# Members and roles

> Invite colleagues to your Vigilbase One organisation, choose their role, and change or remove their access.

Source: https://docs.vigilbase.com/one/getting-started/members-and-roles

Owners and admins manage who belongs to an organisation from the [Organization](https://one.vigilbase.com/organization) page. Each member has one role, and the role decides which parts of One they see and what they can change.

## Roles

| Role | What it allows |
| --- | --- |
| **Owner** | Full access, including billing changes, member management and approving Vigil actions. |
| **Admin** | Manage members, services and contracts. Also allows billing changes and support requests. Approving Vigil actions is granted separately. |
| **Member** | Read access across the organisation. No support requests. |
| **Read Only** | Read access across the organisation. Also allows support requests. |
| **Billing Only** | Access to billing information only. |

Partner organisations have additional partner roles for deals, managed customers and partner billing.

Some parts of One need a specific permission. For example, **Environment**, Services and **Change requests** need access to services, which **Billing Only** does not have. **Billing** needs access to billing information.

> [!NOTE]
> Only an owner can make someone else an owner. Nobody can change their own role, and One protects the last owner of an organisation from being changed.

## Invite a member

:::steps
1. **Open the Organization page.** Go to [one.vigilbase.com/organization](https://one.vigilbase.com/organization) and stay on the **General** tab.
2. **Click Invite.** It is next to **Team Members**.
3. **Enter the details.** In **Invite Team Member**, type the colleague's **Email Address** and choose a **Role**. The description under the role says what it allows.
4. **Click Send Invitation.** Vigilbase emails them an invitation link.
:::

The invitation appears under **Pending Invitations** with its role and expiry date. Use the buttons beside it to **Resend invitation** or **Cancel invitation**. Your colleague accepts it as described in [Organisations](https://docs.vigilbase.com/one/getting-started/organisations#with-an-invitation).

You can only offer roles and permissions that you hold yourself, so the **Role** list may be shorter for an admin than for an owner.

## Change a member's role

:::steps
1. **Find the member** under **Team Members**.
2. **Open their actions.** Click the menu button at the end of their row and choose **Change role**.
3. **Pick the new role** in **Change member role** and click **Save role**.
:::

## Remove a member

Click the menu button at the end of the member's row, choose **Remove**, then confirm with **Remove Member**. They lose access to everything in the organisation.

## Let a member approve Vigil actions

**Approve Vigil actions** is a permission for approving actions that Vigil proposes. Owners always have it; anyone else needs it granted explicitly. Vigil does not currently propose actions in customer conversations, so this permission does not change what a member can do today. Changes to your managed services are approved through [change requests](https://docs.vigilbase.com/one/requests/change-requests#set-how-your-team-approves-changes).

Under each member on the **General** tab, owners and admins see an **Approve Vigil actions** switch:

- **Included with Owner** means the member is an owner and already has it.
- **Requires a role that can change services** means their role cannot hold it; give them a role such as **Admin** first.
- **You cannot change your own access** appears on your own row.

Turn the switch on to grant the permission, or off to remove it.

## Membership through single sign-on

If your organisation provisions users with SCIM, directory users join with member access. Groups in your identity provider never grant admin roles; an owner or admin changes roles in One. See [Single sign-on](https://docs.vigilbase.com/one/getting-started/single-sign-on).