Manage membership, roles, seats, group assignments, and departments from Organization Settings > Users. Adjacent pages handle Departments, Access Groups, and Single Sign-On.

Inviting people

The Users admin page with the member roster, roles, and seat controls — ↳The roster is the source of truth: roles, seats, and bulk operations in one table.

1Click Invite, enter the email address, and pick a role: user, org admin, or platform admin.
2The invitee gets an email. Pending invitations are listed until accepted.

Roles and seats

Members hold one role: owner, platform admin, org admin, user, or viewer. Separately, each member has a seat plan, Chat or Build, which is what determines their capabilities and billing. The user list shows each member's instance and its live status alongside role and seat.

Change one member's seat from their row, or select multiple members with the checkboxes and set the seat plan in bulk: a 500-seat org should not need 500 dropdown clicks. Bulk changes skip members already on the target plan and report how many were updated versus failed.

Finding people

The list supports free-text search, a role filter, an instance filter (Build seats versus Chat seats), and sortable columns for email, role, instance, and status.

Groups and departments

Assign members to access groups directly from their row in the user list. Access groups gate resources: for example, an MCP connection scoped to a group is only usable by that group's members. Groups themselves are created on Organization Settings > Access Groups with a name and description, and members are added there or from the Users page.

Each member also belongs to at most one department. Departments are pure org structure, created on Organization Settings > Departments; per-department budgets are set on Spending Limits, the single authoritative home for financial controls. Deleting a department flips its members back to Unassigned, so nobody is stranded.

The Departments admin page with the org structure list — ↳Departments are pure structure: budgets live on Spending Limits, people live here.

The Access Groups admin page with the group list and per-group membership — ↳Groups gate resources: scope a source to a group and only that group can reach it.

Single Sign-On

Organization Settings > Single Sign-On configures SAML 2.0 with Microsoft Entra ID. Paste your Entra federation metadata URL or the metadata XML and the form auto-fills the identifier, sign-on URL, and signing certificates; the SP values you need on the Entra side are shown with copy buttons. You must add at least one allowed email domain before enabling SSO, and the signing certificate never round-trips back out of the API after you save it.

Export

Export the roster as CSV (email, name, role, seat plan, member since) for license and finance reconciliation. The export matches exactly what the table shows.