Grant admin rights

Elevated access is scoped and time-boxed by default. Every grant is recorded in the audit log.

Who

Admin rights can only be granted to an existing, active account

User

Clara Lindqvist

Member · Marketing · joined Feb 24, 2025

MFA enrolled — meets the admin prerequisite

What

Pick the narrowest role that covers the work

Team AdminManage members, roles, and groups within a single team. Cannot touch billing or workspace settings. User AdminCreate, suspend, and deprovision accounts workspace-wide. Cannot change roles above Manager. Billing AdminManage plans, payment methods, and invoices. No access to user data. Security AdminSet authentication policy, review risk, and revoke sessions. Cannot grant admin rights. Owner Unrestricted. Can delete the workspace and remove other owners. Requires approval from a second owner.

Where and how long

Scope and expiry keep standing privilege from accumulating

Scope

Expires

Justification

Shown to reviewers during the next access recertification.

Cancel

Resulting permissions

Team Admin, scoped to Marketing

Invite and remove Marketing members
Assign roles up to Manager
Manage Marketing groups
View the Marketing audit trail
Billing and payment methods
Workspace security policy
Granting admin rights to others

Marketing already has 1 admin

Beatriz Correia holds Team Admin for this scope. Two admins on a six-person team is worth a second look.

Least privilege

Grants expire at the next access review by default. Reviewers see the justification and the account's admin activity since the grant, and can renew or revoke in one action.

Compare role permissions