Administer
Team and roles
What each role can do, and how project access works.
Roles
| Role | What they can do |
|---|---|
| Owner | Everything, including transferring ownership. Every organization keeps at least one. |
| Admin | Manage the organization, team, projects, connections, saved views, budgets, allocation rules, reports, chargeback, API keys, single sign on and required two step verification. |
| Member | Read the projects they are granted: their costs, connections and budgets. Save views in Explore, and generate and schedule reports of them. |
| Viewer | Read only access to the projects they are granted, and generate reports of them. |
| Billing | See the plan and the spend of the projects they are granted, save views, manage their budgets and who is alerted, generate and schedule reports, and run chargeback. |
Project access
Owners and admins see every project. Members, viewers and billing contacts see only the projects they are granted, chosen when they are invited or changed later from Change role and access.
Rules that protect the organization
- Only an owner can make someone else an owner, or change another owner's access.
- Nobody can change their own role or remove themselves.
- The last owner cannot be removed. Transfer ownership first with Make owner, which turns you into an admin.
- Removing a member ends their access on their next request.
- An owner cannot be suspended. Transfer ownership first.
Suspending a member
Choose Suspend access on a member's row to end their access on their next request without removing them. Their role, projects and history stay, and they no longer hold a seat on your plan. Reactivate access restores them as they were, if a seat is free. They are told by email either way. People your identity provider manages are deactivated there instead.
Invitations
Invitations are listed under Invitations until they are accepted, including expired ones. Send again emails a new link valid for seven days, and the earlier link stops working; Revoke withdraws it.
Provisioned people
On the Enterprise plan, your identity provider can manage the team for you: see Provisioning with SCIM. People it manages are marked Identity provider on the Team page; it adds, deactivates and removes them, and once any group has a role, their role comes from their groups.
Erasure requests
When a person asks your organization to erase their data, choose Erase personal data on their row. They are removed, and their name and email are replaced in your organization's audit trail. The events themselves are kept.