# Invite your team

Invite people to your Tracix organization with a role, track and cancel pending invites, and give each person access to the workspaces they need.

Bring people into your organization with an invite, then give them access to the workspaces they need. You need the Owner or Admin role to invite people and to manage workspace access.

## How access works

Access has two layers:

| Layer        | Roles                          | Where you set it                         |
| ------------ | ------------------------------ | ---------------------------------------- |
| Organization | Admin, Member or a custom role | Console, **Team**                        |
| Workspace    | Admin, Editor or Viewer        | Console, each workspace's **Access** tab |

The organization role decides what someone can do in the console. The workspace role decides what they can do inside one workspace. Nobody can open a workspace until they're added to it, organization Admins included; the person who creates a workspace is added as its Admin. [Users and roles](https://tracix.io/docs/admin/users-and-roles) explains every role.

## Invite people

**1. Open the invite form**

In the console, open **Team** and select **Invite member**.

**2. Enter an email address and a role**

Enter the person's **Email address** and choose a **Role**:

* **Admin**: full administration of the organization: members, workspaces, settings and billing.
* **Member**: sees the organization's workspaces in the console. What they can do inside a workspace depends on their workspace role.
* A custom role, if your organization has created any.

Select **Send invite**.

**3. They accept the invite**

They get an email with a link to join. They sign in, or create an account, with the email address you invited, and select **Accept Invite**. Invites expire after 72 hours.

**4. Give them access to workspaces**

For each workspace they need, open the workspace in the console and select the **Access** tab. Select **Add member**, pick the person, choose **Admin**, **Editor** or **Viewer**, and select **Grant access**.

## Track and cancel invites

The **Pending invites** tab on **Team** lists each outstanding invite with its email address, role and the `invited` status. Expired invites drop off the list; send a new invite to try again.

To cancel an invite before it's accepted, select the trash icon on its row and confirm **Cancel invite**. The link in the email stops working.

## Change what someone can do

* **Workspace role**: on the workspace's **Access** tab, choose a new role from the menu on the person's row. To take away access to one workspace, select the remove icon and confirm **Revoke**; they stay in the organization.
* **Organization role**: the **Team** page shows each member's role but can't change it yet. Today, remove the member and invite them again with the new role. If you use single sign-on, group mappings set the role at each sign-in instead.

## Remove someone

On the **Members** tab of **Team**, select the trash icon on the person's row and confirm **Remove**. They lose access to the organization and all its workspaces, and their pending invites and workspace access are revoked. To bring them back, invite them again. To remove several people at once, select the checkboxes on their rows and choose **Remove** in the bar that appears.

You can't remove yourself or the organization's Owner.

## Other ways to add people

* **Single sign-on**: people with an email address at your verified domain can sign in through your identity provider without an invite. Tracix creates their account with the role your SSO settings give them. See [Single sign-on](https://tracix.io/docs/admin/sso).
* **SCIM**: your identity provider creates and deactivates accounts for you. See [Provision users with SCIM](https://tracix.io/docs/admin/scim).

Either way, add people to workspaces on the **Access** tab.

## Next steps

- [Users and roles](https://tracix.io/docs/admin/users-and-roles): Organization, workspace and custom roles

- [Require MFA](https://tracix.io/docs/admin/mfa): Make every member use an authenticator app

- [Set up single sign-on](https://tracix.io/docs/admin/sso): Sign in through your identity provider