Skip to content

Teams

Availability: all tiers ยท Admin-scoped

See the Tier & Scope Matrix for the full breakdown.

Teams let you divide an organization into sub-groups (e.g. by product line, business unit, or customer) and scope which cloud accounts, repositories, registries, clusters, or web apps each team can see and manage.

Where to find it

Go to Settings > Identity > Teams. The page lists every team in your organization with its member count and scope mappings.

Creating a team and adding members

  1. Click New Team and give it a name.
  2. Open the team and click Add Member. The member must already have signed in to the console at least once; you can't add someone who has never authenticated.
  3. Remove a member from the team roster at any time. This does not remove them from the organization itself.

Note: Team membership does not carry its own role. A member's organization-level role (from Settings > Admin > Organizations) still governs what they can do. Teams control scope (which resources are visible), not permissions.

Scoping resources to a team

Each team can be mapped to specific resources by kind, matching the categories on the Connections page:

Scope type What it restricts
cloud_account Which saved cloud connections the team can use
repository Which saved repository connections the team can use
registry Which saved container registry connections the team can use
k8s_cluster Which saved Kubernetes cluster connections the team can use
web_app Which saved web application connections the team can use

Add a scope mapping from the team's detail page by selecting a resource kind and one of your organization's saved connections.

IdP group mapping

If your organization signs in via OIDC SSO (configured per Authentication Setup), you can automatically add users to a team based on the group claim their identity provider sends at login.

Note: This depends on OIDC sign-in actually being active, which today means the AUTH_OIDC_* environment variables from Authentication Setup, not just a provider registered on the SSO Configuration Settings page (see that page's known limitation). If your organization hasn't set up working OIDC sign-in yet, group mapping has nothing to reconcile against.

Go to Settings > Identity > Teams, open a team, and add an IdP group mapping: the exact group name as it appears in your IdP's groups claim.

On every sign-in, VirtualSutra reconciles team membership from the groups present in that login's claim:

  • A group present in the claim and mapped to a team adds the user to that team.
  • A group mapped to a team but absent from the claim removes the user from that team, unless they were added manually (see below).
  • Group name matching is exact and case-sensitive. Engineering and engineering are treated as different groups.

Note: Manually added members (added via Add Member rather than IdP sync) are never removed by a sync that omits their group. Sync only reconciles memberships it originally created.

Related