M↓ View as Markdown ↗

Members¶

The Members page is where you invite people to your organization, decide what each member can do, and remove people who no longer need access. Access is set with Capabilities. The presets Administrator, Editor, Viewer and Billing contact fill them in for you.

Availability

Who can do this: members with the Manage members and access capability (for the organization).
Deployment: Actian SaaS and self-managed deployments.

To open the page, go to Settings → Administration → Members. In Studio you can also click Members in the sidebar. If you don't hold Manage members and access, the page shows "You need Manage members permission to view this page."

The page has these sections:

Section	What it shows
Invite by email	The form for inviting someone.
Pending invitations	Invitations that haven't been accepted yet. Shown only when there is at least one.
Waiting for first SSO sign-in	People added ahead of their first Enterprise SSO sign-in. Shown only when there is at least one.
Current members	Everyone in the organization, with their access and MFA status.
Channel guests	Slack and Teams guests who hold a Seat.

Invite someone by email¶

Go to Settings → Administration → Members.
Under Invite by email, enter the person's email address.
Choose their access. The access picker next to the address shows Viewer by default. To change it, click the picker. In the Customize access dialog, choose a preset in Select preset or switch individual Capabilities on and off, then click Save. The dialog opens showing only your current Workspace. To set organization-level permissions or access in other Workspaces, click Show organization permissions and other Workspaces.
Click Invite.

The invitation's Capabilities are applied the first time the person signs in.

Keep in mind:

An invitation must give at least one Capability. No access isn't offered when you invite.
A preset's Workspace capabilities go to the Workspace you are currently working in. To give access to other Workspaces, click Show organization permissions and other Workspaces in Customize access and switch them on, or edit the member's access after they join.
Invitation emails can take up to 10 minutes to arrive. If one hasn't arrived, ask the person to check their spam folder.
On Actian SaaS, accepting the invitation signs the person in and takes them straight to your organization. On self-managed deployments that use Keycloak for sign-in, the invitation link opens the Keycloak sign-in page, where the person registers or signs in.

If the address is on one of your organization's verified SSO email domains, the Invite button may read Add instead. See Add people who sign in with SSO.

Why an invitation can be refused¶

Message	What it means
"That address is a disposable mailbox. Invite a durable mailbox instead."	The address belongs to a known throwaway email service.
"That address cannot receive mail. Check the domain and try again."	The domain has no mail server, or is a website-hosting domain. On air-gapped deployments the mail-server check is skipped.
"That address is already a member of this Organization. Change their Access role instead."	The person is already a member, even if they are set to No access. Use Edit access… on their row instead.
"That address was already added and hasn't signed in yet."	The person is listed under Waiting for first SSO sign-in.
"This Organization has no spare Seats. Contact Actian, or free a Seat by removing a member or setting one to No access."	Your organization has reached its Seat limit. See Seats.

Manage pending invitations¶

Pending invitations lists invitations that haven't been accepted. Each row shows the access the invitation gives and, when available, when it was sent (Sent) and when it expires (Expires).

Resend sends a new invitation with the same access. The previous link stops working.
Revoke cancels the invitation. Confirm with Revoke invitation. The link stops working straight away, and you can send a new invitation at any time.

If Resend is unavailable for an invitation, its access can't be read. Revoke it and send a new one.

Once someone accepts, their invitation leaves this list and they appear under Current members.

You can add people who sign in through your organization's Enterprise SSO before they sign in for the first time. No email is sent. They get the access you choose the first time they sign in through SSO.

Availability

Who can do this: members with the Manage members and access and Manage organization capabilities (for the organization).
Plan: Included only in plans that enable Enterprise SSO.
Deployment: Actian SaaS. Not available on self-managed deployments that use Keycloak for sign-in.

Your organization needs an Enterprise SSO connection with at least one verified email domain. The person's address must be on that exact domain. A subdomain doesn't match: example.com doesn't cover mail.example.com.

Under Invite by email, enter the person's address. When the address is on a verified SSO email domain, the button changes to Add and the page explains that no email is sent.
Choose their access in the access picker.
Click Add.

The person appears under Waiting for first SSO sign-in, with their access, when they were added, and a Not signed in yet badge. Their access starts the first time they sign in through your organization's SSO with that address.

To cancel, click Remove on their row and confirm. Their first SSO sign-in no longer gives them this access.

Adding a person is refused if they are already a member, already have a pending invitation ("That address already has a pending invitation."), were already added, or if no Seat is free.

View current members¶

Current members lists everyone in your organization. Each row shows:

the member's name and email address,
MFA: an icon whose tooltip reads MFA on, MFA off or MFA via IdP. MFA via IdP means the member signs in through your Enterprise SSO, and your identity provider handles MFA. On self-managed deployments that use Keycloak, the column shows whether the member has set up an authenticator app.
Access: the preset that matches their Capabilities, Custom or No access, followed by a Workspace name or the number of Workspaces when they hold access in a Workspace.

Use Search by name or email to find a member. Use the sort menu to sort by Name (A–Z), Name (Z–A) or Access level.

Change a member's access¶

On the member's row, click Edit access…. The Edit access for name dialog opens.
Choose a preset in Select preset, or switch individual Capabilities on and off for the current Workspace.

Warning

Choosing a preset replaces all of the member's current Capabilities, including organization-level permissions and access in other Workspaces, with the preset's set for the current Workspace. To keep access in other Workspaces, switch individual Capabilities instead of choosing a preset.
To set Organization-level permissions or access in other Workspaces, click Show organization permissions and other Workspaces. If the member already holds organization-level permissions or access in another Workspace, the dialog opens with everything shown.
Click Save.

Saving replaces everything the member holds, at organization level and in every Workspace. Anything switched off is removed. The change takes effect on the member's next action.

If someone is listed under Current members but hasn't signed in yet (for example, someone added through SCIM provisioning), you can still use Edit access…. Their Capabilities are applied when they first sign in.

You can't switch off your own Manage members and access. If you try, you're asked Change your own access? and the change is then refused. Ask another member with Manage members and access to do it. See Capabilities and access.

To change who can do what in a single Workspace, you can also use Settings → Administration → Workspaces (Members). See Workspaces.

SCIM provisioning

On Actian SaaS, when SCIM provisioning is on, members who also hold Manage organization see the note "Your identity provider sets Access roles for the people it names. Changes made here are re-applied at that member's next sign-in." You turn SCIM provisioning on under Settings → Administration → Security.

Set No access or remove a member¶

You have two ways to take away someone's access:

	No access	Remove
Stays a member of the organization	Yes	No
Capabilities	All removed	All removed
Seat	Released	Released
Active sessions	Signed out	Loses access to the organization
To restore access	Edit access…	Invite them again, then check their access with Edit access… after they accept

Set a member to No access¶

Click Edit access… on the member's row.
In Select preset, choose No access.
Click Save.

Remove members¶

Click Remove on each member you want to remove. The row shows Removing, and the button changes to Undo in case you change your mind.
In the Unsaved changes bar, click Save.
Confirm in the Remove this member? dialog (or Remove these members? when you remove several).

Your own row has no Remove button. To remove yourself, use Leave in the Danger zone of Settings → Administration → Organization (see General). The Organization page appears for members who hold Manage organization. You can't remove the last member who holds Manage members and access.

On self-managed deployments that use Keycloak for sign-in, members who joined through your organization's Enterprise SSO can't be removed here. You see "This member signs in through your organization's single sign-on, so they can't be removed here. Set them to No access, or remove them at your identity provider." The same applies if one of those members tries to leave the organization.

Seats¶

A Seat is what your organization is billed for. It doesn't decide what a member can do; Capabilities do that.

Every member with any Capability holds a Seat once they have signed in. This includes members with only Billing contact. Members with No access don't hold one.
Setting a member to No access or removing them releases their Seat straight away.
People under Waiting for first SSO sign-in reserve a Seat. They count against your Seat limit when you invite or add people, but they appear in the Seats used count only after they sign in.

When your plan or licence sets a Seat limit, the Current members header shows used of limit Seats used. Without a limit it shows the number of Seats used. If your organization holds more Seats than its plan allows, the page shows how many Seats it is over.

Inviting at the Seat limit¶

New invitations and SSO additions are refused when Seats held, plus pending invitations, plus people waiting for their first SSO sign-in reach the limit. To make room, remove a member, set one to No access, revoke a pending invitation, or contact Actian.

People who join automatically through Enterprise SSO or SCIM provisioning are not refused at the limit. Your organization goes over its Seat limit instead.

On self-managed deployments that use Sign-up domains, nobody can join through a sign-up domain while all Seats are taken.

Channel guests¶

Channel guests lists Slack and Teams guests who hold a Seat: people outside your organization's member list who use an Analyst through a Slack or Teams integration. A guest takes a Seat the first time they interact. If no Seat is free, they're told the organization has reached its seat limit and their question isn't answered.

To free a guest's Seat, click Release and confirm. They take a Seat again the next time they interact, if one is free.

When usage is available for your organization, Settings → Administration → Usage also shows a Seats row. See Billing & Usage.