---
title: "Enterprise Roles"
description: "How enterprise roles (Owner, Admin, Billing manager, Member) differ from organization roles, and who in your company should hold each"
---

An Enterprise account has two layers, each with its own roles:

* **The enterprise** is your company: its email domains, sign-in rules, people and contract. Enterprise roles decide who manages those.
* **Organizations** sit inside the enterprise and own apps. Organization roles decide who can see and ship each organization’s apps.

The two are separate. An enterprise role gives no access to any app, and an organization role gives no say over the enterprise. One person can hold both.

## Enterprise roles

Everyone who signs in with a managed account at one of your domains (through Google Workspace, Microsoft Entra ID, or your [SAML connection](/enterprise/saml/)) is a Member of your enterprise automatically. When Shorebird sets up your enterprise, you name its Owners, Admins and Billing managers and who should own your organization; everyone else joins as a Member. From then on, Owners change roles from the **People** tab of the **Enterprise** page in the [Shorebird console](https://console.shorebird.dev), which Owners, Admins and Billing managers reach from the organization switcher.

|                                                          | Member | Billing manager | Admin | Owner |
| -------------------------------------------------------- | ------ | --------------- | ----- | ----- |
| See every organization, app, person and API key          |        |                 | ✅     | ✅     |
| See activity across organizations                        |        |                 | ✅     | ✅     |
| Read the enterprise [audit log](/enterprise/audit-logs/) |        |                 | ✅     | ✅     |
| Remove a person from every organization at once          |        |                 | ✅     | ✅     |
| Remove guests and set the guest policy                   |        |                 | ✅     | ✅     |
| Set default organizations                                |        |                 | ✅     | ✅     |
| See service accounts and revoke API keys                 |        |                 | ✅     | ✅     |
| Change enterprise roles                                  |        |                 |       | ✅     |
| Require a sign-in method for a domain                    |        |                 |       | ✅     |
| See billing, usage and invoices                          |        | ✅               |       | ✅     |
| See and download contracts                               |        | ✅               |       | ✅     |

An enterprise always has at least one Owner; the last one can’t be demoted, and an Owner can’t be removed until they’re given another role.

Removing a person takes them out of every organization and app in the enterprise and revokes their invitations, sessions and API keys.

Guests are people outside your domains who belong to one of your organizations. The guest policy decides whether organizations can add them.

Default organizations are ones that Members join on their own the first time they sign in, as a Viewer or Developer.

## Enterprise roles don’t grant app access

Activity across organizations shows each app’s name, organization, release versions, channels and install counts. To open an app, create a release, or publish a patch, a person needs an [organization role](#organization-roles) in the organization that owns it, even if they are an enterprise Owner.

This keeps people who manage the account or pay for it, such as IT or accounts payable, from shipping to your users by default. An engineer who is also an enterprise Admin holds both roles and gets both sets of abilities.

## Organization roles

Each organization has its own members, each with one of Viewer, Developer, App Manager, Admin or Owner. These roles apply to every app in that organization. See [Member roles](/account/orgs#member-roles) for what each one can do.

Organization Admins and Owners manage their organization’s members. They don’t need an enterprise role to do it.

## Who should hold which role

Most companies divide the work like this:

| Who                                           | Enterprise role | Organization role               |
| --------------------------------------------- | --------------- | ------------------------------- |
| The engineering champion for Shorebird        | Owner or Admin  | Owner of the app’s organization |
| An engineering manager, CTO or contract owner | Owner           | None, or Viewer                 |
| Accounts payable or procurement               | Billing manager | None                            |
| The rest of the mobile team                   | Member          | Developer or App Manager        |

* **Owners** control who holds each role, whether your domains must sign in through SSO, and your contracts. The engineering champion can be an Owner when your company doesn’t mind engineers seeing the contract; otherwise make them an Admin and give Owner to a manager. Keep at least two Owners, so the account isn’t stranded when one leaves.
* **Admins** handle people day to day: they remove people who leave, manage guests, revoke stray API keys and watch the audit log.
* **Billing managers** see billing, invoices and contracts, without access to your people or apps.
* **The organization’s Owner** invites the mobile team, sets each person’s organization role, and manages releases and patches. Organization roles are what grant access to apps.

If one person does more than one of these jobs, give them each role it needs.