--- title: "Set up a team on Teams" description: "Create an organisation, invite people, sign in with your identity provider, sync groups with SCIM, understand active developers and the yearly cap, and push audit evidence." section: "guides" status: "Planned for 0.7" spec: "teams-plan" canonical: "https://mainsdk.dev/docs/guides/set-up-a-team" updated: "2026-10-28" --- # Set up a team on Teams > Create an organisation, invite people, sign in with your identity provider, sync groups with SCIM, understand active developers and the yearly cap, and push audit evidence. Status: Planned for 0.7 · Canonical: https://mainsdk.dev/docs/guides/set-up-a-team · Updated: 2026-10-28 Teams is the paid plan for working together in MainSDK Cloud. This page shows how a team is set up and what it is billed for. The app itself stays free on every plan. Plan about 30 minutes, longer if your identity provider needs a ticket. ## You need - A MainSDK Cloud account, signed in with a passkey, WhatsApp or a social login. - For SSO and SCIM: an Okta, Entra or Google Workspace admin. ## 1. Invite people An admin invites by email as `admin`, `developer` or `viewer`. An invite works once and for seven days, for the person who owns that email. A developer can create and read keys; a viewer reads projects and nothing else. ## 2. Sign in with your identity provider SSO uses OIDC or SAML through a driver (WorkOS first). SCIM keeps people in step: a person added in the provider becomes a member, and a SCIM group such as `payments-team` becomes a team with the same members. Removing a person in the provider ends their console access within five minutes. SSO and SCIM are never a separate charge. ## 3. Know what you are billed for A seat costs $20 for each active developer in a month: someone who pushed, ran a gate that reported to the Cloud, or used the console. Viewers and auditors never count. A year is capped at $30,000; past it, more developers cost nothing. You can switch to one annual invoice with a purchase order number. Events pool across all your seats and stay searchable for 30 days. An approved startup pays $0 for 12 months. Billing starts in month 13, and you get a notice 30 days before. ## 4. Add-ons Add-ons are optional and apply to your own projects only: longer history, more replays, hosted triage, questionnaire packs, deep review and audit evidence. None gives access to other organisations' projects, discovery, SIEM streaming, detections, egress control or company-wide evidence; those are Fleet. An add-on with no price set is not on sale yet. ## 5. Push audit evidence With the audit evidence add-on and a connected Vanta, Drata or Secureframe account, push evidence for one project. The tool receives a bundle signed with Ed25519 and mapped to SOC 2 or ISO 27001 criteria. Check it offline with `mainsdk assure verify ` (planned with spec `assure`). ## 6. Hand a project to a client Follow [Hand a project to a client](https://mainsdk.dev/docs/guides/client-handover). Use `--keep-maintainer` to keep one maintainer seat and `--bill-addons-to client` to put add-ons on the client's invoice. ## Check it worked Invite yourself with a second email as a viewer: the viewer can open the project and cannot create a key. Remove a person in your identity provider and confirm their console session ends within five minutes.