> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/configuration/account-and-teams.md).

# Account & Teams

Use your tenant's settings to manage members, roles, and teams. Sign-in identity, tenant membership, source-control installation access, and service-account tokens are related but separate records.

## Members and roles

An authorized administrator can add users and manage role assignments through the supported member/access screens and Admin API. Use the destination provider's account identity rather than a display name alone. The current access API exposes `/admin/access/me`, `/admin/access/users`, and `/admin/access/users/roles` for effective access and role updates.

Role updates protect against removing the last administrator and self-promotion. A successful identity-provider login does not independently grant access to every Nullify tenant. See [API authentication](/api-reference/api-reference/authentication.md) for the current role-enforcement rollout and service-account lifetime limitations.

An existing GitHub member can have a stored role without activated platform access. A role update does not activate that member or link their Microsoft identity. Before Microsoft sign-in, use **Vault → Access → Roles → Activate access** with an authorized identity administrator, then have the member link their own Microsoft account, or reconcile the approved identity through SCIM. Follow [member activation and linking](/configuration/account-and-teams/entra-sso-and-scim.md#activate-existing-members-before-linking) and verify actual sign-in.

## Teams and ownership

Teams can come from connected providers or be created through `/admin/teams`. The platform also supports merging duplicate teams across providers and deriving team mappings from configured repository property keys. Review source preferences and synchronization results before changing an established ownership map.

Configure each team's lead, membership, ticket destination, and ground rules where available. A team can provide routing and a confirmed security owner; it is not automatically the same thing as a source-control permission group. Changes to team mappings can affect future ticket and escalation routing.

## Data requests and usage

For a user's data export or erasure, follow [Data Subject Requests](/api-reference/api-reference/api-admin.md#data-subject-requests). Erasure is separate from disabling sign-in or deleting a service-account record.

Use the [AI Usage API](/api-reference/api-reference/usage.md) for ledger, aggregate, and time-series data. Usage visibility does not grant permission to change billing terms.

## Identity and dashboard access

**Settings → Identity** contains the supported Microsoft Entra binding and SCIM credential workflows, with administrative controls separated from a member's own Microsoft account-linking action. Connecting a cloud subscription, connecting Azure DevOps, and linking a sign-in identity are different operations. See [Microsoft Entra ID SSO and SCIM](/configuration/account-and-teams/entra-sso-and-scim.md) for setup.

Human membership and roles are managed through the access screens/API; service-account automation lives under **Settings → API access**. The General organization-profile form is not a substitute for access management. Check the effective `/admin/access/me` response when a screen or action is unavailable.

For governed access, use [Entra group-to-role provisioning](/configuration/account-and-teams/entra-group-role-provisioning.md) and the [LIAM/Saviynt SCIM contract](/configuration/account-and-teams/saviynt-scim.md). Group assignments do not automatically change stored Nullify roles. Before requiring Microsoft sign-in, verify two approved administrators and the [activation and recovery procedure](/configuration/account-and-teams/entra-sso-and-scim.md#require-microsoft-sign-in). Configure and test [workspace network restrictions](/configuration/account-and-teams/entra-sso-and-scim.md#network-restrictions) separately.