Teams, enterprise & SSO

An enterprise account gives your team shared capabilities and allowances, a verified email domain, and single sign-on. Enterprises are set up by sales. Once yours exists, this page covers what an owner or admin configures.

Roles

Every member of an enterprise has a role:

  • Owner: full control, including billing and enterprise settings.
  • Admin: manages members, domains, and SSO, and can see members’ connected apps, disconnect them or sign out one of their sessions, but can’t touch owner-only controls.
  • Member: a regular user in the enterprise, with access to the enterprise’s capabilities and allowances.

Where approvals apply to your organization, owners and admins also decide on our staff’s requests for access, under Organization → Staff access, a tab that appears only then. When a request is needed, who can approve it, and what an approval opens is in Security & data handling.

Domain verification (DNS-TXT)

Before people can join automatically, or before you enforce SSO, you verify that you own their email domain:

  1. Add your domain in the enterprise settings.
  2. The platform gives you a verification token.
  3. Publish that token as a DNS TXT record on the domain.
  4. The platform checks the record and marks the domain verified.

A verified domain is what lets the platform associate new sign-ins from that domain with your enterprise.

Single sign-on (OIDC)

Enterprises connect their own identity provider over OIDC. Once configured, your users sign in through your IdP instead of a local password. Two settings control the behavior:

  • Add people automatically (auto-provision): when on, someone signing in through your identity provider joins your enterprise as a member, with no invitation. Both things have to be true: the sign-in goes through your connection, and their email address is on a domain you have verified. They always join as a member, never as an admin or owner. Off by default, including on connections you set up before this setting did anything, so nobody joins without an invitation until you turn it on.
  • Enforce SSO: when on, users on your domain must sign in through SSO, and other sign-in methods are refused. Use this to make SSO mandatory once you’ve confirmed the connection works.

Two cases the automatic path deliberately leaves alone. Someone whose address is on a domain you have not verified is not added, even if they can sign in through your provider. And someone who already belongs to a different enterprise is not moved into yours by signing in; move them with the member controls instead.

People who join this way appear in your activity feed the same as invited members, so you can see who arrived and when.

Configure the connection carefully. Turn on Enforce SSO only after you’ve verified a test user can sign in through it, so you don’t lock your team out.

Inviting members

For users outside your verified domains, or when you’d rather approve each person, invite members directly from the enterprise settings. Invited users join with the role you assign (admin or member). Invitations work whether or not automatic joining is on.

Usage across the team

The enterprise’s capabilities apply to every member. Storage and investigation-unit allowances are set at the enterprise level and applied to each member, so one heavy user doesn’t consume a teammate’s budget. Admins can see usage across the team.

An enterprise can also hold one shared allowance of investigation units for its contract term, drawn on by every member. Each member’s own cap still applies, so a run is declined if either would be exceeded. Owners and admins see the shared allowance on the organization overview: what has been used, what remains, and the days left in the term. Sales sets up a shared allowance. See Investigation units & quotas for how the budget works.

A contract can also include a shared data allowance: how much the team can upload during the term, in decimal units, counting a compressed file or archive at its expanded size. It appears beside the unit allowance on the organization overview and on every member’s usage page. Owners and admins can be alerted when either shared allowance reaches 50, 75 and 100 percent, by adding an alert for “Organization allowance threshold crossed” in the organization’s alert settings.

Next