diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index a2db6b7..c072a12 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -63,6 +63,7 @@ PROXY_AUTH_LOGOUT_URL=/logout        # URL for SSO logout
 - **DO NOT** put port configuration here - use system.json or systemd overrides
 - Copy `.env.example` from the repository for a ready-to-edit template
 - Locked out? Create `<data-path>/.auth_recovery`, restart Pulse, and sign in from localhost to reset credentials. Remove the file afterwards.
+- **UI Behavior:** When authentication is not configured, the Settings tab is automatically hidden from the web interface, providing a cleaner monitoring-only view for unauthenticated deployments.
 
 ---
 
diff --git a/frontend-modern/src/App.tsx b/frontend-modern/src/App.tsx
index 459d8aa..567ff60 100644
--- a/frontend-modern/src/App.tsx
+++ b/frontend-modern/src/App.tsx
@@ -897,7 +897,7 @@ function AppLayout(props: {
       { warning: 0, critical: 0 },
     );
     const activeAlertCount = breakdown.warning + breakdown.critical;
-    return [
+    const tabs = [
       {
         id: 'alerts' as const,
         label: 'Alerts',
@@ -908,7 +908,11 @@ function AppLayout(props: {
         breakdown,
         icon: <BellIcon class="w-4 h-4 shrink-0" />,
       },
-      {
+    ];
+
+    // Only show Settings tab when authentication is configured
+    if (hasAuth()) {
+      tabs.push({
         id: 'settings' as const,
         label: 'Settings',
         route: '/settings',
@@ -917,8 +921,10 @@ function AppLayout(props: {
         count: undefined,
         breakdown: undefined,
         icon: <SettingsIcon class="w-4 h-4 shrink-0" />,
-      },
-    ];
+      });
+    }
+
+    return tabs;
   });
 
   const handlePlatformClick = (platform: ReturnType<typeof platformTabs>[number]) => {