Members

Use Members to manage the people who can access your VeloDB Cloud organization and the actions they can perform in the console. Organization roles control console and organization access. They do not control SQL access to a warehouse.

Only an Organization Admin can manage organization members and roles. To open the page:

1. Log in to the VeloDB Cloud console.
2. In the upper-left corner, click the organization name to open Organization Overview.
3. In the left navigation pane, click Members.

Note:

Organization members use their VeloDB Cloud accounts to access the console. Applications, BI tools, and SQL clients use separate warehouse users and roles. For warehouse-level access, see Warehouse Users and Roles.

View members

The User Management tab lists the members and invitations in the organization. The list includes the following fields:

Field	Description
Username	The member's email address.
Provider	The sign-in method associated with the account, such as email, Google, Microsoft, or SAML.
Role	The organization role assigned to the member.
Last Login	The most recent console sign-in time.
Joined At	The time when the member activated the invitation. An invitation that has not been activated shows Not Joined.
Actions	Controls for editing the member's role or deleting the member.

The list displays times in the timezone shown next to the relevant column heading.

Invite members

Inviting a member adds the person to the organization with the role you select. The invitation email contains a link that the recipient must activate to join the organization. Invitations are valid for 3 days.

To invite a member, do the following. You can invite multiple people at once, but each person must have a unique email address. If the person already has a VeloDB Cloud account, they can use that account to sign in. If not, they are prompted to create an account when they activate the invitation.

1. Open the Members page.
2. On the User Management tab, click Invite Users.
3. Enter the person's email address in Email address.
4. Select an organization role in Role. Use the least-privileged role that meets the person's responsibilities.
5. To invite more than one person, click Add and repeat the previous two steps.
6. Click Send invitations.

After the invitation is sent, the member appears in the list with Not Joined in Joined At until they activate the invitation.

Change a member's role

You can change the role of an activated member. You cannot edit the role of the account currently signed in to the console, or an invitation that the recipient has not yet activated.

1. Open the Members page.
2. On the User Management tab, find the activated member.
3. In Actions, click Edit.
4. Select the new organization role in Role, then click Confirm.

The new permissions take effect after the change is saved. If you remove your own administrative access, the console may return you to a page that your new role can access.

Remove a member

Removing a member deletes their membership in the current organization. It does not delete their VeloDB Cloud account, and it does not delete warehouse users that happen to use the same email address.

Before removing a member, confirm that another active Organization Admin can manage the organization. The last Organization Admin cannot be deleted. To remove a member:

1. Open the Members page.
2. On the User Management tab, find the member.
3. In Actions, click Delete.
4. Review the confirmation message, then click Confirm.

You cannot delete the account currently signed in to the console. For SAML users, also revoke the user's access to the SAML application in your identity provider. Removing an identity provider assignment alone does not remove an existing organization membership. See SAML Single Sign-On.

Organization roles

Organization roles control what a member can see and manage in the VeloDB Cloud console. They are separate from warehouse SQL roles.

VeloDB Cloud provides the following built-in roles:

Role	Organization Management	Warehouse Management	Warehouse View
Organization Admin	Full organization-level management	All warehouses	All warehouses
Warehouse Admin	No organization management	All warehouses	All warehouses
Warehouse Admin ReadOnly	No organization management	No	All warehouses
Organization Billing	No organization management	No	All warehouses
Warehouse Viewer	No organization management	No	Assigned warehouses

The permission categories have these meanings:

• Organization Management: manage organization-level settings and members.
• Warehouse Management: create and edit warehouses and clusters for the warehouses included in the role.
• Warehouse View: view warehouse details, run queries, and monitor warehouse status for the warehouses included in the role.

The Organization Billing role provides billing access as a built-in role. Billing access is not a permission that you can select when you create a custom role.

The user who creates an organization is automatically assigned Organization Admin.

Create a custom organization role

Create a custom role when a built-in role grants more access than a member needs. A custom role must include at least one warehouse permission. A warehouse cannot be selected in more than one permission category for the same role.

1. Open the Members page.
2. Click the Role Management tab.
3. Click New Role.
4. Enter a unique name in Role Name.
5. Optionally, enter a description in Description.
6. Under Warehouse View, select the warehouses that the role can view.
7. Under Warehouse Management, select the warehouses that the role can manage.
8. If the console displays Public (Warehouse), select the warehouses that the role can access through the public warehouse permission.
9. Click Confirm.

After creating the role, assign it to members from the User Management tab. You cannot edit or delete the built-in roles.

Configure SAML single sign-on

Premium organizations can authenticate console members through a SAML 2.0 identity provider. SAML SSO supports verified corporate email domains, just-in-time provisioning, default role assignment, and organization-level SSO enforcement.

Only Organization Admins can configure SAML SSO. For setup instructions, see SAML Single Sign-On.

Require multi-factor authentication

Organization Admins can require every member to complete multi-factor authentication before signing in to the console. Members can also add a second factor to their own accounts.

For setup steps, supported methods, and how MFA interacts with SAML SSO, see Multi-Factor Authentication.

See also

• Organizations: create organizations and manage organization-level settings.
• Warehouse Users and Roles: manage SQL users, roles, and privileges inside a warehouse.
• SAML Single Sign-On: authenticate members through a corporate identity provider.
• Multi-Factor Authentication: add or require a second authentication factor for console access.