Admin ConsoleUser Management

User Management

User seats

Bitwarden Teams and Enterprise organizations will automatically scale up user seats as you invite new users. You can set a seat limit on scaling to prevent your seat count from exceeding a specified number, or manually add seats as desired. Regardless of how you choose to add seats, you will need to manually remove seats you're no longer using.

Adding and removing user seats will adjust your future billing totals. Adding seats will immediately charge your payment method on file at an adjusted rate so that you will only pay for the remainder of the billing cycle (month/year). Removing seats will cause your next charge to be adjusted so that you are credited for time not used by the already-paid-for seat.

note

Only an an organization owner or provider service user can add or remove seats, as this directly affects billing.

Set a seat limit

To set a limit on the number of seats your organization can scale up to:

  1. Log in to your web vault and open your organization.

  2. Open the Billing tab and select Subscription from the left-hand menu.

  3. Check the Limit subscription checkbox:

    Set a seat limit
    Set a seat limit
  4. In the Seat limit input, specify a seat limit.

  5. Select Save.

note

Once the specified limit is reached, you will not be able to invite new users unless you increase the limit.

Manually add or remove seats

To manually add or remove seats to your organization:

  1. Log in to your web vault and open your organization.

  2. Open the Billing tab and select Subscription from the left-hand menu.

  3. In the Subscription seats input, add or remove seats using the hover-over arrows:

    Add or remove seats
    Add or remove seats
  4. Select Save.

note

If you are increasing your Subscription seats above a specified Seat limit, you must also increase the seat limit so that it is equal to or greater than the desired subscription seat count.

Onboard users

To ensure the security of your organization, Bitwarden applies a 3-step process for onboarding a new member, inviteacceptconfirm.

tip

This document covers the manual onboarding flow for adding users to Bitwarden organizations, however Bitwarden offers two methods for automatic user and group provisioning:

Invite

tip

For Enterprise organizations, we recommend configuring enterprise policies prior to inviting users to ensure compliance on-entrance to your organization.

To invite users to your organization:

  1. Log in to your web vault and open your organization.

  2. Open Members tab and select the Invite User button:

    Invite members
    Invite members
  3. On the Invite User panel:

    • Enter the Email address where new users should receive invites. You can add up to 20 users at a time by comma-separating email addresses.

    • Select the Member role to be applied to new users. Member role will determine what permissions these users will have at an organizational level.

    • In the Groups tab, select which groups to add this user to.

    • In the Collections tab, select collects to give this user access to and what permissions they should have to each collection.

  4. Click Save to invite the designated users to your organization.

note

Invitations expire after 5 days, at which point the user will need to be re-invited. Re-invite users in bulk by selecting each user and using the Options menu to Resend invitations:

Bulk re-invite
Bulk re-invite

If you're self-hosting Bitwarden, you can configure the invitation expiration period using an environment variable.

Accept

Invited users will receive an email from Bitwarden inviting them to join the organization. Clicking the link in the email will open a Bitwarden client invitation window. Log In with an existing Bitwarden or Create Account to accept the invitation:

Invitation Window
Invitation Window

When you accept an invitation, you will be notified that you can access the organization once confirmed:

Accepted Invitation
Accepted Invitation

Additionally, organization members will have their email automatically verified when they accept an invitation.

Confirm

tip

The 3-step inviteacceptconfirm procedure is designed to facilitate secure sharing between organizations and users by maintaining end-to-end encryption. Learn more.

To confirm accepted invitations into your organization:

  1. Log in to your web vault and open your organization.

  2. Open the Members tab.

  3. Select any Accepted users and use the Options menu to Confirm Selected:

    Confirm accepted members
    Confirm accepted members
  4. Verify that the fingerprint phrase on your screen matches the one your new member can find in Account settingsMy account:

    Sample Fingerprint Phrase
    Sample Fingerprint Phrase

Each fingerprint phrase is unique to its account, and ensures a final layer of oversight in securely adding users. If they match, select Submit.

Deprovision users

warning

For those accounts that do not have master passwords as a result of SSO with trusted devices, removing them from your organization or revoking their access will cut off all access to their Bitwarden account unless:

  1. You assign them a master password using account recovery beforehand.

  2. The user logs in at least once post-account recovery in order to fully complete the account recovery workflow.

To remove users from your organization:

  1. Log in to your web vault and open your organization.

  2. Open the Members tab.

  3. Select the users you want to remove from the organization and use the Options menu to Remove:

Remove Users
Remove Users
tip

Offline devices cache a read-only copy of vault data, including organizational vault data. If you anticipate malicious exploitation of this, credentials the member had access to should be updated when you remove them from the organization.

Deleting user accounts

Removing a user from your organization does not delete their Bitwarden account. When a user is removed they can no longer access the organization or any shared items and collections, however they will still be able to log in to Bitwarden using their existing master password and access any individual vault items.

Depending on the particulars of your implementation, you may be able to use one of the following methods to delete a Bitwarden user account that belongs to a deprovisioned user:

  1. If you are self-hosting Bitwarden, an authorized admin can delete the account from the System Administrator Portal.

  2. If the account has an @yourcompany.com email address that your company controls, you can use the delete without logging in workflow and confirm deletion within the @yourcompany.com inbox. For more information, see Delete an Account or Organization.

Revoke access

tip

If your organization has an active SCIM integration, user access to your organization is automatically revoked when users are suspended or de-activated in your source directory.

warning

For those accounts that do not have master passwords as a result of SSO with trusted devices, removing them from your organization or revoking their access will cut off all access to their Bitwarden account unless:

  1. You assign them a master password using account recovery beforehand.

  2. The user logs in at least once post-account recovery in order to fully complete the account recovery workflow.

Instead of completely removing members, you can also temporarily revoke access to your organization and its vault items. To revoke access:

  1. Login to your web vault and open your organization.

  2. Open the Members tab.

  3. Select the members you want to revoke access for and use the Options menu to Revoke access:

    Revoke access
    Revoke access

tip

Only owners can revoke and restore access to other owners.

Users with revoked access are listed in the Revoked tab and will:

  • Not have access to any organization vault items, collections, and more.

  • Not have the ability to use SSO to login, or Organizational Duo for two-step login.

  • Not be subject to your organization's policies.

  • Not occupy a license seat.

Restore access

To restore access to a user:

  1. Login to your web vault and open your organization.

  2. Open the Members tab and the Revoked members tab.

  3. Select the users you want to restore access for and use the Options menu to Restore access:

    Restore access
    Restore access

When you restore access to a user, they don't need to go through the inviteacceptconfirm workflow again.

Review user 2FA status

The 2FA status of users can be viewed from the organization management page. On the Members tab, owners and admins can review which users have two-step login enabled. If the user has a icon, two-step login has been enabled on their Bitwarden account.

2FA user
2FA user

Make a suggestion to this page

Contact Our Support Team

For technical, billing, and product questions.

Name*
Bitwarden account email*
Verify account email*
Product*
Are you self-hosting?*
Subject*
Message...*

Cloud Status

Check status

© 2024 Bitwarden, Inc.TermsPrivacySitemap
This site is available in English.
Go to EnglishStay Here