra | ✔ | ✔ | ✖ |
-| [Access Monitoring & Response](./admin-guides/access-controls/access-monitoring.mdx): Detect overly broad privileges and inspect sessions that are not using strong protection, such as multi-factor authentication or device trust. Alert on access violations and purge unused permissions with automated access rules. | ✔ | ✔ | ✖ |
-| [Okta integration](./admin-guides/access-controls/okta/okta.mdx): Configure Teleport to import and grant access to Okta applications and user groups. | ✔ | ✔ | ✖ |
+| [Access Monitoring & Response](identity-governance/access-monitoring.mdx): Detect overly broad privileges and inspect sessions that are not using strong protection, such as multi-factor authentication or device trust. Alert on access violations and purge unused permissions with automated access rules. | ✔ | ✔ | ✖ |
+| [Okta integration](identity-governance/okta/okta.mdx): Configure Teleport to import and grant access to Okta applications and user groups. | ✔ | ✔ | ✖ |
 | Microsoft Entra ID directory synchronization and SSO [integration](./admin-guides/access-controls/sso/azuread.mdx) | ✔ | ✔ | ✖ |

 ## Teleport Identity Security
@@ -2,6 +2,7 @@
 title: Access Lists
 description: Use Access Lists in Teleport
 layout: tocless-doc
+sidebar_position: 3
 ---

 Access Lists allow Teleport users to be granted long term access to resources
@@ -13,4 +14,4 @@ traits, which then tie easily back into Teleport's existing RBAC system.

 [Nested Access Lists](nested-access-lists.mdx)

-[Access List Reference](../../../reference/access-controls/access-lists.mdx)
+[Access List Reference](../../reference/access-controls/access-lists.mdx)
@@ -29,7 +29,7 @@ app_service:

 And restart Teleport. The "dumper" app should show up in the resource list.

-![Debug app](../../../../img/access-controls/access-lists/debug-app.png)
+![Debug app](../../../img/access-controls/access-lists/debug-app.png)

 ## Step 2/4. Create a test user

@@ -40,7 +40,7 @@ another user if you so choose. If you would rather use your own user, skip to th
 Navigate to the management pane and select "Users." Click on "Create New User" and fill in `test-user` as
 the name and select `requester` as the role.

-![Create Test User](../../../../img/access-controls/access-lists/create-test-user.png)
+![Create Test User](../../../img/access-controls/access-lists/create-test-user.png)

 Click "Save," and then navigate to the provided URL in order to set up the credentials for your test user.
 Try logging into the cluster with the test user to verify that no resources show up in the resources page.
@@ -50,26 +50,26 @@ Try logging into the cluster with the test user to verify that no resources show
 Next, we'll create a simple Access List that will grant the `access` role to its members.
 Login as the administrative user mentioned in the prerequisites. Click on "Add New" in the left pane, and then "Create an Access List."

-![Navigate to create new Access List](../../../../img/access-controls/access-lists/create-new-access-list.png)
+![Navigate to create new Access List](../../../img/access-controls/access-lists/create-new-access-list.png)

 Here, fill in a title, description, and grant the `access` role. Select a date in the future for the next
 review date.

-![Fill out Access List Fields](../../../../img/access-controls/access-lists/fill-out-access-list-fields.png)
+![Fill out Access List Fields](../../../img/access-controls/access-lists/fill-out-access-list-fields.png)

 Under "List Owners" select `editor` as a required role, then add your administrative user under "Add
 Eligible List Owners." By selecting `editor` as a required role, this will ensure that any owner of the list
 must have the `editor` role in order to actually manage the list. If the user loses this role later, they will
 not be able to manage the list, though they will still be reflected as an owner.

-![Select an owner](../../../../img/access-controls/access-lists/select-owner.png)
+![Select an owner](../../../img/access-controls/access-lists/select-owner.png)

 Under "Members" select `requester` as a required role, then add your test user to the Access List. Similar to
 the owner requirements, this will ensure that any member of the list must have the `requester` role in order to
 be granted the access described in this list. If the user loses this role later, they will not be granted the
 roles or traits described in the Access List.

-![Add a member](../../../../img/access-controls/access-lists/add-member.png)
+![Add a member](../../../img/access-controls/access-lists/add-member.png)

 Finally, click "Create Access List" at the bottom of the page.

@@ -80,5 +80,5 @@ the cluster, and should be able to interact with it as expected.

 ## Next Steps

- Familiarize yourself with the CLI tooling available for managing Access Lists in the [reference](../../../reference/access-controls/access-lists.mdx).
+- Familiarize yourself with the CLI tooling available for managing Access Lists in the [reference](../../reference/access-controls/access-lists.mdx).
 - Learn how to work with nested Access Lists in the [nested Access Lists guide](./nested-access-lists.mdx).
@@ -29,7 +29,7 @@ Inheritance is recursive – members of "Engineering Team" can themselves be Acc
 with their own members, and so on. However, circular nesting is not allowed, and nesting is limited
 to a maximum depth of 10 levels.

-For more information, see the [Access Lists reference](../../../reference/access-controls/access-lists.mdx).
+For more information, see the [Access Lists reference](../../reference/access-controls/access-lists.mdx).

 ## Prerequisites

@@ -79,5 +79,5 @@ the "dumper" app should be visible to the user.

 ## Next Steps

- Review the [Access Lists reference](../../../reference/access-controls/access-lists.mdx) for more detailed information on Access Lists' nesting and inheritance.
+- Review the [Access Lists reference](../../reference/access-controls/access-lists.mdx) for more detailed information on Access Lists' nesting and inheritance.
 - Learn how nested Access Lists work with Okta/SCIM synchronization in [Synchronization with Okta and SCIM](../okta/app-and-group-sync.mdx).
@@ -1,6 +1,7 @@
 ---
-title: Getting Started with Access Monitoring
+title: Access Monitoring
 description: Learn how to use Access Monitoring.
+sidebar_position: 6
 ---

 Access Monitoring allows users to understand and analyze the access patterns in a Teleport cluster.
@@ -23,7 +24,7 @@ Users are able to write their own custom access monitoring queries by querying t

 ## Prerequisites
 - Teleport v14 or later.
- For self-hosted Teleport the [Amazon Athena Backend](../../reference/backends.mdx) is required.
+- For self-hosted Teleport the [Amazon Athena Backend](../reference/backends.mdx) is required.


 ### Configuration
@@ -243,7 +244,7 @@ WHERE
  command LIKE '%/etc/passwd%';
 ```

-![exec passwd](../../../img/access-monitoring/exec_passwd.png)
+![exec passwd](../../img/access-monitoring/exec_passwd.png)

 - Select the count of unique IP addresses associated with each user cert over different event dates:
 ```sql
@@ -343,7 +344,7 @@ ORDER BY
    event_date
 ```

-![privileged access report](../../../img/access-monitoring/privileged_access_report.png)
+![privileged access report](../../img/access-monitoring/privileged_access_report.png)


 **Suggestion:**  Set up Access Requests, Device Trust and per-session MFA.
@@ -499,7 +500,7 @@ ORDER BY
    event_date
 ```

-**Suggestion:**  Use short-lived tokens to reduce risk of compromise or [delegated](../../reference/join-methods.mdx) joining when possible.
+**Suggestion:**  Use short-lived tokens to reduce risk of compromise or [delegated](../reference/join-methods.mdx) joining when possible.

 ### Root SSH sessions

@@ -2,6 +2,7 @@
 title: Just-in-Time Access Request Plugins
 description: "Use Teleport's Access Request plugins to least-privilege access without sacrificing productivity."
 layout: tocless-doc
+sidebar_position: 2
 ---

 Teleport Just-in-Time Access Requests allow users to receive temporary elevated
@@ -56,4 +57,4 @@ workflows by reading our setup guides:

 To read more about the architecture of an Access Request plugin, and start
 writing your own, read our [Access Request plugin development
-guide](../../api/access-plugin.mdx).
+guide](../../admin-guides/api/access-plugin.mdx).
@@ -1,5 +1,6 @@
 ---
 title: Access Requests with Datadog Incident Management
+sidebar_label: Datadog
 description: How to set up Teleport's Datadog Incident Management plugin for privilege elevation approvals.
 ---

@@ -100,7 +101,7 @@ select **Enroll Users** and create a user with the `editor-requester` role.

 You should end up with two users that look like this:

-![Teleport Users](../../../../img/enterprise/plugins/datadog/teleport-users.png)
+![Teleport Users](../../../img/enterprise/plugins/datadog/teleport-users.png)

 ## Step 3/6. Generate Datadog credentials

@@ -115,7 +116,7 @@ First, in the Datadog web UI navigate to **Organization Settings -> Access -> AP
 to view your organization's API keys. To generate a new API key, click on **New Key**
 and name it "Teleport Access". Copy the API key to paste in a later step.

-![Datadog dashboard for API Keys](../../../../img/enterprise/plugins/datadog/dashboard-api-keys.png)
+![Datadog dashboard for API Keys](../../../img/enterprise/plugins/datadog/dashboard-api-keys.png)

 ### Create a Datadog Service Account

@@ -126,20 +127,20 @@ email you'd like to associate with the service account, then assign the role
 "Datadog Standard Role". This role provides the required permissions necessary to
 manage the incidents in Datadog.

-![Datadog dashboard for Service Accounts](../../../../img/enterprise/plugins/datadog/dashboard-service-accounts.png)
+![Datadog dashboard for Service Accounts](../../../img/enterprise/plugins/datadog/dashboard-service-accounts.png)

 Now click on the "Teleport Access" service account that was just created and click
 on the **Application Keys** tab and click on **New Key** and name it "Teleport Access"
 to create a new Application key. Copy the Application key to paste in a later step.

-![Datadog dashboard for Application Keys](../../../../img/enterprise/plugins/datadog/dashboard-application-keys.png)
+![Datadog dashboard for Application Keys](../../../img/enterprise/plugins/datadog/dashboard-application-keys.png)

 ## Step 4/6. Enroll the Datadog Incident Management plugin

 At this point, you're now ready to enroll the Datadog Incident Management plugin.
 Navigate to **Access Management -> Enroll New Integration -> Datadog**.

-![Select enrollment](../../../../img/enterprise/plugins/datadog/select-enrollment.png)
+![Select enrollment](../../../img/enterprise/plugins/datadog/select-enrollment.png)

 Provide the API and Application keys generated above. Select the desired API endpoint.
 Then provide the Datadog team handle, that you created earlier, as the fallback recipient.
@@ -150,7 +151,7 @@ can be a Datadog user email, or a Datadog team handle. You can configure more cu
 notification routing rules afterwards using
 [Access Monitoring Rules](./notification-routing-rules.mdx).

-![Datadog enrollment](../../../../img/enterprise/plugins/datadog/datadog-enrollment.png)
+![Datadog enrollment](../../../img/enterprise/plugins/datadog/datadog-enrollment.png)

 If the recipient is a Datadog team, the team name will be added to the Datadog incident
 teams attribute.
@@ -160,7 +161,7 @@ the team members won't be notified, you must configure Datadog notification rule
 to page the team members. To do so, navigate to **Incidents -> Settings -> Notifications -> Rules**
 and create a new rule matching alerts labeled with the recipient team.

-![Datadog dashboard for Incident Notification Rules](../../../../img/enterprise/plugins/datadog/dashboard-notification-rules.png)
+![Datadog dashboard for Incident Notification Rules](../../../img/enterprise/plugins/datadog/dashboard-notification-rules.png)

 <details>
 <summary>Suggested reviewers</summary>
@@ -185,20 +186,20 @@ As the Teleport user `[email protected]`, create an Access Request for the
 `editor` role. Navigate to the **Access Requests** tab and click on
 **New Access Request**:

-![New access request](../../../../img/enterprise/plugins/datadog/create-access-request.png)
+![New access request](../../../img/enterprise/plugins/datadog/create-access-request.png)

 In Datadog, you will see a new incident containing information about the
 Access Request:

 ![Datadog dashboard showing an Access
-Request](../../../../img/enterprise/plugins/datadog/new-access-request-incident.png)
+Request](../../../img/enterprise/plugins/datadog/new-access-request-incident.png)

 ### Resolve the request

 Once you receive an Access Request message, click the link to visit Teleport and
 approve or deny the request:

-![Review access request](../../../../img/enterprise/plugins/datadog/review-access-request.png)
+![Review access request](../../../img/enterprise/plugins/datadog/review-access-request.png)

 <Admonition type="info" title="Auditing Access Requests">

@@ -1,6 +1,7 @@
 ---
-title: Routing Access Request notifications
+title: Routing Access Request Notifications
 description: How to set up Teleport's Access Monitoring Rules to route Access Request notifications
+sidebar_position: 11
 ---

 With Teleport's Access Monitoring Rules, Access Request notifications can be
@@ -19,7 +20,7 @@ the the AMR and uses it to process incoming events.
 Plugins implement AMR handling logic separately from one another. Currently,
 only a subset of hosted plugins support notification routing rules. We are
 working on extending support to the rest of hosted plugins. Keep an eye on
-Teleport [changelog](../../../changelog.mdx) to learn about new plugins.
+Teleport [changelog](../../changelog.mdx) to learn about new plugins.

 ## Prerequisites

@@ -38,7 +39,7 @@ Teleport [changelog](../../../changelog.mdx) to learn about new plugins.
  ```

  You can download these tools by following the appropriate [Installation 
-  instructions](../../../installation.mdx) for your environment and Teleport edition.
+  instructions](../../installation.mdx) for your environment and Teleport edition.

 - At least one of the Teleport Access Plugins that support Access Monitoring Rules is enrolled.

@@ -55,11 +56,11 @@ You can define an Access Request notification rule in two ways:
 To create an Access Monitoring Rule via the Web UI, first navigate to
 the Access Request page and click on `View Notification Routing Rules`.

-![View Notification Routing Rules](../../../../img/enterprise/plugins/access_monitoring_rules/view_routing_rules.png)
+![View Notification Routing Rules](../../../img/enterprise/plugins/access_monitoring_rules/view_routing_rules.png)

 Then click `Create Notification Rule`.

-![Create Access Monitoring Rule](../../../../img/enterprise/plugins/access_monitoring_rules/access_monitoring_rule_ui.png)
+![Create Access Monitoring Rule](../../../img/enterprise/plugins/access_monitoring_rules/access_monitoring_rule_ui.png)

 If a plugin that supports Access Monitoring Rule based routing is not enrolled
 the UI will prompt you to enroll one.
@@ -1,5 +1,6 @@
 ---
 title: Access Requests with Opsgenie
+sidebar_label: Opsgenie
 description: How to set up Teleport's Opsgenie plugin for privilege elevation approvals.
 ---

@@ -33,7 +34,7 @@ Opsgenie.
  ```

  You can download these tools by following the appropriate [Installation 
-  instructions](../../../installation.mdx) for your environment and Teleport edition.
+  instructions](../../installation.mdx) for your environment and Teleport edition.

 - An Opsgenie account with the ability to create API keys with the 'read' and
  'create and update' access rights.
@@ -91,11 +92,11 @@ plugin:

 To create a user first navigate to Management -> Access -> Users

-![Add user one](../../../../img/enterprise/plugins/opsgenie/add-user-one.png)
+![Add user one](../../../img/enterprise/plugins/opsgenie/add-user-one.png)

 Then select 'Create New User' and create a user with the requester role.

-![Add user two](../../../../img/enterprise/plugins/opsgenie/add-user-two.png)
+![Add user two](../../../img/enterprise/plugins/opsgenie/add-user-two.png)

 ## Step 3/5. Set up an Opsgenie API key

@@ -112,7 +113,7 @@ At this point, you have generated credentials that the Opsgenie plugin will use
 to connect to the Opsgenie API. To configure the plugin to use this API key navigate
 to Management -> Integrations -> Enroll New Integration.

-![Integrations page](../../../../img/enterprise/plugins/opsgenie/opsgenie-integration-page.png)
+![Integrations page](../../../img/enterprise/plugins/opsgenie/opsgenie-integration-page.png)

 ## Step 5/5. Test the Opsgenie plugin

@@ -1,5 +1,6 @@
 ---
 title: Access Requests with ServiceNow
+sidebar_label: ServiceNow
 description: How to set up Teleport's ServiceNow plugin for privilege elevation approvals.
 ---

@@ -74,7 +75,7 @@ At this point, you have a ServiceNow user that the ServiceNow plugin will use
 to connect to the ServiceNow API. To configure the plugin to use this user navigate
 to Management -> Integrations -> Enroll New Integration.

-![Integrations page](../../../../img/enterprise/plugins/servicenow/servicenow-integration-page.png)
+![Integrations page](../../../img/enterprise/plugins/servicenow/servicenow-integration-page.png)

 The plugin requires credentials that can read and write to the incident table.

@@ -1,5 +1,6 @@
 ---
 title: Run the Discord Access Request Plugin
+sidebar_label: Discord
 description: How to set up Teleport's Discord plugin for privilege elevation approvals.
 ---

@@ -11,7 +12,7 @@ Access Requests. Users can then approve and deny Access Requests from within
 Discord, making it easier to implement security best practices without
 compromising productivity.

-![The Discord Access Request plugin](../../../../img/enterprise/plugins/discord.png)
+![The Discord Access Request plugin](../../../img/enterprise/plugins/discord.png)

 <details>
 <summary>This integration is hosted on Teleport Cloud</summary>
@@ -76,7 +77,7 @@ you must register a new app with the Discord API.
 Visit [https://discord.com/developers/applications](https://discord.com/developers/applications)
 to create a new Discord application. Click "New Application" and name the application "Teleport".

-Set the application icon ([download application icon here](../../../../img/sso/onelogin/teleport.png)).
+Set the application icon ([download application icon here](../../../img/sso/onelogin/teleport.png)).

 ### Create the application bot

@@ -91,7 +92,7 @@ Discord API.

 Go to the "OAuth2" tab, open the "URL Generator" and check the "bot" and "Send Messages" permissions.

-![Set Discord permissions](../../../../img/enterprise/plugins/discord/discord-permissions.png)
+![Set Discord permissions](../../../img/enterprise/plugins/discord/discord-permissions.png)

 Copy and access the generated URL. Choose to install the application into the
 desired Discord server. If the server is not available in the
@@ -1,5 +1,6 @@
 ---
 title: Access Requests with Email
+sidebar_label: Email
 description: How to set up the Teleport email plugin to notify users when another user requests elevated privileges.
 ---

@@ -9,14 +10,14 @@ at least some of their communications, Teleport's email plugin makes it
 straightforward to integrate Access Requests into your existing workflows,
 letting you implement security best practices without compromising productivity.

-![The email Access Request plugin](../../../../img/enterprise/plugins/email.png)
+![The email Access Request plugin](../../../img/enterprise/plugins/email.png)

 <details>
 <summary>This integration is hosted on Teleport Enterprise (Cloud)</summary>

 (!docs/pages/includes/plugins/enroll.mdx name="the Email integration"!)

-![Enroll email plugin](../../../../img/enterprise/plugins/email/enroll-email.png)
+![Enroll email plugin](../../../img/enterprise/plugins/email/enroll-email.png)

 Configure and connect email integration by providing the following configuration
 values:
@@ -29,7 +30,7 @@ notifications.
 **`Email Service`**: Selects the desired email service. Note: only `Mailgun` is
 supported for Teleport Enterprise (Cloud).

-![Configure Mailgun integration](../../../../img/enterprise/plugins/email/configure-mailgun.png)
+![Configure Mailgun integration](../../../img/enterprise/plugins/email/configure-mailgun.png)

 Complete Mailgun integration by providing the following Mailgun API
 configuration values:
@@ -1,5 +1,6 @@
 ---
 title: Run the Jira Access Request Plugin
+sidebar_label: Jira
 description: How to set up the Teleport Jira plugin to notify users when another user requests elevated privileges.
 ---

@@ -128,7 +129,7 @@ contains the following four:
 Create a column with the same name as each status. The result should be the
 following:

-![Jira board setup](../../../../img/enterprise/plugins/jira/board-setup.png)
+![Jira board setup](../../../img/enterprise/plugins/jira/board-setup.png)

 <Admonition type="warning">

@@ -390,7 +391,7 @@ Access Request:

 When you create the request, you will see a new task in the "Pending" column of the Access Requests board:

-![New Access Request](../../../../img/enterprise/plugins/jira/new-request.png)
+![New Access Request](../../../img/enterprise/plugins/jira/new-request.png)

 ### Resolve the request

@@ -1,5 +1,6 @@
 ---
 title: Run the Mattermost Access Request plugin
+sidebar_label: Mattermost
 description: How to set up Teleport's Mattermost plugin for privilege elevation approvals.
 ---

@@ -22,7 +23,7 @@ can then approve and deny Access Requests by following the message link, making
 it easier to implement security best practices without compromising
 productivity.

-![The Mattermost Access Request plugin](../../../../img/enterprise/plugins/mattermost/diagram.png)
+![The Mattermost Access Request plugin](../../../img/enterprise/plugins/mattermost/diagram.png)

 ## Prerequisites

@@ -97,7 +98,7 @@ System Console → Integrations → Bot Accounts.

 Set "Enable Bot Account Creation" to "true".

-![Enable Mattermost bots](../../../../img/enterprise/plugins/mattermost/mattermost_admin_console_integrations_bot_accounts.png)
+![Enable Mattermost bots](../../../img/enterprise/plugins/mattermost/mattermost_admin_console_integrations_bot_accounts.png)

 This will allow you to create a new bot account for the Mattermost plugin.

@@ -114,7 +115,7 @@ Icon.

 Set "post:all" to "Enabled".

-![Enable Mattermost Bots](../../../../img/enterprise/plugins/mattermost/mattermost_bot.png)
+![Enable Mattermost Bots](../../../img/enterprise/plugins/mattermost/mattermost_bot.png)

 Click "Create Bot Account". We will use the resulting OAuth 2.0 token when we
 configure the Mattermost plugin.
@@ -206,7 +207,7 @@ You will need to invite your Teleport plugin to any channel you add to the
 navigate to each channel you want to invite the plugin to, and enter `/invite
@teleport` (or the name of the bot you configured) into the message box.

-![Invite the bot](../../../../img/enterprise/plugins/mattermost/add-bot.png)
+![Invite the bot](../../../img/enterprise/plugins/mattermost/add-bot.png)

 <details>
 <summary>Suggested reviewers</summary>
@@ -1,5 +1,6 @@
 ---
 title: Access Requests with Microsoft Teams
+sidebar_label: Microsoft Teams
 description: How to set up Teleport's Microsoft Teams plugin for privilege elevation approvals.
 ---

@@ -11,11 +12,11 @@ from Teleport.

 (!docs/pages/includes/plugins/enroll.mdx name="the Microsoft Teams integration"!)

-![Create Microsoft Teams Bot](../../../../img/enterprise/plugins/msteams/enroll-bot.png)
+![Create Microsoft Teams Bot](../../../img/enterprise/plugins/msteams/enroll-bot.png)

 Once enrolled you can download the required `app.zip` file from the integrations status page.

-![Download app.zip](../../../../img/enterprise/plugins/msteams/app-zip.png)
+![Download app.zip](../../../img/enterprise/plugins/msteams/app-zip.png)

 </details>

@@ -26,7 +27,7 @@ Users can then approve and deny Access Requests by following the message link,
 making it easier to implement security best practices without compromising
 productivity.

-![The Microsoft Teams Access Request plugin](../../../../img/enterprise/plugins/msteams.png)
+![The Microsoft Teams Access Request plugin](../../../img/enterprise/plugins/msteams.png)

 ## Prerequisites

@@ -105,7 +106,7 @@ the resource group and the bot pricing tier.
 In the "Microsoft App ID" section choose "Single Tenant" and "Create new
 Microsoft App ID".

-![Create Azure Bot](../../../../img/enterprise/plugins/msteams/create-azure-bot.png)
+![Create Azure Bot](../../../img/enterprise/plugins/msteams/create-azure-bot.png)

 ### Connect the bot to Microsoft Teams

@@ -115,7 +116,7 @@ channel.

 The result should be as follows:

-![Add Bot Channel](../../../../img/enterprise/plugins/msteams/add-bot-channel.png)
+![Add Bot Channel](../../../img/enterprise/plugins/msteams/add-bot-channel.png)

 ### Obtain information about your Microsoft App

@@ -125,7 +126,7 @@ plugin configuration.

 Click the "Manage" link next to "Microsoft App ID". This will open the app management view.

-![Manage Bot App](../../../../img/enterprise/plugins/msteams/manage-bot-app.png)
+![Manage Bot App](../../../img/enterprise/plugins/msteams/manage-bot-app.png)

 Then, go to the "Certificates & Secrets" section and choose to create a "New client secret".
 Use the "Copy" icon to copy the newly created secret and keep it with the
@@ -153,12 +154,12 @@ At this point the app declares the required permissions but those have not been
 If you are an admin, click "Grant admin consent for \<directory name\>". If you are not an admin,
 contact an admin user to grant the permissions.

-![Specify App Permissions](../../../../img/enterprise/plugins/msteams/specify-app-permissions.png)
+![Specify App Permissions](../../../img/enterprise/plugins/msteams/specify-app-permissions.png)

 Once permissions have been approved, refresh the page and check the approval status.
 The result should be as follows:

-![Granted App Permissions](../../../../img/enterprise/plugins/msteams/granted-app-permissions.png)
+![Granted App Permissions](../../../img/enterprise/plugins/msteams/granted-app-permissions.png)

 ## Step 6/9. Configure the Teleport Microsoft Teams plugin

@@ -314,7 +315,7 @@ the email address of a Microsoft Teams user or a channel URL.
 You can find the URL of a channel by opening the channel and clicking the button
 "Get link to channel":

-![Copy Teams Channel](../../../../img/enterprise/plugins/msteams/copy-teams-channel.png)
+![Copy Teams Channel](../../../img/enterprise/plugins/msteams/copy-teams-channel.png)

 The `role_to_recipients` map must also include an entry for `"*"`, which the
 plugin looks up if no other entry matches a given role name. In the example
@@ -382,7 +383,7 @@ The final configuration file should resemble the following:
 Open Microsoft Teams and go to "Apps", "Manage your apps", then in the additional
 choices menu choose "Upload an App".

-![Upload Teams App](../../../../img/enterprise/plugins/msteams/upload-teams-app.png)
+![Upload Teams App](../../../img/enterprise/plugins/msteams/upload-teams-app.png)

 If you're a Teams admin, choose "Upload an app to your org's app catalog".
 This will allow you to skip the approval step.
@@ -399,7 +400,7 @@ They can do so by connecting to the
 [Teams admin dashboard](https://admin.teams.microsoft.com/policies/manage-apps),
 searching "TeleBot", selecting it and choosing "Allow".

-![Upload Teams App](../../../../img/enterprise/plugins/msteams/allowed-teams-app.png)
+![Upload Teams App](../../../img/enterprise/plugins/msteams/allowed-teams-app.png)

 ### Add the Teams App to a Team

@@ -407,7 +408,7 @@ Once the app is approved it should appear in the "Apps built for your org" secti
 Add the newly uploaded app to a team. Open the app, click "Add to a team",
 choose the "General" channel of your team and click "Set up a bot".

-![Add Teams App](../../../../img/enterprise/plugins/msteams/add-teams-app.png)
+![Add Teams App](../../../img/enterprise/plugins/msteams/add-teams-app.png)

 Note: Once an app is added to a team, it can post on all channels.

@@ -443,7 +444,7 @@ Check your MS Teams!

 The plugin should exit and you should have received two messages through Microsoft Teams.

-![Validate Bot Message](../../../../img/enterprise/plugins/msteams/validate-bot-message.png)
+![Validate Bot Message](../../../img/enterprise/plugins/msteams/validate-bot-message.png)

 ### Start the MS Teams Plugin

@@ -1,5 +1,6 @@
 ---
 title: Run the PagerDuty Access Request Plugin
+sidebar_label: PagerDuty
 description: How to set up Teleport's PagerDuty plugin for privilege elevation approvals.
 ---

@@ -23,7 +24,7 @@ the on-call team for a service affected by an incident.

 </details>

-![PagerDuty plugin architecture](../../../../img/enterprise/plugins/pagerduty/diagram.png)
+![PagerDuty plugin architecture](../../../img/enterprise/plugins/pagerduty/diagram.png)

 ## Prerequisites

@@ -396,7 +397,7 @@ Leave "Read-only API Key" unchecked. Copy the key to a file on your local
 machine. We'll use the key in the plugin config file later.

 ![Create an API
-key](../../../../img/enterprise/plugins/pagerduty/pagerduty-integrations.png)
+key](../../../img/enterprise/plugins/pagerduty/pagerduty-integrations.png)

 ## Step 6/8. Configure the PagerDuty plugin

@@ -562,7 +563,7 @@ In PagerDuty, you will see a new incident containing information about the
 Access Request:

 ![PagerDuty dashboard showing an Access
-Request](../../../../img/enterprise/plugins/pagerduty/new-access-req-incident.png)
+Request](../../../img/enterprise/plugins/pagerduty/new-access-req-incident.png)

 ### Resolve the request

@@ -1,6 +1,7 @@
 ---
 title: Run the Slack Access Request Plugin
 description: How to set up Teleport's Slack plugin for privilege elevation approvals.
+sidebar_label: Slack
 ---

 This guide will explain how to set up Slack to receive Access Request messages
@@ -20,7 +21,7 @@ Access Requests. Users are then directed to log in to the Teleport cluster where
 they can approve and deny Access Requests, making it easier to implement security 
 best practices without compromising productivity.

-![The Slack Access Request plugin](../../../../img/enterprise/plugins/slack/diagram.png)
+![The Slack Access Request plugin](../../../img/enterprise/plugins/slack/diagram.png)

 Here is an example of sending an Access Request via Teleport's Slack plugin:

@@ -97,7 +98,7 @@ Visit [https://api.slack.com/apps](https://api.slack.com/apps) to create a new
 Slack app. Click "Create an App", then "From scratch". Fill in the form as shown
 below:

-![Create Slack App](../../../../img/enterprise/plugins/slack/Create-a-Slack-App.png)
+![Create Slack App](../../../img/enterprise/plugins/slack/Create-a-Slack-App.png)

 The "App Name" should be "Teleport". Click the "Development Slack Workspace"
 dropdown and choose the workspace where you would like to see Access Request
@@ -127,7 +128,7 @@ following scopes:

 The result should look like this:

-![API Scopes](../../../../img/enterprise/plugins/slack/api-scopes.png)
+![API Scopes](../../../img/enterprise/plugins/slack/api-scopes.png)

 After you have configured scopes for your plugin, scroll back to the top of the
 OAuth & Permissions page, find the "OAuth Tokens for Your Workspace" section,
@@ -142,7 +143,7 @@ well.
 After submitting this form, you will see an OAuth token in the "OAuth &
 Permissions" tab under "Tokens for Your Workspace":

-![OAuth Tokens](../../../../img/enterprise/plugins/slack/OAuth.png)
+![OAuth Tokens](../../../img/enterprise/plugins/slack/OAuth.png)

 You will use this token later when configuring the Slack plugin.

@@ -95,7 +95,7 @@ A role matcher can include the following values:

 To add the values of `claims_to_roles` to the lists of role matchers, the Auth
 Service evaluates template expressions with the user's traits. See the [Role
-Templates](../guides/role-templates.mdx#templating-in-access-requests) for more
+Templates](../../admin-guides/access-controls/guides/role-templates.mdx) for more
 information on how Teleport executes template expressions with user traits in
 the `claims_to_roles` field.

@@ -167,7 +167,7 @@ privileges:
 1. Calculate the maximum duration of elevated privileges if the Access Request
   were granted. This is the lowest value of:
   - The `--max-duration` flag of the [`tsh request
-     create`](../../../reference/cli/tsh.mdx) command (if the
+     create`](../../reference/cli/tsh.mdx) command (if the
     user creating the request provides this flag).
   - The lowest value of the `request.max_duration` field included in one of
     the user's requested roles.
@@ -176,7 +176,7 @@ privileges:
   lowest value of:
   - The requested session expiration time, which is the value of the
     `--session-ttl` flag of [`tsh request
-     create`](../../../reference/cli/tsh.mdx).
+     create`](../../reference/cli/tsh.mdx).
   - The remaining time in the user's current Teleport session.
   - The lowest value of the `options.max_session_ttl` field in the user's
     requested roles.
@@ -190,8 +190,8 @@ privileges:
 When creating or reviewing Access Requests, you can specify the earliest time
 that a user can assume elevated privileges by using the `--assume-start-time`
 flag. This flag is available for the
-[`tsh request create`](../../../reference/cli/tsh.mdx) and [`tsh request
-review`](../../../reference/cli/tsh.mdx) commands. The format accepted
+[`tsh request create`](../../reference/cli/tsh.mdx) and [`tsh request
+review`](../../reference/cli/tsh.mdx) commands. The format accepted
 is defined in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339), e.g, `2023-12-12T23:20:50.52Z`.
 The time specified must be in the future.

@@ -235,7 +235,7 @@ valid while it awaits approval:

 1. Begin with with the base expiration of the Access Request, which a user can
   set with the `--request-ttl` flag of the [`tsh request
-   create`](../../../reference/cli/tsh.mdx) command. If this is
+   create`](../../reference/cli/tsh.mdx) command. If this is
   unset, the request TTL is one hour.
 1. If the user's Teleport session is due to expire before the base expiration
   time, Teleport sets the Access Request expiration to the end of the Teleport
@@ -385,7 +385,7 @@ the request has met the criteria specified in one of the thresholds in
 `allow.request.thresholds` associated with that role.

 The value of `filter` is an expression that uses the Teleport [predicate
-language](../../../reference/predicate-language.mdx).
+language](../../reference/predicate-language.mdx).

 For example, the following configuration includes four thresholds, three of which
 have filters:
@@ -505,7 +505,7 @@ following role fields:

 The Auth Service evaluates the `claims_to_roles` field using template
 expressions with the user's traits. See the [Role
-Templates](../guides/role-templates.mdx#templating-in-access-requests) for more
+Templates](../../admin-guides/access-controls/guides/role-templates.mdx) for more
 information on how Teleport executes template expressions with user traits in
 the `claims_to_roles` field.

@@ -673,7 +673,7 @@ pagerduty_services:

 ### Reading annotations in custom plugins

-If you [write your own Access Request plugin](../../api/access-plugin.mdx), the
+If you [write your own Access Request plugin](../../admin-guides/api/access-plugin.mdx), the
 program can access system annotations using a function similar to the following:

 ```go
@@ -694,4 +694,4 @@ Requests with the key `my-annotation`.

 For a full description of the configuration options within a Teleport role,
 refer to the [Access Controls
-Reference](../../../reference/access-controls/roles.mdx).
+Reference](../../reference/access-controls/roles.mdx).
@@ -2,6 +2,7 @@
 title: Just-in-Time Access Requests
 description: Use just-in-time Access Requests to request elevated privileges.
 layout: tocless-doc
+sidebar_position: 1
 ---

 Just-in-time Access Requests allow Teleport users to request access to a
@@ -82,7 +82,7 @@ traits via the Teleport Web UI.
 4. Click **Save**
 5. Verify that the user has been updated with the desired trait.

-![Edit User Traits](../../../../img/access-controls/automatic-reviews/users-edit.png)
+![Edit User Traits](../../../img/access-controls/automatic-reviews/users-edit.png)

 When adding user traits, you can enter any keys and values. The user trait form
 does not support wildcard or regular expressions.
@@ -104,7 +104,7 @@ Next, define the automatic review rule via the Teleport Web UI.
   - **Review decision**: `APPROVED`
 4. Click **Create Rule**

-![Create Automatic Review Rule Editor](../../../../img/access-controls/automatic-reviews/create-automatic-review-rule.png)
+![Create Automatic Review Rule Editor](../../../img/access-controls/automatic-reviews/create-automatic-review-rule.png)

 This Access Monitoring Rule will ensure that Access Requests for the `access`
 role will be automatically reviewed for approval if the Teleport user traits
@@ -121,14 +121,14 @@ Web UI.
 4. Add the `access` role to the Access Request
 5. Click **Proceed to Request**, then **Submit Request**

-![Create Access Request](../../../../img/access-requests/new-role-request.png)
+![Create Access Request](../../../img/access-requests/new-role-request.png)

 At this point, the new Access Request should have been created, automatically
 reviewed, and transitioned into an `APPROVED` state. Navigate **Back to Listings**
 and verify the Access Request status. It might take a second for the review to
 process, so you may have to refresh the page.

-![View Access Requests](../../../../img/access-controls/automatic-reviews/view-access-requests.png)
+![View Access Requests](../../../img/access-controls/automatic-reviews/view-access-requests.png)

 ## Troubleshooting

@@ -147,8 +147,8 @@ other than a role.
 ## Next Steps

 - For more configuration options with Access Monitoring Rules, refer to the
-  [Access Monitoring Rules Reference](../../../reference/access-controls/access-monitoring-rules.mdx).
+  [Access Monitoring Rules Reference](../../reference/access-controls/access-monitoring-rules.mdx).
 - For configuration with Teleport Terraform Provider, refer to the
-  [Terraform Resources Index](../../../reference/terraform-provider/resources/access_monitoring_rule.mdx)
+  [Terraform Resources Index](../../reference/terraform-provider/resources/access_monitoring_rule.mdx)
 - For configuration options with SSO, refer to the
-  [Single Sign-On Guides](../sso/sso.mdx)
+  [Single Sign-On Guides](../../admin-guides/access-controls/sso/sso.mdx)
@@ -122,7 +122,7 @@ However, it prevents you from access any resources belonging to another namespac
 </details>

 Advanced filters and queries are supported. See our
-[filtering reference](../../../reference/cli/cli.mdx) for more information.
+[filtering reference](../../reference/cli/cli.mdx) for more information.

 Try narrowing your search to a specific resource you want to access.

@@ -313,7 +313,7 @@ below, edit one of the user's roles so the `search_as_roles` field includes the
 role you have created.

 For full details on how to use Teleport roles to configure RBAC, see the
-[Access Controls Reference](../../../reference/access-controls/roles.mdx).
+[Access Controls Reference](../../reference/access-controls/roles.mdx).

 #### `node`

@@ -471,7 +471,7 @@ spec:
        - kind: "*"
 ```

-See related section about [Kubernetes Resources](../../../enroll-resources/kubernetes-access/controls.mdx#kubernetes_resources) 
+See related section about [Kubernetes Resources](../../enroll-resources/kubernetes-access/controls.mdx) 
 to see a list of supported `kind` values.

 The `request.kubernetes_resources` field only restricts what `kinds` of Kubernetes resource requests are allowed.
@@ -98,12 +98,12 @@ You can not mix the two. For more information on how to request access to
 specific resources, see the
 [Resource Access Requests Guide](./resource-requests.mdx).

-![New Request](../../../../img/access-requests/new-role-request.png)
+![New Request](../../../img/access-requests/new-role-request.png)

 When all desired roles have been added, click **PROCEED TO REQUEST**, where you
 can review and submit the request.

-![Submit Request](../../../../img/access-requests/submit-request.png)
+![Submit Request](../../../img/access-requests/submit-request.png)

 ## Reviewing Access Requests via the Web UI

@@ -3,6 +3,7 @@ title: Device Trust
 description: Teleport Device Trust Concepts
 layout: tocless-doc
 videoBanner: gBQyj_X1LVw
+sidebar_position: 5
 ---

 (!docs/pages/includes/device-trust/support-notice.mdx!)
@@ -45,7 +45,7 @@ instructions.
 Role-based configuration enforces trusted device access at the role level. It
 can be configured with the `spec.options.device_trust_mode` option and
 applies to the resources in its `allow` rules. It
-works similarly to [`require_session_mfa`](../guides/per-session-mfa.mdx).
+works similarly to [`require_session_mfa`](../../admin-guides/access-controls/guides/per-session-mfa.mdx).

 To enforce authenticated device checks for a specific role when a user accesses
 databases, Kubernetes clusters, and servers with Teleport, update the role with
@@ -132,7 +132,7 @@ ERROR: ssh: rejected: administratively prohibited (unauthorized device)

 <Admonition type="tip" title="Trusted Clusters">
 It is possible to use [trusted
-clusters](../../management/admin/trustedclusters.mdx) to limit the impact of
+clusters](../../admin-guides/management/admin/trustedclusters.mdx) to limit the impact of
 device mode `required`. A leaf cluster in mode `required` will enforce access to
 all of its resources, without imposing the same restrictions to the root
 cluster. Likewise, a root cluster will not enforce Device Trust on resources in
@@ -146,10 +146,10 @@ enforcement](#role-based-trusted-device-enforcement).

 To access apps protected by Device Trust using the Web UI (Teleport v16 or
 later), make sure your device is [registered and enrolled](
-./device-management.mdx#register-a-trusted-device), install [Teleport Connect](../../../connect-your-client/teleport-connect.mdx), and
+./device-management.mdx#register-a-trusted-device), install [Teleport Connect](../../connect-your-client/teleport-connect.mdx), and
 follow the instructions during login.

-Alternatively, you may use [tsh proxy app](../../../reference/cli/tsh.mdx) or the certificates issued by
+Alternatively, you may use [tsh proxy app](../../reference/cli/tsh.mdx) or the certificates issued by
 `tsh app login`.

 As an example, to enforce Device Trust for all `env:production` apps, save the
@@ -198,7 +198,7 @@ enforcement]( #role-based-trusted-device-enforcement).

 To access desktops protected by Device Trust make sure your device is
 [registered and enrolled](./device-management.mdx#register-a-trusted-device),
-install [Teleport Connect](../../../connect-your-client/teleport-connect.mdx), and
+install [Teleport Connect](../../connect-your-client/teleport-connect.mdx), and
 follow the instructions during login.

 As an example, to enforce Device Trust for all `env:production` desktops, save
@@ -244,7 +244,7 @@ device.

 ## Locking a device

-Similar to [session and identity locking](../guides/locking.mdx), a device can
+Similar to [session and identity locking](../locking.mdx), a device can
 be locked using `tctl lock`.

 Locking blocks certificate issuance and ongoing or future accesses originating
@@ -154,5 +154,5 @@ Device Trust enforcement.
  which Teleport replaces with values from the Teleport local user
  database. For full details on how traits work in Teleport roles,
  see the [Access Controls
-  Reference](../../../reference/access-controls/roles.mdx).
+  Reference](../../reference/access-controls/roles.mdx).

@@ -84,9 +84,9 @@ try to recreate your API client.
  <details>
  <summary>Configure Jamf hosted plugin</summary>
    Select the Jamf plugin:
-    ![Select Jamf plugin](../../../../img/access-controls/device-trust/select-jamf.png)
+    ![Select Jamf plugin](../../../img/access-controls/device-trust/select-jamf.png)
    Fill in the required information and click "Connect Jamf" button:
-    ![Configure Jamf plugin](../../../../img/access-controls/device-trust/hosted-jamf.png)
+    ![Configure Jamf plugin](../../../img/access-controls/device-trust/hosted-jamf.png)
  </details>
 </Admonition>

@@ -364,10 +364,10 @@ Create a readonly Jamf user for inventory sync.
   Take note of the user and password.

   User account setup: ![Jamf user setup](
-   ../../../../img/access-controls/device-trust/jamf-setup-1.png)
+   ../../../img/access-controls/device-trust/jamf-setup-1.png)

   Privileges setup: ![Jamf privileges setup](
-   ../../../../img/access-controls/device-trust/jamf-setup-2.png)
+   ../../../img/access-controls/device-trust/jamf-setup-2.png)

 ## Next steps

@@ -0,0 +1,6 @@
+---
+title: Teleport Identity Governance
+description: Provides guides on Teleport Identity Governance.
+---
+
+<DocCardList />
@@ -14,15 +14,14 @@ matching the lock's target.
 A lock can target the following objects or attributes:

 - a Teleport user by the user's name
- a Teleport [RBAC](../../../reference/access-controls/roles.mdx) role by the role's name
- a Teleport [trusted device](
-  ../device-trust/enforcing-device-trust.mdx#locking-a-device) by the device ID
+- a Teleport [RBAC](../reference/access-controls/roles.mdx) role by the role's name
+- a Teleport [trusted device](device-trust/enforcing-device-trust.mdx#locking-a-device) by the device ID
 - an MFA device by the device's UUID
 - an OS/UNIX login
 - a Teleport Agent by the Agent's server UUID (effectively unregistering it from the
  cluster)
 - a Windows desktop by the desktop's name
- an [Access Request](../access-requests/access-requests.mdx) by UUID
+- an [Access Request](access-requests/access-requests.mdx) by UUID

 ## Prerequisites

@@ -161,7 +160,7 @@ spec:
 ```

 The `kind: lock` resources can also be created and updated using `tctl create`
-as per usual. See the [Admin Guide](../../../reference/resources.mdx) for more
+as per usual. See the [Admin Guide](../reference/resources.mdx) for more
 details.
 </details>

@@ -12,7 +12,7 @@ perform required actions within Okta.
 If you do not plan to enroll additional components of the guided Okta
 integration, you can set up only the Okta SSO integration - called an
 authentication connector - by following [Authentication With Okta as an SSO
-Provider](../../../admin-guides/access-controls/sso/okta.mdx).
+Provider](../../admin-guides/access-controls/sso/okta.mdx).
 
 ## Prerequisites

@@ -28,7 +28,7 @@ Provider](../../../admin-guides/access-controls/sso/okta.mdx).
  the integration is hardcoded as `okta`. If you have a connector named `okta`
  and you'd like to use a different one, you'll have to create your connector
  manually following [Authentication With Okta as an SSO Provider
-  ](../../../admin-guides/access-controls/sso/okta.mdx).
+  ](../../admin-guides/access-controls/sso/okta.mdx).

 - (!docs/pages/includes/tctl.mdx!)

@@ -64,7 +64,7 @@ from Okta.
 1. From the main navigation menu, select **Applications** -> **Applications**,
   and click **Create App Integration**. Select SAML 2.0, then click **Next**.

-   ![Create APP](../../../../img/sso/okta/okta-saml-1.png)
+   ![Create APP](../../../img/sso/okta/okta-saml-1.png)

 1. On the next screen (**General Settings**), provide a name and optional logo
   for your new app, then click **Next**. This will bring you to the **Configure
@@ -100,7 +100,7 @@ membership and assign matching roles.

 The configuration page should now look like this:

-![Configuring an Okta application](../../../../img/sso/okta/setup-redirection.png)
+![Configuring an Okta application](../../../img/sso/okta/setup-redirection.png)

 Notice that we have set "NameID" to the email format and mapped the groups with
 a wildcard regex in the Group Attribute statements. We have also set the
@@ -121,7 +121,7 @@ From the **Assignments** tab of the new application page, click **Assign**.  Ass
 which can access to the app. Users being members of those groups will have the SSO access to
 Teleport once the Auth Connector is configured.

-![Configure APP](../../../../img/sso/okta/okta-saml-3.1.png)
+![Configure APP](../../../img/sso/okta/okta-saml-3.1.png)

 ## Step 5/5. Provide your Okta app metadata to Teleport

@@ -133,7 +133,7 @@ its SAML messages.
   the metadata URL. Paste this somewhere that you can refer to as you work
   through the guided flow.

-   ![Okta SAML app metadata URL](../../../../img/enterprise/plugins/okta/okta-saml-app-metadata-url.png)
+   ![Okta SAML app metadata URL](../../../img/enterprise/plugins/okta/okta-saml-app-metadata-url.png)

 1. In the Teleport Web UI, make sure you are in the **Step Two** view in the
   Okta SSO connector enrollment flow.
@@ -1,6 +1,7 @@
 ---
 title: Enroll the Teleport Okta Integration
 description: Describes how to set up the Teleport Okta integration in order to grant Teleport users access to resources managed in Okta.
+sidebar_position: 4
 ---

 The Teleport Okta integration can import and grant access to resources from an
@@ -44,7 +45,7 @@ To start the enrolment, visit the Teleport Web UI and click **Access** and then
 **Integrations** on the menu bar at the left of the screen. Then click **Enroll
 New Integration** and select **Okta** tile.

-![Enroll an Access Request plugin](../../../../img/enterprise/plugins/enroll.png)
+![Enroll an Access Request plugin](../../../img/enterprise/plugins/enroll.png)

 This will bring you to the SSO integration configuration screen. Read [Guided
 Okta SSO Integration](./guided-sso.mdx) for supplementary instructions as you
@@ -86,7 +87,7 @@ to manage any component of the integration. To open the integration status page
 in the Teleport Web UI, navigate to **Access** -> **Integrations** and click
 anywhere on the Okta integration row.

-![Okta integration #1](../../../../img/enterprise/plugins/okta/okta-status-page-1.png)
+![Okta integration #1](../../../img/enterprise/plugins/okta/okta-status-page-1.png)

 ## Deleting the Okta integration

@@ -103,7 +104,7 @@ You can delete the Okta integration by taking the following steps:

 1. Click **Delete Integration** .

-   ![Delete Okta integration](../../../../img/enterprise/plugins/okta/okta-delete-integration.png)
+   ![Delete Okta integration](../../../img/enterprise/plugins/okta/okta-delete-integration.png)

 1. Permanently delete the SAML connector created as part of the integration.
   Navigate to the **Auth Connectors** page in the Teleport UI and select the
@@ -72,7 +72,7 @@ in the [integration status page](./okta.mdx#managing-integration-components).
   UI, follow the instructions in **Step 1**. In Okta, you should see that SCIM
   has been enabled for your application:

-   ![Enable SCIM](../../../../img/enterprise/plugins/okta/scim-enable.png)
+   ![Enable SCIM](../../../img/enterprise/plugins/okta/scim-enable.png)

 1. In Okta, viewing the SAML application configuration menu, click **Save**.

@@ -85,7 +85,7 @@ in the [integration status page](./okta.mdx#managing-integration-components).
   Console** view, copy the values provided in **Step 2** to the **SCIM
   Connection** menu in Okta:

-   ![Okta Enrollment: SCIM - configure](../../../../img/enterprise/plugins/okta/scim-configure.png)
+   ![Okta Enrollment: SCIM - configure](../../../img/enterprise/plugins/okta/scim-configure.png)

 1. Navigate to the Teleport Web UI. In the **Configure SCIM in Okta’s Admin
   Console** view, click **Save SCIM Configuration**.
@@ -105,7 +105,7 @@ in the [integration status page](./okta.mdx#managing-integration-components).

   You should see the following settings selected in Okta:

-   ![Configure SCIM Provisioning](../../../../img/enterprise/plugins/okta/scim-provisioning.png)
+   ![Configure SCIM Provisioning](../../../img/enterprise/plugins/okta/scim-provisioning.png)

 1. Return to the Teleport Web UI. You should see the **Configure SCIM in Okta’s
   Admin Console** view. Click **Continue** to finish setting up the SCIM
@@ -117,7 +117,7 @@ If your Okta app has assigned users in Teleport before SCIM provisioning is
 enabled, you will need to trigger their provisioning explicitly. This can be
 done by selecting the **Provision Users** button on the Okta app assignments page.

-![Provision Existing Users](../../../../img/enterprise/plugins/okta/scim-provision-existing-users.png)
+![Provision Existing Users](../../../img/enterprise/plugins/okta/scim-provision-existing-users.png)

 If your Okta instance is missing the **Provision Users** button, you can force
 user provisioning by removing and re-adding users to the app.
@@ -40,7 +40,7 @@ group assignments in Okta and can make changes within Okta based on your
 Teleport RBAC configuration. To limit the scope of the integration, ensure that:

 - In the Teleport roles you have assigned to users, no role contains an
-  [app_labels](../../../enroll-resources/application-access/controls.mdx#configuring-application-labels-in-roles) field
+  [app_labels](../../enroll-resources/application-access/controls.mdx) field
  with a wildcard value. Since Teleport uses this field to govern access to Okta
  applications, wildcard values will grant Teleport users access to all Okta
  applications. 
@@ -65,14 +65,14 @@ resources.
   **Applications** -> **Applications**, and click **Create App Integration**.
   Select API Services, then click **Next**.

-   ![Create Okta API app](../../../../img/enterprise/plugins/okta/okta-api-app-1.png)
+   ![Create Okta API app](../../../img/enterprise/plugins/okta/okta-api-app-1.png)

 1. Create an admin role for the app. Okta API Services apps require assigning
   admin roles to be able to provide access to Okta resources. From the main
   navigation menu, select **Security** -> **Administrators**, then go to the
   **Roles** tab and click **Create new role**:

-   ![Create new Okta admin role](../../../../img/enterprise/plugins/okta/okta-create-new-admin-role.png)
+   ![Create new Okta admin role](../../../img/enterprise/plugins/okta/okta-create-new-admin-role.png)

 1. Type in the role name and optionally the description and select the following permissions for the role:

@@ -106,7 +106,7 @@ section.

 1. Click **+ Add Resource** to add 3 resource types: *Users*, *Groups* and *Applications*.

-   ![Create new Okta resource set](../../../../img/enterprise/plugins/okta/okta-create-new-resource-set.png)
+   ![Create new Okta resource set](../../../img/enterprise/plugins/okta/okta-create-new-resource-set.png)

   You can limit Teleport's access to Okta resources by adjusting the resources
   in the set. Remember to include the Okta SAML 2.0 application that you
@@ -125,7 +125,7 @@ section.
   Then uncheck the "Require Demonstrating Proof of Possession (DPoP) header in
   token requests" checkbox and click **Save**.

-   ![Create Okta API app](../../../../img/enterprise/plugins/okta/okta-disable-dpop.png)
+   ![Create Okta API app](../../../img/enterprise/plugins/okta/okta-disable-dpop.png)

 2. Set up Okta API scopes. In the **Okta API Scopes** tab grant the following
   scopes: 
@@ -137,12 +137,12 @@ section.
   - `okta.users.read`
   - `okta.users.manage`

-   ![Okta API scopes setup](../../../../img/enterprise/plugins/okta/okta-api-app-scopes.png)
+   ![Okta API scopes setup](../../../img/enterprise/plugins/okta/okta-api-app-scopes.png)

 3. Assign an admin role to the app. Navigate to the **Admin roles**, and click
   **Edit assignments**.

-   ![Create Okta API app](../../../../img/enterprise/plugins/okta/okta-api-app-role-assignment.png)
+   ![Create Okta API app](../../../img/enterprise/plugins/okta/okta-api-app-role-assignment.png)

 4. Select the custom admin role and the resource set created earlier and click
   **Save changes**.
@@ -172,7 +172,7 @@ accessible over the public internet:.
   **Save**.

   ![Okta API app public key for public
-   cluster](../../../../img/enterprise/plugins/okta/okta-api-app-public-cluster-pub-key.png)
+   cluster](../../../img/enterprise/plugins/okta/okta-api-app-public-cluster-pub-key.png)

 </TabItem>
 <TabItem label="Private Teleport cluster">
@@ -196,7 +196,7 @@ accessible over the public internet:.
   message in the *Created* column. This value will become a valid date once you
   click **Save**.

-   ![Okta API app - private cluster pub key #3](../../../../img/enterprise/plugins/okta/okta-api-app-private-cluster-pub-key-3.png)
+   ![Okta API app - private cluster pub key #3](../../../img/enterprise/plugins/okta/okta-api-app-private-cluster-pub-key-3.png)

 </TabItem>
 </Tabs>
@@ -207,12 +207,12 @@ accessible over the public internet:.
   API services app. In the app settings in the **General** tab you will find
   the client ID.

-   ![Okta API app - client ID](../../../../img/enterprise/plugins/okta/okta-api-app-client-id.png)
+   ![Okta API app - client ID](../../../img/enterprise/plugins/okta/okta-api-app-client-id.png)

 1. Paste the client ID to the **App Sync** enrollment screen and click **Update**.

   ![Okta Enrollment: User sync - Step 3 client
-   ID](../../../../img/enterprise/plugins/okta/user-sync-configure-s3-client-id.png)
+   ID](../../../img/enterprise/plugins/okta/user-sync-configure-s3-client-id.png)

 1. Click **Update** to finish configuring user sync.

@@ -5,9 +5,9 @@
 - [Multi-Factor: WebAuthn](../admin-guides/access-controls/guides/webauthn.mdx): Add multi-factor authentication through WebAuthn.
 - [Per-Session MFA](../admin-guides/access-controls/guides/per-session-mfa.mdx): Per-session multi-mactor authentication.
 - [MFA for Administrative Actions](../admin-guides/access-controls/guides/mfa-for-admin-actions.mdx): Multi-mactor authentication for admin actions.
- [Locking](../admin-guides/access-controls/guides/locking.mdx): Lock access to active user sessions or hosts.
+- [Locking](../identity-governance/locking.mdx): Lock access to active user sessions or hosts.
 - [Joining Sessions](../admin-guides/access-controls/guides/joining-sessions.mdx): Configure access to existing sessions.
 - [Hardware Key Support](../admin-guides/access-controls/guides/hardware-key-support.mdx): Enforce the use of hardware-based private keys.
- [Device Trust](../admin-guides/access-controls/device-trust/guide.mdx): Register and enforce trusted devices.
+- [Device Trust](../identity-governance/device-trust/guide.mdx): Register and enforce trusted devices.
 - [Headless WebAuthn](../admin-guides/access-controls/guides/headless.mdx): Login with Webauthn from a remote device.
 - [IP Pinning](../admin-guides/access-controls/guides/ip-pinning.mdx): Pin a user's certificates to a login IP address.
@@ -1,12 +1,12 @@
 | Integration | Type | Setup Instructions |
 | - | - | - |
-| Slack | Messaging | [Set up Slack](../admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx) |
-| Mattermost | Messaging | [Set up Mattermost](../admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx) |
-| Microsoft Teams | Messaging | [Set up Microsoft Teams](../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) |
-| Jira | Project Board | [Set up Jira](../admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx) |
-| PagerDuty | Schedule | [Set up PagerDuty](../admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx) |
-| Email | Messaging | [Set up email](../admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx) |
-| Discord | Messaging | [Set up Discord](../admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx) |
-| OpsGenie | Incident Management | [Set up OpsGenie](../admin-guides/access-controls/access-request-plugins/opsgenie.mdx) |
-| ServiceNow | Workflow | [Set up ServiceNow](../admin-guides/access-controls/access-request-plugins/servicenow.mdx) |
-| Datadog | Incident Management | [Set up Datadog](../admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx) |
+| Slack | Messaging | [Set up Slack](../identity-governance/access-request-plugins/ssh-approval-slack.mdx) |
+| Mattermost | Messaging | [Set up Mattermost](../identity-governance/access-request-plugins/ssh-approval-mattermost.mdx) |
+| Microsoft Teams | Messaging | [Set up Microsoft Teams](../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) |
+| Jira | Project Board | [Set up Jira](../identity-governance/access-request-plugins/ssh-approval-jira.mdx) |
+| PagerDuty | Schedule | [Set up PagerDuty](../identity-governance/access-request-plugins/ssh-approval-pagerduty.mdx) |
+| Email | Messaging | [Set up email](../identity-governance/access-request-plugins/ssh-approval-email.mdx) |
+| Discord | Messaging | [Set up Discord](../identity-governance/access-request-plugins/ssh-approval-discord.mdx) |
+| OpsGenie | Incident Management | [Set up OpsGenie](../identity-governance/access-request-plugins/opsgenie.mdx) |
+| ServiceNow | Workflow | [Set up ServiceNow](../identity-governance/access-request-plugins/servicenow.mdx) |
+| Datadog | Incident Management | [Set up Datadog](../identity-governance/access-request-plugins/datadog-hosted.mdx) |
@@ -7,8 +7,8 @@ the problem.
 ### "unauthorized device" errors using a trusted device

 A trusted device needs to be registered and enrolled before it is recognized by
-Teleport as such. Follow the [registration](../../admin-guides/access-controls/device-trust/device-management.mdx) and
-[enrollment](../../admin-guides/access-controls/device-trust/device-management.mdx) steps
+Teleport as such. Follow the [registration](../../identity-governance/device-trust/device-management.mdx#register-a-trusted-device) and
+[enrollment](../../identity-governance/device-trust/device-management.mdx#enroll-a-trusted-device) steps
 and make sure to `tsh logout` and `tsh login` after enrollment is done.

 ### "Failed to open the TPM device" on Linux
@@ -49,7 +49,7 @@ Follow the instructions in the [Web UI troubleshooting section](
 #web-ui-fails-to-authenticate-trusted-device) below (Teleport v16 or later).

 Alternatively, you may use one of the tsh commands described by
-[App Access support](../../admin-guides/access-controls/device-trust/enforcing-device-trust.mdx).
+[App Access support](../../identity-governance/device-trust/enforcing-device-trust.mdx).
 For example, for an app called `myapp`, run `tsh proxy app myapp -p 8888`, then
 open http://localhost:8888 in your browser.

@@ -69,8 +69,7 @@ The Web UI attempts to authenticate your device using Teleport Connect during
 login. If you are not asked to authenticate your device immediately after login,
 follow the steps below:

-1. Make sure your device is [registered and enrolled](
-   ../../admin-guides/access-controls/device-trust/device-management.mdx#register-a-trusted-device)
+1. Make sure your device is [registered and enrolled](../../identity-governance/device-trust/device-management.mdx#register-a-trusted-device)
 2. Install [Teleport Connect](
   ../../connect-your-client/teleport-connect.mdx#installation--upgrade).
   Use the DEB or RPM packages on Linux (the tarball doesn't register the custom
@@ -46,7 +46,7 @@ data:
 ```

 Check out the [Access Requests with
-Datadog Incident Management](../../admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx) guide
+Datadog Incident Management](../../identity-governance/access-request-plugins/datadog-hosted.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -43,7 +43,7 @@ data:
 ```

 Check out the [Access Requests with
-Discord](../../admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx) guide
+Discord](../../identity-governance/access-request-plugins/ssh-approval-discord.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -43,7 +43,7 @@ data:
 ```

 Check out the [Access Requests with
-Email](../../admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx) guide
+Email](../../identity-governance/access-request-plugins/ssh-approval-email.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -43,7 +43,7 @@ data:
 ```

 Check out the [Access Requests with
-Jira](../../admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx) guide
+Jira](../../identity-governance/access-request-plugins/ssh-approval-jira.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -43,7 +43,7 @@ data:
 ```

 Check out the [Access Requests with
-Mattermost](../../admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx) guide
+Mattermost](../../identity-governance/access-request-plugins/ssh-approval-mattermost.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -43,7 +43,7 @@ data:
 ```

 Check out the [Access Requests with
-Microsoft Teams](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) guide
+Microsoft Teams](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -72,7 +72,7 @@ You can pass the MsTeams appSecret:
 | `string` | `""` |

 `msTeams.appID` is the Azure app ID used by the plugin.
-See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+See [the MsTeams guide](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.

 This value is mandatory.

@@ -83,7 +83,7 @@ This value is mandatory.
 | `string` | `""` |

 `msTeams.tenantID` is the Azure tenant ID used by the plugin and Microsoft Teams.
-See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+See [the MsTeams guide](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.

 This value is mandatory.

@@ -94,7 +94,7 @@ This value is mandatory.
 | `string` | `""` |

 `msTeams.teamsAppID` is the MsTeams app ID used by the plugin.
-See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+See [the MsTeams guide](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.

 This value is mandatory.

@@ -43,7 +43,7 @@ data:
 ```

 Check out the [Access Requests with
-PagerDuty](../../admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx) guide
+PagerDuty](../../identity-governance/access-request-plugins/ssh-approval-pagerduty.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -46,7 +46,7 @@ data:
 ```

 Check out the [Access Requests with
-Slack](../../admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx) guide
+Slack](../../identity-governance/access-request-plugins/ssh-approval-slack.mdx) guide
 for more information about how to acquire these credentials.

 ### `teleport.identitySecretPath`
@@ -57,18 +57,18 @@ to human factor or identity attacks.

 Get started with Teleport Identity Governance:

- [Access Requests](admin-guides/access-controls/access-requests/access-requests.mdx): Temporarily
+- [Access Requests](identity-governance/access-requests/access-requests.mdx): Temporarily
  provision minimal privileges to complete a task.
- [Access Lists](admin-guides/access-controls/access-lists/access-lists.mdx): Regularly audit and
+- [Access Lists](identity-governance/access-lists/access-lists.mdx): Regularly audit and
  control membership to specific roles and traits, which then tie easily back
  into Teleport's existing RBAC system.
- [Device Trust](admin-guides/access-controls/device-trust/device-trust.mdx): Require an up-to-date,
+- [Device Trust](identity-governance/device-trust/device-trust.mdx): Require an up-to-date,
  registered device for each authentication by giving every device a
  cryptographic identity. 
- [Session & Identity Locks](admin-guides/access-controls/guides/locking.mdx): Lock
+- [Session & Identity Locks](identity-governance/locking.mdx): Lock
  suspicious or compromised identities and stop all their activity across all
  protocols and services.
- [Access Monitoring](admin-guides/access-controls/access-monitoring.mdx): Detect overly
+- [Access Monitoring](identity-governance/access-monitoring.mdx): Detect overly
  broad privileges and inspect sessions that are not using strong protection,
  such as multi-factor authentication and Device Trust.

@@ -89,7 +89,7 @@ slack-default RUNNING

 If no integrations are listed, enroll a plugin first.
 For a step by step guide on how to enroll a plugin see
-[Access Request Plugins](../../admin-guides/access-controls/access-request-plugins/access-request-plugins.mdx).
+[Access Request Plugins](../../identity-governance/access-request-plugins/access-request-plugins.mdx).

 ### Recipients

@@ -431,7 +431,7 @@ spec:
 The following role fields configure Access Requests. For a full description of
 Access Request configuration fields and their relationship to one another, see
 the [Access Request configuration
-guide](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx).
+guide](../../identity-governance/access-requests/access-request-configuration.mdx).

 ### Creating Access Requests

@@ -440,14 +440,14 @@ Requests. The `request` field can fall under both `spec.allow` and `spec.deny`:

 |Role Field|Description|Further Information|
 |---|---|---|
-| `request.roles` |Teleport roles that a user can or cannot request|[Restrict role requests](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#restrict-role-requests)|
-| `request.claims_to_roles`|Teleport roles that a user can or cannot access based on their traits.|[Restrict role requests](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#restrict-role-requests)|
-| `request.search_as_roles`|Teleport roles that a user can or cannot assume while searching for resources to request access to.|[Restrict resource requests](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#restrict-resource-requests)|
-| `request.max_duration`|The maximum duration of elevated privileges if an Access Request were granted. | [How long access lasts](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#how-long-access-lasts) |
-| `request.reason`|Configures the behavior of Access Request reasons. | [Requiring request reasons](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#requiring-request-reasons) |
-| `request.thresholds`|Configures the criteria that an Access Request must meet.| [Review thresholds](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#review-thresholds) |
-| `request.suggested_reviewers`|Reviewers to add to an Access Request by default.| [Suggested reviewers](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#suggested-reviewers)|
-| `request.annotations`|Arbitrary data to write (or prevent writing) to an Access Request|[Request annotations](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#request-annotations)|
+| `request.roles` |Teleport roles that a user can or cannot request|[Restrict role requests](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.claims_to_roles`|Teleport roles that a user can or cannot access based on their traits.|[Restrict role requests](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.search_as_roles`|Teleport roles that a user can or cannot assume while searching for resources to request access to.|[Restrict resource requests](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.max_duration`|The maximum duration of elevated privileges if an Access Request were granted. | [How long access lasts](../../identity-governance/access-requests/access-request-configuration.mdx) |
+| `request.reason`|Configures the behavior of Access Request reasons. | [Requiring request reasons](../../identity-governance/access-requests/access-request-configuration.mdx) |
+| `request.thresholds`|Configures the criteria that an Access Request must meet.| [Review thresholds](../../identity-governance/access-requests/access-request-configuration.mdx) |
+| `request.suggested_reviewers`|Reviewers to add to an Access Request by default.| [Suggested reviewers](../../identity-governance/access-requests/access-request-configuration.mdx)|
+| `request.annotations`|Arbitrary data to write (or prevent writing) to an Access Request|[Request annotations](../../identity-governance/access-requests/access-request-configuration.mdx)|

 ### Reviewing Access Requests

@@ -456,10 +456,10 @@ Requests, and like `request`, can fall under `allow` or `deny`:

 |Role Field|Description|Further Information|
 |---|---|---|
-|`review_requests.roles`|Allows or denies the ability to review requests for particular roles.|[Reviews for specific roles](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#allowing-and-denying-reviews-for-specific-roles)|
-|`review_requests.where`|Configures conditions in which a user with the role may review an Access Request|[`where` expressions](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#where-expressions)|
-|`review_requests.preview_as_roles`|Allows or denies the ability to list resources that a user with the requested role can access|[Inspecting requested resources](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#inspecting-requested-resources)|
-|`review_requests.claims_to_roles`|Teleport roles that a user can or cannot review requests for based on their traits.|[Reviews for specific roles](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#allowing-and-denying-reviews-for-specific-roles)|
+|`review_requests.roles`|Allows or denies the ability to review requests for particular roles.|[Reviews for specific roles](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`review_requests.where`|Configures conditions in which a user with the role may review an Access Request|[`where` expressions](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`review_requests.preview_as_roles`|Allows or denies the ability to list resources that a user with the requested role can access|[Inspecting requested resources](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`review_requests.claims_to_roles`|Teleport roles that a user can or cannot review requests for based on their traits.|[Reviews for specific roles](../../identity-governance/access-requests/access-request-configuration.mdx)|

 ### Client options

@@ -467,8 +467,8 @@ The `options` field, a property of `spec`, applies additional settings:

 |Role Field|Description|Further Information|
 |---|---|---|
-|`options.request_access`|Configures Teleport client behavior for creating Access Requests|[How clients request access](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#how-clients-request-access)|
-|`options.request_prompt`|Configures the prompt that Teleport clients display when a user requests access|[How clients request access](../../admin-guides/access-controls/access-requests/access-request-configuration.mdx#how-clients-request-access)|
+|`options.request_access`|Configures Teleport client behavior for creating Access Requests|[How clients request access](../../identity-governance/access-requests/access-request-configuration.mdx)|
+|`options.request_prompt`|Configures the prompt that Teleport clients display when a user requests access|[How clients request access](../../identity-governance/access-requests/access-request-configuration.mdx)|

 ## Role templates

@@ -85,7 +85,7 @@ Instead of distributing revocation lists, Teleport relies on time to do the job
 <Admonition type="tip">
 In some cases, certificate expiration is not fast enough, and all sessions have to be terminated immediately,
 for example during active security incident.
-For those cases, Teleport Proxy can terminate live connections using [session and identity locking](../../admin-guides/access-controls/guides/locking.mdx).
+For those cases, Teleport Proxy can terminate live connections using [session and identity locking](../../identity-governance/locking.mdx).
 </Admonition>

 ### Short-lived Certs For Users
@@ -123,7 +123,7 @@ learn how to do certificate rotation in practice.
 To quickly lock out a potentially compromised Auth Service instance, Proxy
 Service instance, or Teleport Agent without rotating the entire cluster
 certificates, use [session and identity
-locking](../../admin-guides/access-controls/guides/locking.mdx).
+locking](../../identity-governance/locking.mdx).
 </Admonition>

 ## More concepts
@@ -386,7 +386,7 @@ spec:

 - [Access Control Reference](../access-controls/roles.mdx).
 - [Teleport Predicate Language](../predicate-language.mdx).
- [Access Requests Guides](../../admin-guides/access-controls/access-requests/access-requests.mdx)
+- [Access Requests Guides](../../identity-governance/access-requests/access-requests.mdx)
 - [Architecture Overview](../../core-concepts.mdx)
 - [Teleport Auth](authentication.mdx)
 - [Teleport Agents](agents.mdx)
@@ -47,8 +47,8 @@ web][blog-post] blog post describes the implementation challenges in detail.

 For practical use see the [Device Trust section][section].

-[auto-enrollment]: ../../admin-guides/access-controls/device-trust/device-management.mdx#auto-enrollment
-[device enrollment tokens]: ../../admin-guides/access-controls/device-trust/device-management.mdx#create-a-device-enrollment-token
-[device enforcement]: ../../admin-guides/access-controls/device-trust/enforcing-device-trust.mdx
+[auto-enrollment]: ../../identity-governance/device-trust/device-management.mdx#auto-enrollment
+[device enrollment tokens]: ../../identity-governance/device-trust/device-management.mdx#create-a-device-enrollment-token
+[device enforcement]: ../../identity-governance/device-trust/enforcing-device-trust.mdx
 [blog-post]: https://goteleport.com/blog/device-trust-for-web-challenges-and-solutions/
-[section]: ../../admin-guides/access-controls/device-trust/device-trust.mdx
+[section]: ../../identity-governance/device-trust/device-trust.mdx
@@ -54,7 +54,7 @@ See the [Public IP Address Allowlist](../ips.mdx) for the list of IP addresses u

 We do not have plans to offer support for inbound connection IP allowlists.

-We believe mTLS with strong user and [device identity](../admin-guides/access-controls/device-trust/guide.mdx) provides the best available
+We believe mTLS with strong user and [device identity](../identity-governance/device-trust/guide.mdx) provides the best available
 security for client authentication.

 For customers that require IP-based control for compliance purposes, we do
@@ -144,9 +144,9 @@ Further reading:
  `headless` authentication option.
 - [Single Sign-On](../admin-guides/access-controls/sso/sso.mdx): Configuring SSO
  so you can configure Teleport to use a specific SSO authentication connector.
- [Locking](../admin-guides/access-controls/guides/locking.mdx): Configuring the
+- [Locking](../identity-governance/locking.mdx): Configuring the
  `locking_mode` option.
- [Device Trust](../admin-guides/access-controls/device-trust/device-trust.mdx): Configuring
+- [Device Trust](../identity-governance/device-trust/device-trust.mdx): Configuring
  the `device_trust` section.
 - [Recording Proxy Mode](architecture/session-recording.mdx): If you configure
  Recording Proxy Mode, consider enabling `proxy_checks_host_keys`.
@@ -286,7 +286,7 @@ When disabled, users can only log in through authentication connectors like `sam
 | `string` | `""`          | No        | `auth_service.authentication.locking_mode` |

 `authentication.lockingMode` controls the locking mode cluster-wide. Possible values are `best_effort` and `strict`.
-See [the locking modes documentation](../../admin-guides/access-controls/guides/locking.mdx) for more
+See [the locking modes documentation](../../identity-governance/locking.mdx) for more
 details.

 Defaults to Teleport's binary default when empty: `best_effort`.
@@ -1221,11 +1221,11 @@ Whether Teleport should configure DynamoDB's autoscaling. Defaults to `false`.

 ### `aws.accessMonitoring`

-`aws.accessMonitoring` configures the [Access Monitoring](../../admin-guides/access-controls/access-monitoring.mdx)
+`aws.accessMonitoring` configures the [Access Monitoring](../../identity-governance/access-monitoring.mdx)
 feature of the Auth Service.

 Using this features requires setting up specific AWS infrastructure as described
-in [the AccessMonitoring configuration section](../../admin-guides/access-controls/access-monitoring.mdx).
+in [the AccessMonitoring configuration section](../../identity-governance/access-monitoring.mdx).
 The [Terraform example](https://github.com/gravitational/teleport/tree/v(=teleport.version=)/examples/athena)
 code will output the chart values for this section.

@@ -27,7 +27,7 @@ The `teleport-kube-agent` chart can run any or all of three Teleport services:
 | [`application_service`](../../enroll-resources/application-access/guides/guides.mdx)              | `app`                                  | Uses Teleport to handle authentication<br/> with and proxy access to web-based applications  |
 | [`database_service`](../../enroll-resources/database-access/guides/guides.mdx)                    | `db`                                   | Uses Teleport to handle authentication<br/> with and proxy access to databases               |
 | [`discovery_service`](../../enroll-resources/auto-discovery/auto-discovery.mdx)              | `discovery`                            | Uses Teleport to discover new resources<br/> and dynamically add them to the cluster         |
-| [`jamf_service`](../../admin-guides/access-controls/device-trust/jamf-integration.mdx) | `jamf`                                 | Uses Teleport to integrate with Jamf Pro<br/> and sync devices with Device Trust inventory   |
+| [`jamf_service`](../../identity-governance/device-trust/jamf-integration.mdx) | `jamf`                                 | Uses Teleport to integrate with Jamf Pro<br/> and sync devices with Device Trust inventory   |

 ### Legacy releases

@@ -56,7 +56,7 @@ Here's the list of resources currently exposed via [`tctl`](./cli/tctl.mdx):
 | windows_desktop | A registered Windows desktop. |
 | cluster | A trusted cluster. See [here](../admin-guides/management/admin/trustedclusters.mdx) for more details on connecting clusters together. |
 | [login_rule](#login-rules) | A Login Rule, see the [Login Rules guide](../admin-guides/access-controls/login-rules/login-rules.mdx) for more info. |
-| [device](#device) | A Teleport Trusted Device, see the [Device Trust guide](../admin-guides/access-controls/device-trust/guide.mdx) for more info. |
+| [device](#device) | A Teleport Trusted Device, see the [Device Trust guide](../identity-governance/device-trust/guide.mdx) for more info. |
 | [ui_config](#ui-config) | Configuration for the Web UI served by the Proxy Service. |
 | [vnet_config](#vnet-config) | Configuration for the cluster's VNet options. |
 | [cluster_auth_preference](#cluster-auth-preferences) | Configuration for the cluster's auth preferences. |
@@ -164,6 +164,20 @@
        }
      ]
    },
+    {
+      "type": "category",
+      "label": "Identity Governance",
+      "link": {
+        "type": "doc",
+        "id": "identity-governance/identity-governance"
+      },
+      "items": [
+        {
+          "type": "autogenerated",
+          "dirName": "identity-governance"
+        }
+      ]
+    },
    {
      "type": "category",
      "label": "Enroll Resources",
@@ -33,7 +33,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # Datadog Incident Management](../../admin-guides/access-controls/access-request-plugins/datadog-hosted.mdx) guide
+  # Datadog Incident Management](../../identity-governance/access-request-plugins/datadog-hosted.mdx) guide
  # for more information about how to acquire these credentials.
  identitySecretName: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -30,7 +30,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # Discord](../../admin-guides/access-controls/access-request-plugins/ssh-approval-discord.mdx) guide
+  # Discord](../../identity-governance/access-request-plugins/ssh-approval-discord.mdx) guide
  # for more information about how to acquire these credentials.
  identitySecretName: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -30,7 +30,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # Email](../../admin-guides/access-controls/access-request-plugins/ssh-approval-email.mdx) guide
+  # Email](../../identity-governance/access-request-plugins/ssh-approval-email.mdx) guide
  # for more information about how to acquire these credentials.
  identitySecretName: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -30,7 +30,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # Jira](../../admin-guides/access-controls/access-request-plugins/ssh-approval-jira.mdx) guide
+  # Jira](../../identity-governance/access-request-plugins/ssh-approval-jira.mdx) guide
  # for more information about how to acquire these credentials.
  identityFromSecret: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -30,7 +30,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # Mattermost](../../admin-guides/access-controls/access-request-plugins/ssh-approval-mattermost.mdx) guide
+  # Mattermost](../../identity-governance/access-request-plugins/ssh-approval-mattermost.mdx) guide
  # for more information about how to acquire these credentials.
  identitySecretName: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -30,7 +30,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # Microsoft Teams](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) guide
+  # Microsoft Teams](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) guide
  # for more information about how to acquire these credentials.
  identitySecretName: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -46,17 +46,17 @@ teleport:
 # - via an existing Kubernetes Secret by setting `msTeams.appSecretFromSecret`
 msTeams:
  # msTeams.appID(string) -- is the Azure app ID used by the plugin.
-  # See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+  # See [the MsTeams guide](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
  #
  # This value is mandatory.
  appID: ""
  # msTeams.tenantID(string) -- is the Azure tenant ID used by the plugin and Microsoft Teams.
-  # See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+  # See [the MsTeams guide](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
  #
  # This value is mandatory.
  tenantID: ""
  # msTeams.teamsAppID(string) -- is the MsTeams app ID used by the plugin.
-  # See [the MsTeams guide](../../admin-guides/access-controls/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
+  # See [the MsTeams guide](../../identity-governance/access-request-plugins/ssh-approval-msteams.mdx) to know how to get this value.
  #
  # This value is mandatory.
  teamsAppID: ""
@@ -30,7 +30,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # PagerDuty](../../admin-guides/access-controls/access-request-plugins/ssh-approval-pagerduty.mdx) guide
+  # PagerDuty](../../identity-governance/access-request-plugins/ssh-approval-pagerduty.mdx) guide
  # for more information about how to acquire these credentials.
  identitySecretName: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret
@@ -33,7 +33,7 @@ teleport:
  # ```
  #
  # Check out the [Access Requests with
-  # Slack](../../admin-guides/access-controls/access-request-plugins/ssh-approval-slack.mdx) guide
+  # Slack](../../identity-governance/access-request-plugins/ssh-approval-slack.mdx) guide
  # for more information about how to acquire these credentials.
  identitySecretName: ""
  # teleport.identitySecretPath(string) -- is the key in the Kubernetes secret