Members and roles
Add the people who will use your apps as workspace members. Choose a role based on whether each person uses apps, builds and updates them, or manages members and workspace settings.
Users must be members to access apps. The apps they can use depend on the app permissions assigned to their groups.
Choose App User for people who only use apps, and Developer for people who build and update them. Choose Admin for people who manage members and workspace settings, or Owner for people who also handle billing and manage other Owners.
| Role | Main responsibilities and capabilities |
|---|---|
| Owner | Responsible for the workspace. Manages members, including other Owners, settings, and billing |
| Admin | Manages members other than Owners, and workspace settings |
| Developer | Builds, deploys, and updates apps. Cannot manage members or change workspace settings |
| App User | Uses apps they have permission to view. Does not perform management operations in the console |
Owners, Admins, and Developers count toward the plan’s Developers seats, the allowance for people who build and manage apps. App Users do not count toward this allowance, and their number is unlimited. See Plans and Limits.
Owners and Admins can change roles on the Members page. Only an Owner can assign or change the Owner role. Every workspace must have at least one Owner.
How members join
Section titled “How members join”| Method | How membership starts |
|---|---|
| Invitation | An Owner or Admin invites an email address. The recipient opens the link and accepts the invitation |
| Join URL | Someone with an allowed email domain opens the URL and signs in to join. No administrator approval is needed |
| Find a workspace and request to join (Discover) | Someone with an allowed email domain submits a request, which an Owner or Admin approves |
If someone has a valid invitation, signing in with the invited email address and opening an app may also accept the invitation automatically. An Owner or Admin can check the Members page to confirm they have joined.
An email domain is the part after @ in an email address. Allowing your company’s domain lets people with those addresses use the join URL or Discover. See Domains and Join Policies for setup (Team plan and above). Members who join through domain-based joining receive the App User role.
Disable a member
Section titled “Disable a member”To stop someone’s access to all apps in the workspace, for example when they leave the company, an Owner or Admin can select Deactivate on the Members page. To change only which apps they can use, for example after a department transfer, update their groups or app permissions.
- Access checks may take time to reflect the change. Saving it does not necessarily stop all access immediately.
- Disabling does not delete the account. Select Reactivate to restore access.
- You cannot disable yourself or the last Owner. Admins cannot disable Owners.
How roles relate to app permissions
Section titled “How roles relate to app permissions”Members automatically belong to the following groups based on their role. These are called system groups, and their membership cannot be edited manually.
| Role | Automatic group membership |
|---|---|
| Owner | owners developers everyone |
| Admin | admins developers everyone |
| Developer | developers everyone |
| App User | everyone |
New apps grant view permission to everyone (all members) and manage permission to developers (Owners, Admins, and Developers). Manage permission includes view permission.
These group assignments determine who can use and manage an app. Changing a role also changes automatic group membership, which can affect app access. To limit an app to a specific team, see Share an App with Your Team.
Troubleshooting access
Section titled “Troubleshooting access”First, check that you are signed in with the email address that was invited or registered. Ask an Owner or Admin to check your membership status, and someone who manages the app to check your app permissions.
- Are you signed in with the registered account? If you use several Google or Microsoft accounts, check the email address.
- Have you joined the workspace? Check the Members page. If membership is not complete, ask the person to open and accept a valid invitation link.
- Has the member been disabled? Check Deactivated on the Members page.
- Does the member have view or manage permission? Open the app’s Permissions tab and check the assignments for their groups.
- Are IP restrictions blocking access? The denial page shows the IP address the user is connecting from. See IP Restrictions for where these restrictions apply.