Roles
Every person in a workspace is an Owner, an Admin, or a User. See what each role can do and who can change whose role.
A workspace has three roles, from most to least access: Owner, Admin, and User. Everyone who signs in gets one, and you can see and change them under Workspace settings › Members.
What each role can do
| Role | What it’s for |
|---|---|
| Owner | Runs the workspace. There is exactly one, and nobody else can change their role. |
| Admin | Sees and changes anything in Workspace settings, and can step into any session. A workspace can have as many as it needs. |
| User | Starts and runs their own sessions, and sees what the team shares. |
Admins hold Billing and Usage by role, and the Audit log needs a grant. See Delegated access.
What only the Owner can do
An Admin can change almost everything in Workspace settings. These stay with the Owner because they change who controls the workspace:
- Take the Admin role away from someone.
- Offer ownership to another member. See General.
- Turn single sign-on on or off, require it on a domain, or let a domain capture new sign-ups.
- Generate, rotate, or revoke the SCIM token. See Single sign-on and SCIM.
- Add, change, or delete a group rule that gives Admin. See Give roles from your provider’s groups.
- Switch the workspace between Pro and Enterprise.
- Download a copy of the workspace from Settings › Workspaces.
Who can change whose role
| Who changes it | Whose role they can change |
|---|---|
| Owner | Admins and Users. |
| Admin | Users, but not other Admins. |
| User | Nobody’s. |
An Admin can make a User an Admin, but only the Owner can take the Admin role away again. An Admin can’t change their own role either.
When your identity provider’s group rules set someone’s role, the role shows a lock on Members and nobody can change it there. Change the person’s groups in your provider, or change the rule.
Nobody can make someone else the Owner by changing a role, and the Owner’s role can’t be changed at all. To hand the workspace to another person, the Owner transfers ownership.
Change someone’s role
-
Open Members
Go to Workspace settings › Members.
-
Choose the role
Select the role badge next to the person and pick the new role.
-
Confirm
Evergreen asks you to confirm the change.
The change is recorded in the audit log and takes effect straight away.
Admins and private sessions
An Admin can read any session that isn’t private, and can step in to answer it, message the agent, or bring someone in. The session’s participants can see that they stepped in.
A private session opens only to the people given access. An Admin who needs to see one chooses Step in, picks how long to stay, and writes a reason. The session’s owner is told who stepped in and why, and the reason is kept in the session’s history and the audit log.
Warning
When the Owner takes the Admin role away from someone, they lose Workspace settings and everything else only Admins see, and any session they’ve stepped into stops streaming to them.
Last updated