Roles
Every member has one of three roles:Add people
Select Invite people on the People page to add teammates as admins or members, and Passport emails each an invite. Have a list? Choose Import a CSV in the same dialog to paste one person per line (name, email, title, team), and Invite by email instead to go back. On Enterprise, Or sync from your directory opens SCIM provisioning in Settings. Invited people sit at the top of the list until they accept, with Resend beside each one and Revoke invite in its menu. You can also copy your workspace sign-in link and share it directly. A person’s team is stored as their department; assign it when you add them or change it later. Activity export filters use the query parameter department for that team name.
Needs attention, at the top of the list, shows join requests to review and anyone who joined more than a day ago but hasn’t connected an agent, with their sign-in link one click away. App requests stay in Approvals.
Adoption shows the rollout in three steps: Joined, Connected an agent, and Used a tool, each as a bar with “N of M people” against everyone in the rollout, invites included. Select a step to open the People list narrowed to who hasn’t reached it yet; clear the filter with its chip.
Once the workspace has ten or more people, search the list and filter it by team, role, or status (Active, Invited, or Deactivated). The list shows active and invited people by default. Each row’s menu changes the person’s team or role, copies the sign-in link, signs them out everywhere, or deactivates them. Each of those asks first.
Open a person for their own page. Overview shows how far their setup got and what comes next, their job title, team, and role (each saved as soon as you change it), their connected apps and agents, and Security and account actions. Their Activity tab is the audit trail for that person, with its own CSV export.
Manage teams
Teams live alongside People. Each team row shows how many people it has, how many apps it can use, the team setup that reaches it, and its approval rules. Open a team to add or remove people, review what the team gets on Access (each part links to where it’s edited), and see its published setups on Setup. The team’s menu views its activity, renames it, or deletes it. Renaming a team carries its access rules forward. Deleting one asks where its people should move before removing the team’s shared rules.Who can join
Free and Pro workspaces stay invite-only: only invited members can sign in. Domain join and domain discovery are Enterprise controls under workspace Settings. On Pro, Settings names them with an Enterprise badge in place of the controls. On Enterprise, joining defaults to invite-only. You can instead allow anyone who verifies an email on a company domain to join as a member (a Slack-style domain policy), and optionally make the workspace discoverable to teammates on those domains. You control this and the list of allowed domains in Settings.Consumer and disposable email domains never trigger domain join or domain discovery, so shared providers like
gmail.com can never be used to walk into your workspace.
Deactivate and reactivate
Deactivating a member immediately signs them out everywhere and revokes their connected-account grants, so nothing sits at rest or re-arms later. Reactivating restores access; they reconnect their own accounts. Sign-in attempts by a deactivated member are recorded in the audit trail as a security signal.The same lifecycle runs through SCIM. Deprovisioning a user in your IdP does exactly this, and Passport refuses to
remove the last active admin. See SCIM.
Automation credentials
Connect Claude Code, Codex, Cursor, and other supported agents from Agents. There is no separate managed-agent identity setup. For scripts and CI, owners and admins open Agents → Automations on every plan. A credential authenticates Passport CLI with its own access, or with access narrowed by a delegated person’s permissions. It is shown once, can be rotated in place, and can be revoked from the same dialog. A credential belongs to the person who created it: their Safety choices govern its agent, and deactivating them revokes it. See Agent keys, their owners, and rotation. Passport CLI accepts the credential throughPASSPORT_AGENT_KEY and the workspace endpoint through PASSPORT_ENDPOINT. Store these in your CI secret store. This mode works without interactive sign-in and writes no local credential file. See Passport CLI.