Workspace, teams, and users
Manage who has access to your workspace, how they are organized into teams, and what they can do.
Audience: IT (the enabler)
The /users page is the admin surface for membership.
In version 3.2.3, it includes People, Teams, and Sign-in tabs for workspace admins.
Use Sign-in to configure identity provider groups and the roles they grant; see Single sign-on and identity.
Members who navigate to /users see a read-only directory and the workspace admins to contact.
Read the People tab
The People tab is a flat directory of everyone in the workspace. Four stat tiles at the top double as role filters: Total, Admins, Builders, and Members. Click a tile to scope the list to that role. The toolbar below adds a search field, a team filter, and a status filter.
Each row shows the avatar, display name, email, role badge (Admin, Builder, Member), the team chips the person belongs to, and last sign-in time. The kebab on each row opens admin actions: change role, add to team, view activity, and remove.
Invite a teammate
The invite flow mints a one-time accept link. The link expires in fourteen days and is only returned at create time and on resend.
Open the invite dialog
Click Invite in the page header.
Enter the email and pick a role
Workspace role is Member, Builder, or Admin. A Builder can build and change every project and team, without admin reach.
Copy the accept link and share it
The success toast surfaces the link. Send it through the channel your org uses for onboarding.
Pending invites appear in the directory with a dashed Sema4 avatar and a Pending chip. The row actions are Copy link, Resend, and Revoke. Copy link reads the cached token when present and falls back to a fresh resend if it does not. Resend mints a new token and invalidates the previous one.
Manage roles and remove people
Click the kebab on a user row and pick Change role to switch between Member, Builder, and Admin. You cannot change your own role from this page.
Remove soft-removes the user: access ends immediately, the user record stays so audit history still resolves them by name, and you can re-invite the same email later.
Roles from identity provider groups
From version 3.2.3, workspace admins can use Users → Sign-in to assign an identity provider group a role in the workspace, a team, or a project. The People tab identifies roles that come from groups, and a person's groups indicator opens Groups at last sign-in for troubleshooting. Team and project access views also show their group assignments; manage those assignments on the Sign-in tab.
With Roles from groups on, people receive the highest applicable role from their manual and group assignments. Changing a manual role does not remove access supplied by a group. New assignments and IdP membership changes apply at the person's next sign-in; changing or removing an existing group assignment affects its current grants immediately. See Map groups to roles for setup and Recover from a broken configuration before changing administrator access.
Organize teams
Switch to the Teams tab to create teams and manage membership. Teams are a two-pane layout: a searchable rail on the left, a detail pane on the right. Below 1080px the panes stack vertically. Workspace admins and builders can open any active team without being a member of it.
Create a team
Click Create team. Set a name, an optional slug, a description, and an icon.
Add members
Open the team in the right pane and click Add member. Pick an existing workspace user and assign them as a Member, a Builder, or a Team admin.
Archive or delete
Use the kebab in the team header to archive a team. A team must be archived and have no bound projects before it can be permanently deleted. The delete dialog lists any bound projects you need to move or remove first.
Trace what a user did
Click View activity on a row to deep-link into the audit ledger with that user pre-selected as the actor. The link uses /audit?actor=<user_id>, which is a server-side filter. Pagination respects the filter, so the timeline you see is complete for that actor and time window.
Members see a read-only directory. Members who navigate to /users see the workspace admins to contact and a directory of everyone in the workspace, without admin tools.