> For the complete documentation index, see [llms.txt](https://docs.warp.dev/llms.txt). > Markdown versions of each page are available by appending .md to any URL. # Workspaces for Enterprise teams Workspaces group teams under one Enterprise account with shared membership, billing, SSO, and company-wide settings. A workspace groups one or more teams under a single Enterprise account. Workspace admins manage membership, billing, and company-wide policies across those teams. Single Sign-On (SSO) is configured at the workspace level. ## Workspaces and teams A workspace provides company-wide administration, while teams organize shared resources and team-level settings. - **Workspace level** - Billing, SSO, domain capture, and organization-wide policies apply across teams. - **Team level** - Members share Warp Drive resources, cloud agent runs, environments, and secrets. - **Membership** - A user belongs to one workspace and can belong to multiple teams within it. ## Workspace roles Every workspace member has one of three roles: - **Member** - Uses Warp within their teams and the policies admins configure. - **Admin** - Manages workspace membership, billing, settings, and every team, including teams they don’t belong to. Workspace admins have admin-level permissions on every team; team admins who aren’t workspace admins have admin permissions only on their teams. - **Owner** - Has every admin capability and can transfer ownership to another member. Each workspace has one owner. In team member lists, the **Workspace admin** and **Workspace owner** badges distinguish workspace roles from team roles. ## Workspace admin permissions Workspace admins can: - **Manage members** - View everyone in the workspace, promote members to Admin, demote admins, and remove members or other admins. Removing a member also removes them from every team in the workspace. - **Manage invitations** - Send email invites, and enable, disable, or reset the workspace invite link and its approved email domains. See [Joining a workspace or team](#joining-a-workspace-or-team). ## Teams inside a workspace Workspace admins create teams from the Admin Panel and choose a visibility: - **Open** - Any workspace member can see the team and join it immediately. - **Hidden** - The team doesn’t appear in team discovery; an admin adds members directly. Workspace admins can also manage every team’s membership and settings. ## Joining a workspace or team Workspace admins add users through invitations or domain capture: - **Workspace invite links** - Add a user to the workspace and let them choose an Open team. - **Team invite links** - Add a user to an Open team and its workspace. - **Email invites** - Add a user directly to a workspace or team. Admins add users to Hidden teams this way. - **Domain capture** - Automatically adds users who sign up with a verified company domain. - **Team discovery** - Shows Open teams to unassigned users in the Warp app under **Settings** > **Teams**. ## Unassigned users An unassigned user belongs to the workspace but not to a team. Workspace admins can manage unassigned users and set a separate per-user spend limit for them in the Admin Panel. Unassigned users cannot start cloud agent or factory runs until they join a team. Workspace-level billing and policies still apply to them. ## Cloud agent run visibility Workspace admins can view and manage each team-owned cloud agent run in the workspace, including runs that members of other teams started. Their access matches members of the team that owns the run. Workspace and team roles don’t grant access to runs owned by an individual user. Only the user who owns a run can access it by default, though the owner can choose to [share the session](https://docs.warp.dev/platform/viewing-cloud-agent-runs/). Other members can access their own runs and runs owned by their teams. ## Changing workspace roles In the Warp app, open the [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/), click **Members**, then use the three-dots menu on a member’s row to promote, demote, remove, or transfer ownership. - **Roles are additive** - Changing a workspace role never changes a member’s team roles. An admin who is demoted loses workspace admin access immediately but keeps any team admin role they already had. - **Only the owner transfers ownership** - The previous owner becomes an Admin. - **The owner stays in place** - Admins can’t remove the owner or change the owner’s role. To step down, the owner transfers ownership first. - **Leaving a workspace** - Members can’t leave an Enterprise workspace themselves. A workspace admin removes them instead. ## Workspace settings and team settings Workspace admins configure company-wide policies in the [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/). For supported settings, they can enforce a value across the workspace or select **Respect Team Setting** to let each team decide. SSO and domain capture apply at the workspace level. When a workspace admin enforces a setting, team admins see it as locked. ## Workspace spend limits Workspace admins can set monthly limits for total, local agent, and cloud agent spending. They can also set a separate per-user limit for unassigned users. Team and individual limits remain independent, and the first applicable limit reached blocks further usage within its scope. ## Related pages - [Team management](https://docs.warp.dev/enterprise/team-management/teams/) - Create and manage teams - [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/) - Configure settings enforced across a workspace or team - [Roles and permissions](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/) - Team-level roles and what each can do - [Single Sign-On (SSO)](https://docs.warp.dev/enterprise/security-and-compliance/sso/) - Configure authentication for a workspace - [Enterprise billing](https://docs.warp.dev/enterprise/support-and-resources/billing/) - Credit pools, spend limits, and billing management