diff --git a/static/directives/config/config-setup-tool.html b/static/directives/config/config-setup-tool.html
index ead4609bf..226a7f8da 100644
--- a/static/directives/config/config-setup-tool.html
+++ b/static/directives/config/config-setup-tool.html
@@ -194,7 +194,7 @@
               <span class="config-string-field" binding="mapped.redis.host"
                     placeholder="The redis server hostname"
                     pattern="{{ HOSTNAME_REGEX }}"
-                    validator="validateHostname(value)">></span>
+                    validator="validateHostname(value)"></span>
             </td>
           </tr>
           <tr>
@@ -553,7 +553,7 @@
           prevent passwords from being saved as plaintext by the Docker client.
         </div>
 
-        <table class="config-table">
+        <table class="config-table" style="margin-bottom: 20px;">
           <tr>
             <td class="non-input">Authentication:</td>
             <td>
@@ -565,6 +565,28 @@
               </select>
             </td>
           </tr>
+
+          <tr ng-if="config.AUTHENTICATION_TYPE == 'LDAP' || config.AUTHENTICATION_TYPE == 'Keystone'">
+            <td>Team synchronization:</td>
+            <td>
+              <div class="config-bool-field" binding="config.FEATURE_TEAM_SYNCING">
+                Enable Team Synchronization Support
+              </div>
+              <div class="help-text">
+                If enabled, organization administrators who are also superusers can set teams to have their membership synchronized with a backing group in {{ config.AUTHENTICATION_TYPE }}.
+              </div>
+            </td>
+          </tr>
+          <tr ng-if="(config.AUTHENTICATION_TYPE == 'LDAP' || config.AUTHENTICATION_TYPE == 'Keystone') && config.FEATURE_TEAM_SYNCING">
+          <td>Resynchronization duration:</td>
+          <td>
+            <span class="config-string-field" binding="config.TEAM_RESYNC_STALE_TIME"
+                  pattern="[0-9]+(m|h|d|s)"></span>
+            <div class="help-text">
+            The duration before a team must be re-synchronized. Must be expressed in a duration string form: <code>30m</code>, <code>1h</code>, <code>1d</code>.
+            </div>
+          </td>
+          </tr>
         </table>
 
         <!--  Keystone Authentication -->
@@ -758,7 +780,7 @@
           <tr>
             <td>Administrator DN Password:</td>
             <td>
-              <div class="co-alert co-alert-warning">
+              <div class="co-alert co-alert-warning" style="margin-bottom: 10px;">
                 Note: This will be stored in
                 <strong>plaintext</strong> inside the config.yaml, so setting up a dedicated account or using
                 <a href="http://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html" ng-safenewtab>a password hash</a> is <strong>highly</strong> recommended.
diff --git a/util/config/configutil.py b/util/config/configutil.py
index c52d22928..e1105d9f7 100644
--- a/util/config/configutil.py
+++ b/util/config/configutil.py
@@ -76,3 +76,4 @@ def add_enterprise_config_defaults(config_obj, current_secret_key, hostname):
   config_obj['PREFERRED_URL_SCHEME'] = config_obj.get('PREFERRED_URL_SCHEME', 'http')
   config_obj['ENTERPRISE_LOGO_URL'] = config_obj.get(
     'ENTERPRISE_LOGO_URL', '/static/img/quay-logo.png')
+  config_obj['TEAM_RESYNC_STALE_TIME'] = '60m'