Team Management
Invite members, assign roles, and manage access to your Atlas workspace.
Manage who has access to your Atlas workspace, what they can do, and how they authenticate.
Prerequisites
- A user with the
adminorownerrole
Roles
Atlas has three built-in roles:
| Role | Permissions |
|---|---|
| Member | Ask questions, create notebooks, share conversations |
| Admin | All member permissions + manage connections, settings, users, semantic layer, plugins, integrations, scheduled tasks |
| Owner | All admin permissions + billing, workspace deletion |
Enterprise plan workspaces can define Custom Roles with granular permissions.
Inviting Members
Send invitations
Go to Admin > Users (/admin/users) and click Invite user. Enter the email address and select a role.
The invitee receives an email with a link to join your workspace. Invitations expire after 7 days — resend from the same page if needed.
Bulk invitations
To invite multiple people, add email addresses one at a time from the invite dialog. Each invitation is sent independently. All invitees receive the same role you selected.
Managing Members
The Admin > Users page shows all workspace members with their:
- Name and email
- Role — click to change (admin or owner required)
- Status — active, invited (pending acceptance), or banned
- Joined — when they created their account
Changing a member's role
Click the role badge next to any member to change it. You cannot demote yourself below admin. Only owners can promote others to owner.
Removing a member
Click the menu on a member's row and select Remove. Removed members immediately lose access. Their conversation history is retained for audit purposes.
Authentication Methods
How members sign in depends on your workspace configuration:
| Method | Setup | Best for |
|---|---|---|
| Email + password | Available by default | Small teams getting started |
| Social login | Available by default (Google, GitHub) | Teams preferring OAuth |
| SSO (SAML/OIDC) | Enterprise plan — see SSO Setup | Organizations with an identity provider |
| SCIM provisioning | Enterprise plan — see SCIM | Auto-provisioning from Okta, Azure AD, etc. |
On the hosted platform, social login providers are pre-configured. Enterprise SSO and SCIM are available on the Enterprise plan.
See Also
- Custom Roles — granular permissions beyond the built-in roles (Enterprise plan)
- Enterprise SSO — SAML and OIDC single sign-on
- SCIM Directory Sync — automatic user provisioning
- IP Allowlisting — restrict access by IP address (Enterprise plan)