Give each person exactly the access they need
Groups give their members a role, custom roles and apps. Custom roles add single permissions, and Check access shows who can reach what, and why.
Groups
Your teams, each with owners who manage its members. A group can give its members a role, custom roles, apps, and write access to an app in Cloud or a repository in Git.
Built-in roles
Owner, admin, developer and viewer, with every permission each holds and who holds it, directly or through a group. Members get the higher of their own role and their groups'.
Custom roles
Named sets of permissions on top of a role: one for a helpdesk that reads the directory and invites people, or for an auditor who reads the audit log. Team, Complete and Enterprise include them.
Check access
Pick a person or a group, and an app or a permission. The answer is yes with the level, or no, with each layer in order, so the first no is where to change it.
Rules that keep access in hand
Owner-only changes
Changes to owners, the sign-in policy, exports and deleting the organisation are for owners themselves, never an admin, a key or Caity.
Nothing more than you hold
Nobody gives a role above their own, or puts a permission they don't hold into a custom role.
The last owner stays
The organisation's last owner can't be demoted, blocked or removed.
Applies within seconds
A demotion or a group change reaches open sessions and the person's keys within seconds.
One answer everywhere
Check access gives the answer every app, the API and Caity use.
Every change recorded
Every change in Tenant goes to the audit log, with refused attempts at owner-only changes.
Run your organisation's access in Tenant
Every Business plan includes it, for the owners and admins who look after your people and how they sign in.