Set up a team on Teams
Create an organisation, invite people, sign in with your identity provider, sync groups with SCIM, understand active developers and the yearly cap, and push audit evidence.
Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.
Stability The promise an interface ships with.
- Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
- Beta Usable in production; may change before it becomes stable.
- Experimental May change or go away; needs an explicit opt-in in main.yaml.
Teams is the paid plan for working together in MainSDK Cloud. This page shows how a team is set up and what it is billed for. The app itself stays free on every plan. Plan about 30 minutes, longer if your identity provider needs a ticket.
You need
- A MainSDK Cloud account, signed in with a passkey, WhatsApp or a social login.
- For SSO and SCIM: an Okta, Entra or Google Workspace admin.
1. Invite people
An admin invites by email as admin, developer or viewer. An invite works once and for seven days, for the person who owns that email. A developer can create and read keys; a viewer reads projects and nothing else.
2. Sign in with your identity provider
SSO uses OIDC or SAML through a driver (WorkOS first). SCIM keeps people in step: a person added in the provider becomes a member, and a SCIM group such as payments-team becomes a team with the same members. Removing a person in the provider ends their console access within five minutes. SSO and SCIM are never a separate charge.
3. Know what you are billed for
A seat costs $20 for each active developer in a month: someone who pushed, ran a gate that reported to the Cloud, or used the console. Viewers and auditors never count. A year is capped at $30,000; past it, more developers cost nothing. You can switch to one annual invoice with a purchase order number. Events pool across all your seats and stay searchable for 30 days.
An approved startup pays $0 for 12 months. Billing starts in month 13, and you get a notice 30 days before.
4. Add-ons
Add-ons are optional and apply to your own projects only: longer history, more replays, hosted triage, questionnaire packs, deep review and audit evidence. None gives access to other organisations' projects, discovery, SIEM streaming, detections, egress control or company-wide evidence; those are Fleet. An add-on with no price set is not on sale yet.
5. Push audit evidence
With the audit evidence add-on and a connected Vanta, Drata or Secureframe account, push evidence for one project. The tool receives a bundle signed with Ed25519 and mapped to SOC 2 or ISO 27001 criteria. Check it offline with mainsdk assure verify <bundle> (planned with spec assure).
6. Hand a project to a client
Follow Hand a project to a client. Use --keep-maintainer to keep one maintainer seat and --bill-addons-to client to put add-ons on the client's invoice.
Check it worked
Invite yourself with a second email as a viewer: the viewer can open the project and cannot create a key. Remove a person in your identity provider and confirm their console session ends within five minutes.
Was this page helpful?