> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CoPilot Settings You Can Enable in Controller

> By default, CoPilot is already associated with your Controller after CoPilot deployment. If you want to reset this association, such as to point Controller to a different CoPilot instance or to recover from a lost association, use the following steps.

<a id="associate-controller-copilot" />

## Associating Controller with CoPilot

By default, CoPilot is already associated with your Controller after CoPilot
deployment. If you want to reset this association, such as to point Controller
to a different CoPilot instance or to recover from a lost association, use the
following steps.

1. In Aviatrix Controller, go to the **Environment** tab. This is the default
   landing page after you log in.

2. If a CoPilot instance is already associated, click **Reset Association** to
   clear the existing association before associating a different instance.

3. Click **Deploy CoPilot**, then select **Associate CoPilot** from the
   dropdown.

4. Enter the **Public IP/FQDN** and **IP Address** of your running CoPilot
   instance, then click **Save**.

<Note>
  The **Environment** tab does not support entering a separate CoPilot FQDN for
  browser-based redirects (such as the redirect Controller performs after a SAML
  login) apart from the address used for gateway log delivery. To configure that
  field, use Legacy Controller UI, as described in the next section.
</Note>

<a id="copilot-fqdn" />

## Setting a Separate CoPilot FQDN for Browser Redirects

<Note>
  This field is only available from Legacy Controller UI. Click **Legacy
  Controller UI** in the Controller header to access it.
</Note>

1. From Legacy Controller UI, go to **Settings > CoPilot > CoPilot Association**
   and check whether your Controller is associated with CoPilot.

2. For **CoPilot FQDN (Optional)**, enter a hostname if your browser needs to
   reach CoPilot at a different address than the one gateways use to send logs.

   Use this field when "Public IP" points to an endpoint that is not suitable
   for browser access, such as a load balancer configured for the mTLS
   connection that gateways use to deliver logs. When "CoPilot FQDN" is set,
   Controller and CoPilot use it for browser-based redirects, including the
   redirect Controller performs after a SAML login. If this field is blank,
   "Public IP" continues to be used for these redirects, matching the previous
   behavior. The value must be a valid IP address or DNS hostname.

   Leave this field blank if a single address already works for both browser
   access and log delivery. No action is required for an existing CoPilot
   Association.

3. Click **Save**.

<a id="enable-security-groups" />

## Enabling Controller to Manage CoPilot Security Groups

The CoPilot Security Group Management feature in Controller is available
starting from Controller release 6.8. The feature is available for AWS and Azure
CSPs and is enabled by default.

To enable or disable Security Group Management, see <a href={"/docs/enterprise/" + "10.1" +
"/reference/controlplane/copilot-security-group-management"}>CoPilot Security
Group Management</a> for details.