WorkLLM User Management: Roles, Invitations, and SSO

Manage your team’s access to WorkLLM — configure roles, invite members, set up SSO, and control who can view or create in your workspace.

WorkLLM uses role-based access control to define what each person in your organization can see and do. You assign a role when you invite someone to your workspace, and Admins can change roles at any time.

Roles

WorkLLM has two roles: Admin & Member

Role descriptions

Admin — Full access to your WorkLLM workspace, including all AI features, organization settings, billing, integrations, and security configuration. Admins can manage every aspect of membership and see all reports and audit logs. Assign this role to workspace owners and IT administrators.

Member — Standard access to all AI features. Members can create and use threads, tools, assistants, and agents. They cannot access administrative settings, billing, or audit logs. This is the appropriate role for most people in your organization.

Inviting members

1. Open member settings

   In your workspace, click Settings in the left sidebar, then select Members.

2. Click Invite Member

   Click Invite Member in the top-right corner of the Members page.

3. Enter the email address

   Type the email address of the person you want to invite. You can enter multiple addresses separated by commas to invite several people at once.

4. Select a role

   Choose Admin or Member from the role dropdown. You can change this later.

5. Send the invitation

   Click Send Invite. WorkLLM sends an email invitation to each address. Invitees have 7 days to accept before the link expires.

Managing pending invitations

Invitations that have been sent but not yet accepted appear under Settings → Members → Pending Invitations. From there you can:

• Resend an invitation if the original email was missed or expired
• Revoke a pending invitation to cancel access before the invitee joins

Changing a member’s role

1. Go to Members

   Click Settings in the left sidebar, then select Members.

2. Find the member

   Locate the person whose role you want to change. Use the search field to filter by name or email.

3. Open the role menu

   Click the role badge next to their name (for example, Member) to open the role dropdown.

4. Select the new role

   Choose the new role. The change takes effect immediately — the member does not need to log out and back in.

Revoking access

To remove a member from your workspace:

1. Go to Members

   Click Settings in the left sidebar, then select Members.

2. Find the member

   Locate the person you want to remove.

3. Remove the member

   Click the … menu next to their name and select Remove Member. Confirm the removal in the dialog that appears.

Removing a member immediately revokes their access to your workspace. Their past contributions — threads they created and prompts they wrote — remain in your workspace and are not deleted. If you need to delete their content, you must do so separately before or after removing them.

Removing a member cannot be undone from the Members page. If you need to restore someone’s access, you must send a new invitation.

Single sign-on (SSO)

WorkLLM supports SSO so your team can authenticate using your existing identity provider, and you can enforce your organization’s authentication policies — including MFA — through that provider.

Google SSO

Google SSO is available on all plans and requires no configuration on WorkLLM’s side. Members can sign in with Sign in with Google on the login page. If your Google Workspace account uses MFA, that requirement is enforced through Google’s authentication flow.

SAML SSO (Enterprise Plans Only - Coming Soon)

Enterprise plans can configure SAML 2.0 SSO with any compatible identity provider, including Okta, Microsoft Entra ID (formerly Azure AD), OneLogin, and others.

To enable SAML SSO for your organization:

1. Contact WorkLLM

   Email [e-mail] with the subject line “SAML SSO configuration” and include your organization name and the identity provider you’re using.

2. Receive your SAML configuration

   WorkLLM will provide you with the Service Provider (SP) metadata, including the ACS URL and Entity ID, needed to configure your identity provider.

3. Configure your identity provider

   In your identity provider’s admin console, create a new SAML application using the SP metadata WorkLLM provides. Assign the application to the users who should have access to WorkLLM.

4. Complete configuration in WorkLLM

   Once your identity provider is configured, WorkLLM will complete the integration on your WorkLLM organization. SSO will be enforced for all members on your domain.

/

When SAML SSO is enabled, members who try to sign in with email and password or Google SSO will be redirected to your identity provider. You can configure whether non-SSO login methods remain available as a fallback during the setup process.