---
title: Configuration
description: Settings the scanner reads at start, and where to put them on each platform.
---

Settings are read once when the service starts. After changing one, restart the service.

| Setting | Default | What it does |
| --- | --- | --- |
| `SURFACE_SCAN_INTERVAL` | `15m` | Time between scans |
| `SURFACE_FULL_PUSH_INTERVAL` | `24h` | How often a full report is sent. In between, only changes are sent. `0` turns full reports off |
| `SURFACE_LOG_LEVEL` | `info` | `debug`, `info`, `warn`, or `error` |
| `SURFACE_UPDATE_DISABLED` | `false` | Turn off self-update, for air-gapped laptops |
| `SURFACE_DRY_RUN` | `false` | Log what Block would do without doing it |
| `SURFACE_GATEWAY_URL` | SuperAlign gateway | The live channel for decisions. Set to `off` to disable. Decisions then arrive at the next scan |
| `SURFACE_MCP_PROBE` | `on` | Check remote connectors over the network. Connectors that run as local programs are never started |
| `SURFACE_PKG_SCAN` | `on` | Read the code of installed AI packages, without running it |
| `SURFACE_ENROLLMENT_TOKEN` | unset | The enrollment token, when delivered as an environment variable |
| `SURFACE_USER_EMAIL`, `SURFACE_USER_FULL_NAME` | unset | The person shown next to the hostname in the console |

## Where to set them

**macOS**

The `EnvironmentVariables` block in `/Library/LaunchDaemons/com.superalign.surface.plist`, then:
```bash
sudo launchctl bootout system/com.superalign.surface
sudo launchctl bootstrap system /Library/LaunchDaemons/com.superalign.surface.plist
```

**Linux**

An `Environment=` line in `/lib/systemd/system/surface.service`, or the managed file `/etc/surface/managed.conf`, then:
```bash
sudo systemctl daemon-reload && sudo systemctl restart surface.service
```

**Windows**

Machine-level environment variables, then restart the **SurfaceScanner** service.

## Managed configuration

The enrollment token and user attribution can also come from your MDM. Environment variables win over the MDM setting. See [MDM deployment](/surface/deploy/mdm/overview) for the keys on each platform.