Add and suspend
Create accounts for your people. A suspended person loses access to mail within about half a minute, not at the next sign-in.
Admin & security
People, sign-in and directory sync for the whole workspace.
The Admin console is where a workspace’s owner and admins add and suspend people, decide how they sign in, and connect the company’s identity provider. Single sign-on and directory sync attach to a domain you have already verified for mail.
People
Who is in the workspace, and what each person may do.
Import from a CSV
Every row is checked against the workspace and shown first; nothing is created until you press the button that says how many. Temporary passwords leave in one downloaded file, never on screen.
Custom roles that only narrow
A custom role is a subset of a person’s own role. It can take permissions away; it can never give anyone more than their role allows.
01
Two-step on every account
Each person can turn on an authenticator app — with recovery codes shown once — or a passkey.
02Require it for everyone
An owner or admin can require two-step for the workspace; a session without a second step is then refused and the person is asked to turn it on. The switch will not turn on for an admin who has no second step of their own.
03Sign out everywhere
For an account the workspace created, end every session and every connected app at once.
Single sign-on
Your people sign in with your identity provider.
Connect OpenID Connect or SAML 2.0 to a domain the workspace has verified in Domains. People with an address on that domain sign in through your provider, and an account is made for them the first time they do.
Require it, keep a way inOnly the owner can require single sign-on for a domain, and only with two-step of their own. Passwords are then refused for that domain — except an owner with two-step, so a provider outage does not lock the company out.
Verified domains onlyA domain that has not been verified for this workspace cannot be connected. Proving it once for mail is what makes it usable here.
Recorded before it changesEvery change to how a domain signs in is written to the audit log first. If the log cannot record it, nothing changes.
Directory sync
SCIM 2.0: your directory adds and removes people here.
A token per directory, shown once
Your identity provider calls with a SCIM token. Only its hash is kept, and you can revoke it from the console.
People and groups
Create, update, suspend and remove people from the directory. A suspension follows the same rule as one made by hand.
Groups change nothing until you map them
A directory group gains permissions only when an admin maps it to a custom role here.
01
A customer’s own identity provider
Single sign-on and SCIM are live and answer on production, but no customer has signed in through their own provider yet. Try it with a test account first.
02Workspace export and sharing rules
A whole-workspace export and rules for sharing outside the company are built. They stay off this page until we have seen them work in production.
03Knowledge has its own sign-in
Knowledge still accepts its own sign-in session, so a two-step or single sign-on requirement may not reach it yet.
04Paid plans
Every workspace is on the Free plan. Paid plans are not on sale yet.
Questions
Asked before the first domain is connected.
Who can open the Admin console?
The workspace’s owner and admins. Anyone else who opens it is told the workspace is managed by an admin.
Which identity providers work?
One that speaks OpenID Connect with a discovery document, or SAML 2.0. We have not yet run one for a customer in production, so we name none here.
What if our provider is down while single sign-on is required?
An owner who has two-step can still sign in with a password and the second step, and switch the requirement off.
Does directory sync give our identity provider admin powers?
No. A synced group changes what people may do only after an admin maps it to a custom role, and a custom role can only narrow.
Verify one domain. Turn on two-step. Connect a test provider.
Free to start, with no credit card.