Before you start
- What goes in
- The correct signed-in account; team administration permissions for membership and security settings.
- What comes out
- An account with the intended plan, workspace members and access configuration.
A practical example
A designer and a reviewer
Invite the colleague who needs to work on projects with the appropriate member role, and choose a viewer role when the person only needs the access that role provides. Check the role and seat explanation before sending an invitation.
Step-by-step walkthrough
Check the signed-in identity
Open Account and confirm the account before troubleshooting a missing plan or project. The account that purchased a plan and the account currently in the editor must be the intended ones.
Review the current entitlement
Read the plan and billing controls. Presentation exports, production exports, assistant access and team features have different availability. Use the current Account, Pricing and Download explanations for the exact entitlement.
Open the team workspace
In Your team, review members, pending invitations and available places. Owners and permitted admins can invite people; available roles and actions depend on the current user’s role.
Invite and confirm delivery
Enter the intended email addresses and select the role. Review the result: an invitation can exist even if its email was not delivered. Use the provided link if needed. Pending invitations reserve the relevant seat or viewer place.
Review membership and seats
Manage pending invites and member roles using the controls available to you. Check the confirmation and billing effect before changing the seat count.
Configure SSO in the guided order
An authorised administrator should verify the email domain, configure the identity provider, save metadata or settings, test a sign-in and then enable SSO. Require SSO and automatic joining are separate choices made after the basic connection works.
Options at a glance
| Control or choice | What it changes | How to use it well |
|---|---|---|
| Plan and billing | The account’s current subscription and available billing actions. | Use the live account page for current pricing, renewal and upgrade details. |
| Owner / admin / member / viewer | Workspace roles with different permitted actions. | Choose the least access that fits the colleague’s job and read the actual role description. |
| Pending invitations | Invites awaiting acceptance, with delivery and expiry state. | Inspect the recipient and role; resend or revoke an obsolete invite as appropriate. |
| Seats | The licensed workspace capacity shown by the account. | Existing members and pending invitations can affect available capacity. |
| Verified domains / SSO | Domain ownership and identity-provider configuration. | Use the workspace-specific TXT record, ACS/redirect URL and entity ID shown in the account guide. |
| Require SSO / automatic joining | Additional access policies after SSO is working. | Test sign-in first and plan how the team will access the workspace before enforcing a policy. |
Detailed control reference
Find the control, understand its effect, and choose it for the job you are making. Available controls depend on the selected structure, object, workspace and output.
Account, Pricing and Download explanations
Account identity, subscription and feature access
The signed-in identity determines available projects and entitlements. Production files, presentation exports, assistant and team features can have different plan requirements.
- When it helps most
- When a feature appears locked, first verify the email/account and the exact required entitlement shown by the live interface.
- Impact and trade-offs
- Do not assume a purchase under another identity grants this session access. Current pricing, limits and billing state should be read from Account rather than a static tutorial. Browser/device capability can separately limit a render option.
Account → Your team
Owner, admin, member and viewer roles
Roles determine which workspace and administration actions a person can perform. The member list and invitation form show the roles available to the current administrator.
- When it helps most
- Choose the role for the colleague’s work: administration, design work or permitted viewing. Review the current role description before inviting.
- Impact and trade-offs
- Role and licensed capacity are separate from an individual share-link password. A pending invite can reserve a place before acceptance. Review membership and billing effects when changing seats or roles.
Your team → Invite and pending invitations
Invitation address, role, delivery and pending state
Creates a role-specific invitation for the intended address. The creation result and email-delivery result can differ; the latest invitation link is the usable one.
- When it helps most
- Check the address, role and available capacity before sending. Use the pending list to distinguish a missing email from a failed creation.
- Impact and trade-offs
- Resending can invalidate an older link. Avoid duplicate invitations when one is already pending; revoke obsolete invites to release the relevant capacity and remove outdated access offers.
Team SSO setup
Verified domain and identity-provider settings
Domain verification proves control using the workspace’s specified DNS record. The provider configuration uses the exact callback/ACS, entity ID and metadata/settings shown by the app.
- When it helps most
- Have the authorised administrator follow the workspace-specific sequence, then test sign-in using the intended provider.
- Impact and trade-offs
- A generic example URL cannot substitute for the workspace’s values. Domain verification alone does not prove the identity-provider connection works. Keep the existing access route available until a successful test confirms the setup.
Team security settings after SSO configuration
Require SSO, automatic joining and audit information
Require SSO enforces the sign-in policy; automatic joining controls a separate membership behaviour. Audit information records relevant changes for authorised administrators.
- When it helps most
- Enable enforcement only after the configured sign-in path works. Decide automatic joining according to the intended domain/workspace membership.
- Impact and trade-offs
- These settings can alter how colleagues gain access. Review seat capacity and expected membership separately; a working identity connection does not automatically make every joining policy appropriate.
Understand invitation state before inviting again
Invitations appear in the recipient’s account and may also be emailed. Pending invitations hold their place until accepted, declined, revoked or expired. Resending can create a new invitation link and invalidate the previous one; share the latest link.
A missing invitation email does not necessarily mean creation failed. Read the delivery result and check the invitation list before generating duplicates.
Use the built-in identity-provider guide
SSO settings are specific to the workspace. The account provides the callback/ACS URL, entity ID and a setup guide. Use those exact values when configuring the identity provider, and import the correct metadata or save the required settings.
Team audit information can help authorised administrators understand membership and security changes. Review it when investigating an unexpected access change.
Check your work
- The intended account is signed in.
- The plan grants the required output or feature.
- Invitations use the correct addresses and roles.
- The seat count covers the intended membership.
- SSO has been tested before enforcement.
Troubleshooting
My paid feature still appears locked
Check the account identity, current plan and whether the specific feature belongs to that plan. Reload after the account state updates.
An invitation email did not arrive
Check the delivery result and pending invite. Copy the current invitation link or resend it if authorised.
SSO sign-in fails
Follow the workspace guide, check the domain and exact provider values and repeat the test before enabling enforcement.