---
title: People and access
display: '*People* and access'
nav_title: People and access
summary:
  - "Invite people with their organization role and projects in one step, and change or remove access later."
  - "Know how single sign-on works with your identity provider, and what stays in Scenario."
  - "Give an agency or freelancer one project, with its own limits, models and visibility."
description: Invite people with the right roles, sign them in with SSO, give partners one project, and remove access cleanly.
section: teams
order: 2
type: tutorial
level: Scale
roles: [admin]
time: { read: 2 }
models_checked: []
last_verified: 2026-11-11
# a lesson that points to its articles: their PDFs, not one of this page
pdf: false
video_caption: People and access
film_first: true
about: "Bring people in from Members: invite several at once with a role and their projects, change roles in the organization or one project, and remove people and their API keys. Then single sign-on, which Scenario turns on for you, and partners in a project of their own. The models and settings in this lesson are as of November 2026."
chapters:
  - { at: 0, title: "In this lesson", image: "/media/images/teams/people-and-access/ch-01-in-this-lesson.webp" }
  - { at: 18, title: "Invite", image: "/media/images/teams/people-and-access/ch-02-invite.webp" }
  - { at: 47.5, title: "Change and remove", image: "/media/images/teams/people-and-access/ch-03-change-and-remove.webp" }
  - { at: 81.2, title: "Single sign-on", image: "/media/images/teams/people-and-access/ch-04-single-sign-on.webp" }
  - { at: 117, title: "Partners", image: "/media/images/teams/people-and-access/ch-05-partners.webp" }
articles: [people-and-access]
related: []
thumb: teams/people-and-access/thumb.webp
video: tutorials/people-and-access.mp4
steps:
  - title: "Open Members and click Invite Members"
    text: "Pill › the gear next to the organization › Members › Invite Members, then type the emails separated by commas. For a long list, use Import CSV with the addresses on one line separated by semicolons."
  - title: "Choose their organization role"
    text: "Open Select role and choose Admin or Member. Most people are Members; keep Admin for the few who run billing, members, settings and models."
  - title: "Pick their projects and send"
    text: "Open Assign to projects and tick the projects they'll join, with Search or Select All. Click Send 2 Invitations (the number follows the addresses you added)."
  - title: "Change a role in one project"
    text: "Project › Members: add someone already in the organization with Invite a user to this project (it starts on Contributor) and Add. Change anyone's role for this project only in the Role column."
  - title: "Make someone an admin"
    text: "Change their role in the Role column of Organization › Members. To hand over, promote the new admin first, then change your own role."
  - title: "Remove someone who leaves"
    text: "In Organization › Members, the row's ... menu › Remove from organization. Then in Organization › API Keys, find their keys by Created by and delete or rotate them: keys keep working until you do."
  - title: "Turn on single sign-on"
    text: "On Enterprise, contact your account manager: Scenario turns SAML 2.0 SSO on for you. Set up Scenario in your identity provider with the default project ID, test with one admin and one member, then tell the team the date."
  - title: "Give a partner a project of their own"
    text: "Create a project with the + in the Projects column, invite them as a Member with only that project, and make them Contributor or Viewer. Set a cap under Project › Usage limit, the agreed models under Project › Models and, if it fits, Project › Visibility › Solo."
  - title: "Close the job"
    text: "Remove their people and their keys, then open Organization › Activity Trail and filter by date range and Projects to check what they made and deleted."
agent_steps:
  - title: "Connect the Scenario MCP as an admin"
    text: "Connect your agent with OAuth (not an API key, which can't do team admin actions) and sign in as an organization Admin at [mcp.scenario.com](https://mcp.scenario.com). Single sign-on, seats, a partner project's usage limit, models and Solo visibility stay in the web app."
  - title: "Brief the agent: invite people"
    prompt: |-
      Using the Scenario MCP, in the team [team]: find the members tools with scenario_tools_search. Invite these people as Members: [emails]. Add them to the project [project] as Contributors. Show me the full list of changes first and wait for my go. Then list the organization and project members and report each person's roles and whether their invitation is pending.
  - title: "Change roles"
    prompt: |-
      In the project [project], make [email] a Viewer, and make [email] an organization Admin. Show me each change first and wait for my go; then list the members with their roles again.
  - title: "Remove someone who leaves"
    prompt: |-
      Remove [email] from the organization. Then find the API key tools with scenario_tools_search, list every project's API keys with their creator and last use, and show me the ones [email] created. Don't delete any key until I confirm each one: deleting a key can't be undone.
  - title: "Check and report"
    text: "Accept when each person has exactly the roles and projects you asked for and a leaver has no access and no live key. Reject a partner added to your main project, or an Admin role nobody asked for."
updated: 2026-11-11
canonical: https://learn.scenario.com/teams/people-and-access
---

Last updated: 2026-11-11

# People and access

> Invite people with the right roles, sign them in with SSO, give partners one project, and remove access cleanly.

In short:

- Invite people with their organization role and projects in one step, and change or remove access later.
- Know how single sign-on works with your identity provider, and what stays in Scenario.
- Give an agency or freelancer one project, with its own limits, models and visibility.


Now bring people in. This lesson invites your team into the Starforge Games organization with the right role and projects, changes roles and removes people, sets up single sign-on, and gives partners access to their own work and nothing else. Almost all of it can also be done through the Scenario MCP; here it is done by hand in the web app.

:::note As of November 2026
The models, settings and screens in this article are the ones Scenario offered in November 2026. New models and updates arrive often, so check the app for newer options before you choose.
:::

:::steps Quick version
1. Open **Settings** › **Organization** › **Members** and click **Invite Members**.
2. Add their emails, choose **Admin** or **Member** and pick their projects, then send the invitations.
3. Change project roles under **Project** › **Members**; remove leavers in **Organization** › **Members** and delete their API keys.
4. For single sign-on, ask Scenario to turn it on, set it up in your identity provider and test it.
5. Give each partner a project of their own, with a spend cap, agreed models and, if it fits, **Solo** visibility.
:::

## Before you start

- **You need to be an organization Admin** to invite people, change organization roles and manage API keys. A project **Owner** can manage the members of that project.
- **Every person has two roles**: one in the organization (**Admin** or **Member**) and one in each project they join (**Owner**, **Contributor** or **Viewer**). [Set up your workspace](https://learn.scenario.com/teams/set-up-your-workspace.md) explains them.
- **Seats.** **Organization** › **Members** shows how many seats are used and available. If you need more, an Admin adds them under **Organization** › **Billing**.
- **Single sign-on is an Enterprise feature**, and so is the **Solo** project visibility used for partners.

## Step 1: Open Members and click Invite Members

Everything about your people starts in **Members**, under **Organization**: open the pill at the top left, click the gear next to the organization, then **Members**. This is where you add users. Click **Invite Members**.

**Invite Members to Your Organization** opens. Type their email addresses in **Enter email address**, separated by commas; each one becomes a chip you can remove with its **x**. For a long list, use **Import CSV** on the Members page instead, with the addresses in one line separated by semicolons (`email1;email2;...`).

![Invite Members to Your Organization with two addresses added, Select role, Assign to projects and the Send 2 Invitations button](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/5419fb589a15afa9fe27ce6b2bf0aa6aeae892b0acd2eadd8e9b1c39379d9bec.webp)

## Step 2: Choose their organization role

Open **Select role** and choose **Admin** or **Member**. Most people are Members: they work in the projects they're added to and see nothing else. Keep Admin for the few people who run billing, members, settings and models.

![The Select role menu open on Admin and Member, with Member ticked](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/6cf7a540234ffd3101d4e060b23d2af53a24473a0dc51bb1ac0cc38e5a4194c9.webp)

## Step 3: Pick their projects and send

Open **Assign to projects** and tick the projects they'll join, so they land in the right place on day one. Type in **Search** to find a project, or use **Select All**. The button then shows how many you picked, for example **Projects (1)**.

Click **Send 2 Invitations** (the number follows how many addresses you added). Each person gets an email to accept.

![The Assign to projects list open with Search, Select All and the organization's projects](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/9c40aa2f9c1f4db3b7a15f97a78dbdfc2f84fb1262e59a68a615c865319d3a3b.webp)

## Step 4: Change a role in one project

Each project has its own members, under **Project** › **Members**. Here you can:

- **Add someone** who is already in the organization: type their email in **Invite a user to this project**, pick a role (it starts on **Contributor**) and click **Add**.
- **Change anyone's role for this project only**, right on their row, in the **Role** column.

The **Role** filter above the list shows only the **Owner**, **Contributor** or **Viewer** rows when the project is large.

![Project › Members for Tour Demo: Invite a user to this project, the Contributor role picker, Add, and the member list](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/9c15ad726beec0b839bbb159db0e64984f98f0379bfd7b7220b153c1b8e443a4.webp)

## Step 5: Make someone an admin

To make someone an admin, change their role in the organization's **Members**, in the **Role** column of their row. There's always at least one admin, so to hand over, promote the new admin first, then change your own role.

![Organization › Members with each person's usage and role, Admin or Member](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/5d628af988d61a5e77265e296b4b752649949afef079d4b7994d424985f85bf0.webp)

## Step 6: Remove someone who leaves

When someone leaves, open the **...** menu at the end of their row and choose **Remove from organization**. They lose access to the organization and every project at once.

![The row menu open on Remove from organization](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/a1c63e72436a40cc8c8f1a1b0311d6a41405c1ef2c183329ab002b8978de941f.webp)

Then go to **Organization** › **API Keys** and delete or rotate any key they used. Keys aren't tied to a login, so they keep working until you do. The list shows each key's **Project**, **Role**, **Created by**, **Last used** and **Usage**, so you can find their keys by creator. The bin icon deletes a key; it's immediate and can't be undone.

![Organization › API Keys: two project keys with their creator, last use and usage, and the edit and delete icons](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/6efa9c057625aadc6754090973dbead3a6696e98e7a340b66f69b9c1b1918816.webp)

## Step 7: Turn on single sign-on

On Enterprise, your team can sign in with their company account through single sign-on (SSO). It uses SAML 2.0, and works with Okta, Microsoft Entra ID, Google Workspace, OneLogin and most other providers that support SAML.

It isn't a switch in Settings: Scenario turns it on for you. Contact your account manager, then:

1. **Set up Scenario in your identity provider.** You need admin access to your provider and to Scenario, and the ID of the default project new users land in.
2. **Test it** with one admin and one member before anyone else.
3. **Tell the team the date.** From then on, members are redirected to your provider's sign-in page. Their projects, models and assets stay as they were.

Admins keep password sign-in as a fallback for troubleshooting; members must use SSO. The full guide is in the Help Center under **SSO and SAML Setup**.

Sign-in moves to your provider, but membership and API keys stay in Scenario. Automatic provisioning (SCIM) isn't available yet, so when someone leaves:

1. Unassign them in your provider.
2. Remove them in **Members**.
3. Delete their keys.

## Step 8: Give a partner a project of their own

Agencies and freelancers get a project of their own. Members see every project they're added to, so never add a partner to your main one.

1. **Create a project for the job** with the **+** at the top of the **Projects** column in the pill.
2. **Invite them as a Member** with only that project (Step 1 to Step 3).
3. **Set their project role:** **Contributor** if they'll make things, **Viewer** if they'll only review.
4. **Set the project's limits:** a spend cap under **Project** › **Usage limit**, and only the models agreed for the job under **Project** › **Models**.

If it fits your needs, open **Project** › **Visibility** and switch from **Collaborative** to **Solo**: for example, when several freelancers share one project, or for private or sensitive work. Each person sees only their own work, while admins still see everything.

| Visibility | Who sees what | Use it for |
|---|---|---|
| **Collaborative** (default) | Everyone can view and reuse all project assets | Open collaboration and shared creativity |
| **Solo** (Enterprise) | Creators see only their own assets; admins see all | Several partners in one project, private or sensitive work |

![Project › Visibility for Tour Demo, with Collaborative selected and Solo next to it](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/2e72a78307be5899af3dd34f668d6426f09847b4ee7f02a21c5c544e05a36fe7.webp)

## Step 9: Close the job

When the job ends, remove their people and their keys, then open **Organization** › **Activity Trail** to check what they made and deleted. Filter it by date range, by **Projects** and by type of activity, or search it.

![Organization › Activity Trail: who generated what, with which model, and when](https://ufgc0c9mhl4ueq76.public.blob.vercel-storage.com/academy/512491094645078fe338b81dd4c593b731e1b4740e430c32b3e6f5bca2d7e645.webp)

## Roles at a glance

| Level | Role | Can |
|---|---|---|
| Organization | **Admin** | Billing, members, organization settings, models, projects; promote and remove people |
| Organization | **Member** | Join projects; no organization settings |
| Project | **Owner** | Manage the project's members and settings, see its analytics, delete it |
| Project | **Contributor** | Generate, train, import and edit assets |
| Project | **Viewer** | View the project and its assets only |

Give people the least access they need, and review organization and project members on a regular schedule.

## Common problems

| What you see | What to do |
|---|---|
| An invited person sees no projects | Add them to a project under **Project** › **Members**, or pick projects when you invite |
| You can't invite more people | All seats are used; an Admin adds seats under **Organization** › **Billing** |
| You can't change your own Admin role | There must be one admin; promote someone else first |
| A former teammate's integration still runs | Their API key is still active; delete it under **Organization** › **API Keys** |
| A partner sees other partners' work | Switch the project to **Solo**, or give each partner their own project |
| A partner sees your main project | They were added to it; remove them from that project's **Members** |
| SSO users land in the wrong project | Check the default project ID set up with Scenario |

## What's next

Your team is in, with the right roles. Next, [Model access](https://learn.scenario.com/teams/model-access.md) chooses which models your team can use, per organization and per project, and connects your own provider keys.

Source: https://learn.scenario.com/teams/people-and-access