diff --git a/x-pack/.i18nrc.json b/x-pack/.i18nrc.json
index 278968cb47231..36cfdf904d6d4 100644
--- a/x-pack/.i18nrc.json
+++ b/x-pack/.i18nrc.json
@@ -11,7 +11,7 @@
     "xpack.dashboard": "plugins/dashboard_enhanced",
     "xpack.discover": "plugins/discover_enhanced",
     "xpack.crossClusterReplication": "plugins/cross_cluster_replication",
-    "xpack.dashboardMode": "legacy/plugins/dashboard_mode",
+    "xpack.dashboardMode": "plugins/dashboard_mode",
     "xpack.data": "plugins/data_enhanced",
     "xpack.embeddableEnhanced": "plugins/embeddable_enhanced",
     "xpack.endpoint": "plugins/endpoint",
diff --git a/x-pack/index.js b/x-pack/index.js
index e7dd4886e6052..2d2e42650cfa7 100644
--- a/x-pack/index.js
+++ b/x-pack/index.js
@@ -7,7 +7,6 @@
 import { xpackMain } from './legacy/plugins/xpack_main';
 import { monitoring } from './legacy/plugins/monitoring';
 import { security } from './legacy/plugins/security';
-import { dashboardMode } from './legacy/plugins/dashboard_mode';
 import { beats } from './legacy/plugins/beats_management';
 import { spaces } from './legacy/plugins/spaces';
 import { ingestManager } from './legacy/plugins/ingest_manager';
@@ -18,8 +17,7 @@ module.exports = function (kibana) {
     monitoring(kibana),
     spaces(kibana),
     security(kibana),
-    dashboardMode(kibana),
-    beats(kibana),
     ingestManager(kibana),
+    beats(kibana),
   ];
 };
diff --git a/x-pack/legacy/plugins/dashboard_mode/index.js b/x-pack/legacy/plugins/dashboard_mode/index.js
deleted file mode 100644
index 1145fad2a8a28..0000000000000
--- a/x-pack/legacy/plugins/dashboard_mode/index.js
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { resolve } from 'path';
-import { i18n } from '@kbn/i18n';
-import { CONFIG_DASHBOARD_ONLY_MODE_ROLES } from './common';
-import { createDashboardModeRequestInterceptor } from './server';
-
-// Copied largely from plugins/kibana/index.js. The dashboard viewer includes just the dashboard section of
-// the standard kibana plugin. We don't want to include code for the other links (visualize, dev tools, etc)
-// since it's view only, but we want the urls to be the same, so we are using largely the same setup.
-export function dashboardMode(kibana) {
-  return new kibana.Plugin({
-    id: 'dashboard_mode',
-    publicDir: resolve(__dirname, 'public'),
-    require: ['kibana', 'elasticsearch', 'xpack_main'],
-    uiExports: {
-      uiSettingDefaults: {
-        [CONFIG_DASHBOARD_ONLY_MODE_ROLES]: {
-          name: i18n.translate('xpack.dashboardMode.uiSettings.dashboardsOnlyRolesTitle', {
-            defaultMessage: 'Dashboards only roles',
-          }),
-          description: i18n.translate(
-            'xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDescription',
-            {
-              defaultMessage: 'Roles that belong to View Dashboards Only mode',
-            }
-          ),
-          value: ['kibana_dashboard_only_user'],
-          category: ['dashboard'],
-          deprecation: {
-            message: i18n.translate(
-              'xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDeprecation',
-              {
-                defaultMessage: 'This setting is deprecated and will be removed in Kibana 8.0.',
-              }
-            ),
-            docLinksKey: 'dashboardSettings',
-          },
-        },
-      },
-    },
-
-    config(Joi) {
-      return Joi.object({
-        enabled: Joi.boolean().default(true),
-      }).default();
-    },
-
-    init(server) {
-      server.injectUiAppVars(
-        'dashboardViewer',
-        async () => await server.getInjectedUiAppVars('kibana')
-      );
-
-      if (server.plugins.security) {
-        server.ext(createDashboardModeRequestInterceptor());
-      }
-    },
-  });
-}
diff --git a/x-pack/legacy/plugins/dashboard_mode/server/__tests__/dashboard_mode_request_interceptor.js b/x-pack/legacy/plugins/dashboard_mode/server/__tests__/dashboard_mode_request_interceptor.js
deleted file mode 100644
index 3fd9bf5f59d52..0000000000000
--- a/x-pack/legacy/plugins/dashboard_mode/server/__tests__/dashboard_mode_request_interceptor.js
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import expect from '@kbn/expect';
-import Hapi from 'hapi';
-
-import { createDashboardModeRequestInterceptor } from '../dashboard_mode_request_interceptor';
-
-const DASHBOARD_ONLY_MODE_ROLE = 'test_dashboard_only_mode_role';
-
-function setup() {
-  const server = new Hapi.Server();
-
-  server.decorate('request', 'getUiSettingsService', () => {
-    return {
-      get: () => Promise.resolve([DASHBOARD_ONLY_MODE_ROLE]),
-    };
-  });
-
-  // attach the extension
-  server.ext(createDashboardModeRequestInterceptor());
-
-  // allow the extension to fake "render an app"
-  server.decorate('toolkit', 'renderApp', function (app) {
-    // `this` is the `h` response toolkit
-    return this.response({ renderApp: true, app });
-  });
-
-  server.decorate('server', 'newPlatform', {
-    setup: {
-      core: {
-        http: {
-          basePath: {
-            get: () => '',
-          },
-        },
-      },
-    },
-  });
-
-  server.route({
-    path: '/app/{appId}',
-    method: 'GET',
-    handler(req, h) {
-      return h.renderApp({ name: req.params.appId });
-    },
-  });
-
-  // catch all route for determining when we get through the extensions
-  server.route({
-    path: '/{path*}',
-    method: 'GET',
-    handler(req) {
-      return { catchAll: true, path: `/${req.params.path}` };
-    },
-  });
-
-  return { server };
-}
-
-describe('DashboardOnlyModeRequestInterceptor', () => {
-  describe('request is not for dashboad-only user', () => {
-    describe('app route', () => {
-      it('lets the route render as normal', async () => {
-        const { server } = setup();
-        const response = await server.inject({
-          url: '/app/kibana',
-          credentials: {
-            roles: ['foo', 'bar'],
-          },
-        });
-
-        expect(response)
-          .to.have.property('statusCode', 200)
-          .and.have.property('result')
-          .eql({
-            renderApp: true,
-            app: { name: 'kibana' },
-          });
-      });
-    });
-
-    describe('non-app route', () => {
-      it('lets the route render as normal', async () => {
-        const { server } = setup();
-        const response = await server.inject({
-          url: '/foo/bar',
-          credentials: {
-            roles: ['foo', 'bar'],
-          },
-        });
-
-        expect(response).to.have.property('statusCode', 200).and.have.property('result').eql({
-          catchAll: true,
-          path: '/foo/bar',
-        });
-      });
-    });
-  });
-
-  describe('request for dashboard-only user', () => {
-    describe('non-kibana app route', () => {
-      it('responds with 404', async () => {
-        const { server } = setup();
-        const response = await server.inject({
-          url: '/app/foo',
-          credentials: {
-            roles: [DASHBOARD_ONLY_MODE_ROLE],
-          },
-        });
-
-        expect(response).to.have.property('statusCode', 404);
-      });
-    });
-
-    describe('requests to dashboard_mode app', () => {
-      it('lets the route render as normal', async () => {
-        const { server } = setup();
-        const response = await server.inject({
-          url: '/app/dashboard_mode',
-          credentials: {
-            roles: [DASHBOARD_ONLY_MODE_ROLE],
-          },
-        });
-
-        expect(response)
-          .to.have.property('statusCode', 200)
-          .and.have.property('result')
-          .eql({
-            renderApp: true,
-            app: { name: 'dashboard_mode' },
-          });
-      });
-    });
-
-    function testRedirectToDashboardModeApp(url) {
-      describe(`requests to url:"${url}"`, () => {
-        it('redirects to the dashboard_mode app instead', async () => {
-          const { server } = setup();
-          const response = await server.inject({
-            url: url,
-            credentials: {
-              roles: [DASHBOARD_ONLY_MODE_ROLE],
-            },
-          });
-
-          expect(response).to.have.property('statusCode', 301);
-          expect(response.headers).to.have.property('location', '/app/dashboard_mode');
-        });
-      });
-    }
-
-    testRedirectToDashboardModeApp('/app/kibana');
-    testRedirectToDashboardModeApp('/app/kibana#/foo/bar');
-    testRedirectToDashboardModeApp('/app/kibana/foo/bar');
-    testRedirectToDashboardModeApp('/app/kibana?foo=bar');
-    testRedirectToDashboardModeApp('/app/dashboards?foo=bar');
-    testRedirectToDashboardModeApp('/app/home?foo=bar');
-  });
-});
diff --git a/x-pack/legacy/plugins/dashboard_mode/server/dashboard_mode_request_interceptor.js b/x-pack/legacy/plugins/dashboard_mode/server/dashboard_mode_request_interceptor.js
deleted file mode 100644
index 76a582d6cf239..0000000000000
--- a/x-pack/legacy/plugins/dashboard_mode/server/dashboard_mode_request_interceptor.js
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import Boom from 'boom';
-
-import { CONFIG_DASHBOARD_ONLY_MODE_ROLES } from '../common';
-
-const superuserRole = 'superuser';
-
-/**
- *  Intercept all requests after auth has completed and apply filtering
- *  logic to enforce dashboard only mode.
- *
- *  @type {Hapi.RequestExtension}
- */
-export function createDashboardModeRequestInterceptor() {
-  return {
-    type: 'onPostAuth',
-    async method(request, h) {
-      const { auth, url } = request;
-      const user = auth.credentials;
-      const roles = user ? user.roles : [];
-
-      if (!user) {
-        return h.continue;
-      }
-
-      const isAppRequest = url.path.startsWith('/app/');
-
-      // The act of retrieving this setting ends up creating the config document if it doesn't already exist.
-      // Various functional tests have come to indirectly rely on this behavior, so changing this is non-trivial.
-      // This will be addressed once dashboard-only-mode is removed altogether.
-      const uiSettings = request.getUiSettingsService();
-      const dashboardOnlyModeRoles = await uiSettings.get(CONFIG_DASHBOARD_ONLY_MODE_ROLES);
-
-      if (!isAppRequest || !dashboardOnlyModeRoles || !roles || roles.length === 0) {
-        return h.continue;
-      }
-
-      const isDashboardOnlyModeUser = user.roles.find((role) =>
-        dashboardOnlyModeRoles.includes(role)
-      );
-      const isSuperUser = user.roles.find((role) => role === superuserRole);
-
-      const enforceDashboardOnlyMode = isDashboardOnlyModeUser && !isSuperUser;
-      if (enforceDashboardOnlyMode) {
-        if (
-          url.path.startsWith('/app/home') ||
-          url.path.startsWith('/app/kibana') ||
-          url.path.startsWith('/app/dashboards')
-        ) {
-          const basePath = request.server.newPlatform.setup.core.http.basePath.get(request);
-          const url = `${basePath}/app/dashboard_mode`;
-          // If the user is in "Dashboard only mode" they should only be allowed to see
-          // the dashboard app and none others. If the kibana app is requested, this might be a old
-          // url we will migrate on the fly.
-          return h.redirect(url).permanent().takeover();
-        }
-        if (url.path.startsWith('/app/dashboard_mode')) {
-          // let through requests to the dashboard_mode app
-          return h.continue;
-        }
-
-        throw Boom.notFound();
-      }
-
-      return h.continue;
-    },
-  };
-}
diff --git a/x-pack/legacy/plugins/ingest_manager/index.ts b/x-pack/legacy/plugins/ingest_manager/index.ts
index df9923d9f11ec..2b20bf16f2400 100644
--- a/x-pack/legacy/plugins/ingest_manager/index.ts
+++ b/x-pack/legacy/plugins/ingest_manager/index.ts
@@ -8,6 +8,7 @@ import { resolve } from 'path';
 export function ingestManager(kibana: any) {
   return new kibana.Plugin({
     id: 'ingestManager',
+    require: ['kibana', 'elasticsearch', 'xpack_main'],
     publicDir: resolve(__dirname, '../../../plugins/ingest_manager/public'),
   });
 }
diff --git a/x-pack/legacy/plugins/dashboard_mode/server/index.js b/x-pack/plugins/dashboard_mode/common/constants.ts
similarity index 71%
rename from x-pack/legacy/plugins/dashboard_mode/server/index.js
rename to x-pack/plugins/dashboard_mode/common/constants.ts
index a7193bb560ca1..f5d36fe9799c7 100644
--- a/x-pack/legacy/plugins/dashboard_mode/server/index.js
+++ b/x-pack/plugins/dashboard_mode/common/constants.ts
@@ -4,4 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { createDashboardModeRequestInterceptor } from './dashboard_mode_request_interceptor';
+export const UI_SETTINGS = {
+  CONFIG_DASHBOARD_ONLY_MODE_ROLES: 'xpackDashboardMode:roles',
+};
diff --git a/x-pack/legacy/plugins/dashboard_mode/common/index.js b/x-pack/plugins/dashboard_mode/common/index.ts
similarity index 84%
rename from x-pack/legacy/plugins/dashboard_mode/common/index.js
rename to x-pack/plugins/dashboard_mode/common/index.ts
index 358d0d5b7e076..60cf0060636d7 100644
--- a/x-pack/legacy/plugins/dashboard_mode/common/index.js
+++ b/x-pack/plugins/dashboard_mode/common/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export * from './constants';
+export { UI_SETTINGS } from './constants';
diff --git a/x-pack/plugins/dashboard_mode/kibana.json b/x-pack/plugins/dashboard_mode/kibana.json
index dfe3221025092..4777b9b25be23 100644
--- a/x-pack/plugins/dashboard_mode/kibana.json
+++ b/x-pack/plugins/dashboard_mode/kibana.json
@@ -3,10 +3,13 @@
   "version": "8.0.0",
   "kibanaVersion": "kibana",
   "configPath": [
-    "xpack", "dashboard_mode"
+    "xpack",
+    "dashboard_mode"
   ],
+  "optionalPlugins": ["security"],
   "requiredPlugins": [
-    "kibanaLegacy", "dashboard"
+    "kibanaLegacy",
+    "dashboard"
   ],
   "server": true,
   "ui": true
diff --git a/x-pack/plugins/dashboard_mode/server/index.ts b/x-pack/plugins/dashboard_mode/server/index.ts
index 2a8890c2f81ac..671a398734ac1 100644
--- a/x-pack/plugins/dashboard_mode/server/index.ts
+++ b/x-pack/plugins/dashboard_mode/server/index.ts
@@ -4,17 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PluginConfigDescriptor } from 'kibana/server';
-
+import { PluginConfigDescriptor, PluginInitializerContext } from 'kibana/server';
 import { schema } from '@kbn/config-schema';
 
+import { DashboardModeServerPlugin } from './plugin';
+
 export const config: PluginConfigDescriptor = {
   schema: schema.object({
     enabled: schema.boolean({ defaultValue: true }),
   }),
 };
 
-export const plugin = () => ({
-  setup() {},
-  start() {},
-});
+export function plugin(initializerContext: PluginInitializerContext) {
+  return new DashboardModeServerPlugin(initializerContext);
+}
+
+export { DashboardModeServerPlugin as Plugin };
diff --git a/x-pack/plugins/dashboard_mode/server/interceptors/dashboard_mode_request_interceptor.test.ts b/x-pack/plugins/dashboard_mode/server/interceptors/dashboard_mode_request_interceptor.test.ts
new file mode 100644
index 0000000000000..2978c48af7414
--- /dev/null
+++ b/x-pack/plugins/dashboard_mode/server/interceptors/dashboard_mode_request_interceptor.test.ts
@@ -0,0 +1,111 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  OnPostAuthHandler,
+  OnPostAuthToolkit,
+  KibanaRequest,
+  LifecycleResponseFactory,
+  IUiSettingsClient,
+} from 'kibana/server';
+import { coreMock } from '../../../../../src/core/server/mocks';
+
+import { AuthenticatedUser } from '../../../security/server';
+import { securityMock } from '../../../security/server/mocks';
+
+import { setupDashboardModeRequestInterceptor } from './dashboard_mode_request_interceptor';
+
+const DASHBOARD_ONLY_MODE_ROLE = 'test_dashboard_only_mode_role';
+
+describe('DashboardOnlyModeRequestInterceptor', () => {
+  const core = coreMock.createSetup();
+  const security = securityMock.createSetup();
+
+  let interceptor: OnPostAuthHandler;
+  let toolkit: OnPostAuthToolkit;
+  let uiSettingsMock: any;
+
+  beforeEach(() => {
+    toolkit = {
+      next: jest.fn(),
+    };
+    interceptor = setupDashboardModeRequestInterceptor({
+      http: core.http,
+      security,
+      getUiSettingsClient: () =>
+        (Promise.resolve({
+          get: () => Promise.resolve(uiSettingsMock),
+        }) as unknown) as Promise<IUiSettingsClient>,
+    });
+  });
+
+  test('should not redirects for not app/* requests', async () => {
+    const request = ({
+      url: {
+        path: 'api/test',
+      },
+    } as unknown) as KibanaRequest;
+
+    interceptor(request, {} as LifecycleResponseFactory, toolkit);
+
+    expect(toolkit.next).toHaveBeenCalled();
+  });
+
+  test('should not redirects not authenticated users', async () => {
+    const request = ({
+      url: {
+        path: '/app/home',
+      },
+    } as unknown) as KibanaRequest;
+
+    interceptor(request, {} as LifecycleResponseFactory, toolkit);
+
+    expect(toolkit.next).toHaveBeenCalled();
+  });
+
+  describe('request for dashboard-only user', () => {
+    function testRedirectToDashboardModeApp(url: string) {
+      describe(`requests to url:"${url}"`, () => {
+        test('redirects to the dashboard_mode app instead', async () => {
+          const request = ({
+            url: {
+              path: url,
+            },
+            credentials: {
+              roles: [DASHBOARD_ONLY_MODE_ROLE],
+            },
+          } as unknown) as KibanaRequest;
+
+          const response = ({
+            redirected: jest.fn(),
+          } as unknown) as LifecycleResponseFactory;
+
+          security.authc.getCurrentUser = jest.fn(
+            (r: KibanaRequest) =>
+              ({
+                roles: [DASHBOARD_ONLY_MODE_ROLE],
+              } as AuthenticatedUser)
+          );
+
+          uiSettingsMock = [DASHBOARD_ONLY_MODE_ROLE];
+
+          await interceptor(request, response, toolkit);
+
+          expect(response.redirected).toHaveBeenCalledWith({
+            headers: { location: `/mock-server-basepath/app/dashboard_mode` },
+          });
+        });
+      });
+    }
+
+    testRedirectToDashboardModeApp('/app/kibana');
+    testRedirectToDashboardModeApp('/app/kibana#/foo/bar');
+    testRedirectToDashboardModeApp('/app/kibana/foo/bar');
+    testRedirectToDashboardModeApp('/app/kibana?foo=bar');
+    testRedirectToDashboardModeApp('/app/dashboards?foo=bar');
+    testRedirectToDashboardModeApp('/app/home?foo=bar');
+  });
+});
diff --git a/x-pack/plugins/dashboard_mode/server/interceptors/dashboard_mode_request_interceptor.ts b/x-pack/plugins/dashboard_mode/server/interceptors/dashboard_mode_request_interceptor.ts
new file mode 100644
index 0000000000000..4378c818f087c
--- /dev/null
+++ b/x-pack/plugins/dashboard_mode/server/interceptors/dashboard_mode_request_interceptor.ts
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HttpServiceSetup, OnPostAuthHandler, IUiSettingsClient } from 'kibana/server';
+import { SecurityPluginSetup } from '../../../security/server';
+import { UI_SETTINGS } from '../../common';
+
+const superuserRole = 'superuser';
+
+interface DashboardModeRequestInterceptorDependencies {
+  http: HttpServiceSetup;
+  security: SecurityPluginSetup;
+  getUiSettingsClient: () => Promise<IUiSettingsClient>;
+}
+
+export const setupDashboardModeRequestInterceptor = ({
+  http,
+  security,
+  getUiSettingsClient,
+}: DashboardModeRequestInterceptorDependencies) =>
+  (async (request, response, toolkit) => {
+    const path = request.url.path || '';
+    const isAppRequest = path.startsWith('/app/');
+
+    if (!isAppRequest) {
+      return toolkit.next();
+    }
+
+    const authenticatedUser = security.authc.getCurrentUser(request);
+    const roles = authenticatedUser?.roles || [];
+
+    if (!authenticatedUser || roles.length === 0) {
+      return toolkit.next();
+    }
+
+    const uiSettings = await getUiSettingsClient();
+    const dashboardOnlyModeRoles = await uiSettings.get(
+      UI_SETTINGS.CONFIG_DASHBOARD_ONLY_MODE_ROLES
+    );
+
+    if (!dashboardOnlyModeRoles) {
+      return toolkit.next();
+    }
+
+    const isDashboardOnlyModeUser = roles.find((role) => dashboardOnlyModeRoles.includes(role));
+    const isSuperUser = roles.find((role) => role === superuserRole);
+
+    const enforceDashboardOnlyMode = isDashboardOnlyModeUser && !isSuperUser;
+
+    if (enforceDashboardOnlyMode) {
+      if (
+        path.startsWith('/app/home') ||
+        path.startsWith('/app/kibana') ||
+        path.startsWith('/app/dashboards')
+      ) {
+        const dashBoardModeUrl = `${http.basePath.get(request)}/app/dashboard_mode`;
+        // If the user is in "Dashboard only mode" they should only be allowed to see
+        // the dashboard app and none others.
+
+        return response.redirected({
+          headers: {
+            location: dashBoardModeUrl,
+          },
+        });
+      }
+
+      if (path.startsWith('/app/dashboard_mode')) {
+        // let through requests to the dashboard_mode app
+        return toolkit.next();
+      }
+
+      return response.notFound();
+    }
+
+    return toolkit.next();
+  }) as OnPostAuthHandler;
diff --git a/x-pack/legacy/plugins/dashboard_mode/common/constants.js b/x-pack/plugins/dashboard_mode/server/interceptors/index.ts
similarity index 72%
rename from x-pack/legacy/plugins/dashboard_mode/common/constants.js
rename to x-pack/plugins/dashboard_mode/server/interceptors/index.ts
index c9a2378ac5d82..e0bf175d15029 100644
--- a/x-pack/legacy/plugins/dashboard_mode/common/constants.js
+++ b/x-pack/plugins/dashboard_mode/server/interceptors/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const CONFIG_DASHBOARD_ONLY_MODE_ROLES = 'xpackDashboardMode:roles';
+export { setupDashboardModeRequestInterceptor } from './dashboard_mode_request_interceptor';
diff --git a/x-pack/plugins/dashboard_mode/server/plugin.ts b/x-pack/plugins/dashboard_mode/server/plugin.ts
new file mode 100644
index 0000000000000..8b56f71b667cb
--- /dev/null
+++ b/x-pack/plugins/dashboard_mode/server/plugin.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  PluginInitializerContext,
+  CoreSetup,
+  CoreStart,
+  Plugin,
+  SavedObjectsClient,
+  Logger,
+} from '../../../../src/core/server';
+
+import { SecurityPluginSetup } from '../../security/server';
+import { setupDashboardModeRequestInterceptor } from './interceptors';
+
+import { getUiSettings } from './ui_settings';
+
+interface DashboardModeServerSetupDependencies {
+  security?: SecurityPluginSetup;
+}
+
+export class DashboardModeServerPlugin implements Plugin<void, void> {
+  private initializerContext: PluginInitializerContext;
+  private logger?: Logger;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    this.initializerContext = initializerContext;
+  }
+
+  public setup(core: CoreSetup, { security }: DashboardModeServerSetupDependencies) {
+    this.logger = this.initializerContext.logger.get();
+
+    core.uiSettings.register(getUiSettings());
+
+    const getUiSettingsClient = async () => {
+      const [coreStart] = await core.getStartServices();
+      const { savedObjects, uiSettings } = coreStart;
+      const savedObjectsClient = new SavedObjectsClient(savedObjects.createInternalRepository());
+
+      return uiSettings.asScopedToClient(savedObjectsClient);
+    };
+
+    if (security) {
+      const dashboardModeRequestInterceptor = setupDashboardModeRequestInterceptor({
+        http: core.http,
+        security,
+        getUiSettingsClient,
+      });
+
+      core.http.registerOnPostAuth(dashboardModeRequestInterceptor);
+
+      this.logger.debug(`registered DashboardModeRequestInterceptor`);
+    }
+  }
+
+  public start(core: CoreStart) {}
+
+  public stop() {}
+}
diff --git a/x-pack/plugins/dashboard_mode/server/ui_settings.ts b/x-pack/plugins/dashboard_mode/server/ui_settings.ts
new file mode 100644
index 0000000000000..f692ec8a33fc9
--- /dev/null
+++ b/x-pack/plugins/dashboard_mode/server/ui_settings.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { schema } from '@kbn/config-schema';
+import { UiSettingsParams } from 'kibana/server';
+import { UI_SETTINGS } from '../common';
+
+const DASHBOARD_ONLY_USER_ROLE = 'kibana_dashboard_only_user';
+
+export function getUiSettings(): Record<string, UiSettingsParams<unknown>> {
+  return {
+    [UI_SETTINGS.CONFIG_DASHBOARD_ONLY_MODE_ROLES]: {
+      name: i18n.translate('xpack.dashboardMode.uiSettings.dashboardsOnlyRolesTitle', {
+        defaultMessage: 'Dashboards only roles',
+      }),
+      description: i18n.translate('xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDescription', {
+        defaultMessage: 'Roles that belong to View Dashboards Only mode',
+      }),
+      value: [DASHBOARD_ONLY_USER_ROLE],
+      category: ['dashboard'],
+      deprecation: {
+        message: i18n.translate('xpack.dashboardMode.uiSettings.dashboardsOnlyRolesDeprecation', {
+          defaultMessage: 'This setting is deprecated and will be removed in Kibana 8.0.',
+        }),
+        docLinksKey: 'dashboardSettings',
+      },
+      schema: schema.arrayOf(schema.string()),
+    },
+  };
+}
diff --git a/x-pack/plugins/ingest_manager/server/plugin.ts b/x-pack/plugins/ingest_manager/server/plugin.ts
index 13301df471c53..fb1c218e1545b 100644
--- a/x-pack/plugins/ingest_manager/server/plugin.ts
+++ b/x-pack/plugins/ingest_manager/server/plugin.ts
@@ -217,7 +217,7 @@ export class IngestManagerPlugin
       encryptedSavedObjects: EncryptedSavedObjectsPluginStart;
     }
   ) {
-    appContextService.start({
+    await appContextService.start({
       encryptedSavedObjectsStart: plugins.encryptedSavedObjects,
       encryptedSavedObjectsSetup: this.encryptedSavedObjectsSetup,
       security: this.security,
diff --git a/x-pack/test/api_integration/apis/fleet/index.js b/x-pack/test/api_integration/apis/fleet/index.js
index a8c026ac6a1bd..df81b826132a9 100644
--- a/x-pack/test/api_integration/apis/fleet/index.js
+++ b/x-pack/test/api_integration/apis/fleet/index.js
@@ -6,6 +6,7 @@
 
 export default function loadTests({ loadTestFile }) {
   describe('Fleet Endpoints', () => {
+    loadTestFile(require.resolve('./setup'));
     loadTestFile(require.resolve('./delete_agent'));
     loadTestFile(require.resolve('./list_agent'));
     loadTestFile(require.resolve('./unenroll_agent'));
@@ -16,7 +17,6 @@ export default function loadTests({ loadTestFile }) {
     loadTestFile(require.resolve('./enrollment_api_keys/crud'));
     loadTestFile(require.resolve('./install'));
     loadTestFile(require.resolve('./agents/actions'));
-    loadTestFile(require.resolve('./setup'));
     loadTestFile(require.resolve('./agent_flow'));
   });
 }
diff --git a/x-pack/test/api_integration/apis/index.js b/x-pack/test/api_integration/apis/index.js
index b79dc3f3ffe59..3f3294c85d6df 100644
--- a/x-pack/test/api_integration/apis/index.js
+++ b/x-pack/test/api_integration/apis/index.js
@@ -27,9 +27,9 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./short_urls'));
     loadTestFile(require.resolve('./lens'));
     loadTestFile(require.resolve('./fleet'));
-    loadTestFile(require.resolve('./ingest_manager'));
-    loadTestFile(require.resolve('./endpoint'));
     loadTestFile(require.resolve('./ml'));
     loadTestFile(require.resolve('./transform'));
+    loadTestFile(require.resolve('./endpoint'));
+    loadTestFile(require.resolve('./ingest_manager'));
   });
 }