Team management
Invite team members, manage roles and enforce single sign-on in your ChangeVault organization.
Roles
ChangeVault uses three roles:
| Role | Can log changes | Can manage org | Can view |
|---|---|---|---|
| Admin | ✓ | ✓ | ✓ |
| Member | ✓ | ✗ | ✓ |
| Reader | ✗ | ✗ | ✓ |
Inviting members
Inviting members requires the Team plan or higher.
- Go to Settings → Members
- Enter the email address of the person to invite
- Select their role (Admin, Member or Reader)
- Click Send invite
The invitee receives an email with a link to join your organization.
Readers
Readers can view the timeline, changes, services and hosts but cannot log or edit anything. They are ideal for:
- Stakeholders who need visibility without making changes
- On-call engineers during read-only periods
- Auditors
Readers are unlimited on all paid plans.
Leaving an organization
Go to Settings and scroll to Leave organization at the bottom. If you are the only admin, you must promote another member to admin first.
Enterprise SSO
On the Enterprise plan, admins can connect an identity provider (Microsoft Entra ID, Okta, Google Workspace or any SAML 2.0 IdP). Once configured:
- Users with a matching email domain are routed to your IdP automatically at sign-in
- New users are added to the organization on first sign-in — no individual invites needed
- Group → role mappings can automatically assign Admin, Member or Reader based on IdP group membership
See the Enterprise SSO guide for full setup instructions.