Skip to main content
There are three ways someone joins an org: an explicit invitation to their email, domain auto-join when their email domain is one your org has verified, or signing in through your organization - an SSO sign-in that WorkOS routes to your org joins it on first sign-in. Sign-in and access lays out how they combine.

​
Inviting a member

Open Settings → Organization → Members. Owners can use Invite your team to: Radar emails each person a one-time-use invitation that expires after 14 days. They must sign in with the invited email address.

​
Pending invites

Owners can cancel an invitation with Revoke under Pending invitations. To send a new invitation, enter the address again in Invite your team; a successful resend replaces the old link.

​
Removing a member

Under Settings → Organization → Members, owners can click Remove in another member’s row and confirm. Their account and other organization memberships remain. Removal blocks new browser and PAT requests to this organization. On a self-managed Hub, it also ends their browser sessions. It does not terminate an already-open terminal or stream. Revoke their org-scoped PATs separately under Settings → Organization → AI & MCP. The tokens are not revoked by membership removal and can work again if membership is restored. Removal alone does not keep someone out: SSO, domain auto-join, or an MCP OAuth token that still asserts organization access can add them back. Revoke their access in your identity provider as well.

​
Changing a role

Owners can change a member’s Role dropdown on the Members page. Granting or removing the owner role requires confirmation. Changes apply on the user’s next request.

​
Domain auto-join

If your team all uses the same email domain, add it under Settings → Organization → Domains and verify it to skip the invite flow entirely. Verification is a DNS-TXT record the page shows you (verification_token=...) at the domain you are verifying - for a subdomain such as eng.acme.com, the guided setup gives the exact DNS host, not the parent’s apex; Radar checks it in the background. Once the domain is verified, its auto-join switch is on, and the org-wide switch is on, new users who sign in with a verified email at that domain (asserted by your IdP through SSO, or confirmed by the emailed code) join automatically with the role set under Settings → Organization → General → How people join. An org-wide switch there turns auto-join off for every domain at once.
A verified domain also routes its sign-ins through SSO once a connection is set up; removing it stops both. Free-mail providers (gmail.com, outlook.com, proton.me, etc.) are blocklisted - you can’t auto-join shared domains. Auto-join records a distinct org_member.auto_joined event in the audit log - separate from org_member.joined (accepted invitations) - so you can filter auto-joins from explicit invites by action.

​
Owners still need explicit promotion

Auto-joined users always get the default invite role (typically member). The system never promotes anyone to owner via auto-join - that always requires explicit role assignment.

​
Contact email for external users

A contractor who signs in as a guest through SSO normally uses their real employer address (for example dana@partner.com), and the Members list shows it like any other. If instead your IdP rewrites guests onto a subdomain you own (dana-partner.com@ext.example.com) and sends a contactEmail claim, Radar keeps the real address and the Members list shows it on top, with the sign-in identifier beneath it. Either way, the real address is what an invitation sent to their employer email matches against, so an invite and an SSO guest resolve to the same person. See SSO for external users for both setups.

​
Invitation flow under SSO

When the org has an SSO connection configured, invitations and domain auto-join still work - they’re additive. A user invited by email but who arrives via SSO will be matched on their verified email, and the invitation will resolve. Radar cannot yet require SSO for an organization: a member who already has an account can still use the Cloud sign-in page. What you can do today is skip invitations entirely - verify your domain and let auto-join or the organization sign-in link bring people in through your IdP - and keep Cloud roles and cluster bindings tight so a stray sign-in reaches little.

​
See also