---
title: Administration domain configuration
related:
  - https://docs.kentico.com/documentation/developers-and-admins/deployment/deploy-to-private-cloud.md
  - https://docs.kentico.com/documentation/developers-and-admins/deployment/deploy-to-private-cloud/deploy-without-the-administration.md
  - https://docs.kentico.com/documentation/developers-and-admins/configuration/website-channel-management/manage-multiple-websites.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

The Xperience by Kentico [administration interface](https://docs.kentico.com/documentation/administration-interface-basics.md) is a web application that can be accessed in a browser by adding the **/admin** path after the domain where the application is deployed. When you add one or more [website channels](https://docs.kentico.com/documentation/developers-and-admins/configuration/website-channel-management.md), the administration is also available on all of the configured website channel domains.

However, even though delivering content through websites is one of the main purposes of Xperience by Kentico, it is not a website-centered product and does not require website channels to function. All channel types are optional. Xperience by Kentico can run as a content management and digital marketing platform even before you configure any channels, and it is possible to serve content through [email](https://docs.kentico.com/documentation/developers-and-admins/digital-marketing-setup/email-channel-management.md) or [headless channels](https://docs.kentico.com/documentation/developers-and-admins/configuration/headless-channel-management.md) without a website.

We recommend separating the administration from your website channels by using a **dedicated domain to access the administration**. For example, you can have website channels running on the _domain1.com_ and _domain2.com_ domains, and use a shared **admin.domain.com** domain to manage both websites, as well as features that are not website-related. This setup is intended as a domain level separation within the **same running Xperience application instance** (for example, one IIS website with multiple host bindings).

[Set up a domain redirect](#set-up-an-administration-domain-redirect) to ensure that all users consistently access the administration on the dedicated domain.

If you need true runtime separation between the administration and live sites (for example, for security hardening), deploy one Xperience instance for the administration and another separate instance [without the administration](https://docs.kentico.com/documentation/developers-and-admins/deployment/deploy-to-private-cloud/deploy-without-the-administration.md) to serve your live websites to visitors.

> **Note:** **Administration domains for SaaS deployments**
>
> When using [Xperience by Kentico SaaS](https://docs.kentico.com/documentation/developers-and-admins/saas/saas-overview.md), the administration domain consists of the environment's **system domain** and an appended _/admin_ slug at end. For example, a [deployment environment](https://docs.kentico.com/documentation/developers-and-admins/deployment/deploy-to-the-saas-environment.md#deploy-the-package-to-another-deployment-environment) has a default administration domain in format _-.xperience-sites.com/admin_. Currently, you cannot set a custom administration domain for projects deployed to Kentico SaaS.
>
> However, for the _PROD_ environment, you can set a custom [system email domain](https://docs.kentico.com/documentation/developers-and-admins/configuration/email-configuration.md#custom-system-email-domains-in-the-saas-environment) in Xperience Portal under **Channels and Domains → System domains**. This domain is used for links in [workflow notification emails](https://docs.kentico.com/documentation/developers-and-admins/configuration/notifications.md) and other administration-generated emails that direct users to the administration UI.

> **Tip:** **Administration domains in local environments**
>
> When setting up [local hosting](https://docs.kentico.com/documentation/developers-and-admins/development/website-development-basics/set-up-local-hosting.md), you can use _localhost_ with different port numbers to set up multiple domains for your website channels and administration (for example using the [launchSettings.json file](https://learn.microsoft.com/aspnet/core/fundamentals/environments#development-and-launchsettingsjson) for the [Kestrel](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel) web server).

## Benefits of a dedicated administration domain

Using a dedicated administration domain provides the following advantages:

- The administration is always consistently accessed through a single domain. This reduces confusion, and prevents administrators, content editors and marketers from assuming that the administration only affects their "current" website.
- Easier setup of single sign-on (SSO) for the administration when using [external authentication](https://docs.kentico.com/documentation/developers-and-admins/configuration/users/administration-registration-and-authentication/administration-external-authentication.md) options.
- Simpler configuration of [Cross-origin resource sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) for [headless channel](https://docs.kentico.com/documentation/developers-and-admins/configuration/headless-channel-management.md) features or for integrations with third-party applications or services.
- Readiness for future expansion of your project. Any configuration or integrations that rely on the domain of the administration do not need to be adjusted to support newly added channels with other domains.
- You have a clearly defined domain that is suitable for all administration-related purposes, such as the [service domain](https://docs.kentico.com/documentation/developers-and-admins/configuration/notifications.md#configure-domains-for-notifications) used for notifications.

## Set up an administration domain redirect

> **Note:** The redirect described in this section is intended for scenarios where all involved domains resolve to the same running application instance.
>
> For example, do not create separate IIS websites that point to the same Xperience project to split administration and live site traffic. This forms a web garden topology, which is not supported.
>
> If you need true runtime separation, follow the guidance for [deployment without the administration](https://docs.kentico.com/documentation/developers-and-admins/deployment/deploy-to-private-cloud/deploy-without-the-administration.md).

1. Open your Xperience solution in Visual Studio.

2. Choose a way to configure the dedicated administration domain for the application, for example, using [ASP.NET Core configuration providers](https://learn.microsoft.com/aspnet/core/fundamentals/configuration/). The following code snippets show how to set up the configuration via the _appsettings.json_ file, together with a matching options class.

   ```json title="appsettings.json"
   {
       ...

       "AdminRedirectOptions": {
           "RedirectDomain": "admin.domain.com"
       },

       ...
   }
   ```

   ```csharp title="Options class"
   public class AdminRedirectOptions
   {
       public string RedirectDomain { get; set; }
   }
   ```

3. Perform a redirect to the configured administration domain for all requests with the **/admin** URL path. For example, use the [ASP.NET URL rewriting Middleware](https://learn.microsoft.com/aspnet/core/fundamentals/url-rewriting).

   ```csharp title="Program.cs"
   var builder = WebApplication.CreateBuilder(args);

   // ...

   // Loads the administration redirect domain (AdminRedirectOptions) from a configuration file section
   builder.Services.Configure<AdminRedirectOptions>(builder.Configuration.GetSection("AdminRedirectOptions"));

   // ...

   var app = builder.Build();

   app.InitKentico();

   app.UseStaticFiles();
   app.UseCookiePolicy();
   app.UseAuthentication();

   // Configures the URL rewriting options
   var rewriteOptions = new RewriteOptions()
       .Add(context =>
       {
           var httpContext = context.HttpContext;
           var request = httpContext.Request;

           // Checks if the URL path starts with '/admin'
           if (request.Path.StartsWithSegments("/admin", StringComparison.OrdinalIgnoreCase))
           {
               // Gets the redirect domain for the administration
               string adminDomain = httpContext.RequestServices
                   .GetRequiredService<IOptions<AdminRedirectOptions>>().Value.RedirectDomain;

               // Checks if the current host is not already the administration domain
               if (!adminDomain.Equals(request.Host.ToString(), StringComparison.OrdinalIgnoreCase))
               {
                   // Redirects the request to the new domain
                   httpContext.Response.Redirect($"//{adminDomain}{request.Path}{request.QueryString}", permanent: false);
                   context.Result = RuleResult.EndResponse;
               }
           }
       });

   // Adds the URL rewriting middleware to the request pipeline using the configured RewriteOptions
   app.UseRewriter(rewriteOptions);

   app.UseKentico();

   // ...
   ```

4. Save the changes and rebuild your solution.

When a user now accesses the application on any domain with a URL path starting with **/admin**, the system automatically redirects them to the correct administration domain.