---
title: Administration
description: Run a Dashies workspace day to day - members and roles, billing, SAML single sign-on, SCIM provisioning, domain verification, and the audit log.
updated: 2026-09-07
---

These pages are for the person who **runs** a workspace rather than the person
who builds dashboards in it. Everything here needs the **admin** role in the
workspace you are administering.

If you are setting up a team for the first time and just want people in it, start
with [Work as a team](/guides/work-as-a-team) instead. It covers creating the
workspace, inviting people, and sharing a data source. This section picks up
where that leaves off.

## Where the settings are

Open **Settings**, switch into the workspace you administer, and the workspace's
own sections appear alongside your personal ones. The two that matter here are
**Subscription** and **Security**.

If the Security section tells you **"You are not an admin here"**, you are a
member of that workspace rather than an admin. Ask an existing admin to change
your role. If it tells you to **switch into a workspace**, you are looking at
your personal account, which has no workspace settings of its own.

## The order to do things in

Single sign-on, provisioning, and domain verification interlock, and the product
lets you do them out of order. Doing them in this order avoids every dead end:

1. **[Turn on Enterprise](/admin/billing#what-enterprise-adds)** for the
   workspace, and set its email domain. The Security section does not appear
   until the workspace is on Enterprise.
2. **[Verify the email domain](/admin/domain-verification)** with a DNS record.
3. **[Connect SAML single sign-on](/admin/sso)**.
4. **[Set up SCIM directory sync](/admin/scim)**, if you want joiners and leavers
   mirrored automatically.

:::warning{title="Steps 2 and 3 look independent and are not"}
The app will let you connect SAML **before** the domain is verified, and it will
report success. Sign-in will then fail for every user in your organization, with
the message "No SSO is configured for that domain", until you verify the domain.

Nothing turns red in the admin screen while this is true. Verify the domain
first.
:::

## The pages

- **[Members and roles](/admin/members)** - what each role can do, changing a
  role, removing someone, and what removal actually revokes.
- **[Billing and plans](/admin/billing)** - subscribing, managing or cancelling,
  and how a workspace gets Enterprise.
- **[Verify your email domain](/admin/domain-verification)** - the DNS record,
  and what a verified domain gates.
- **[SAML single sign-on](/admin/sso)** - connecting your identity provider, and
  what your users see.
- **[SCIM directory sync](/admin/scim)** - mirroring joiners and leavers, and the
  parts of SCIM Dashies does not implement.
- **[Audit log](/admin/audit-log)** - what is recorded, who can read it, and what
  it deliberately does not cover.

## What is not here

- **A screen for row-level security.** On an Enterprise workspace a dashboard
  can serve each viewer only the rows they were granted, but it is declared in
  that dashboard's own spec by whoever authors it rather than administered from
  here. The Access tab on that dashboard's own Schedules page is where an admin
  reads and changes what the spec declared; this section carries nothing for it.
  See [Row-level security](/reference/spec#row-level-security). Below
  Enterprise there is no per-viewer filtering at all, and everyone who can open a
  dashboard sees the same numbers.
- **Seats assigned to named people.** A workspace buys a number of creator seats
  and a number of viewer seats, and a person takes one of them by the role they
  hold. There is no assignment step and nothing to reclaim by hand; what an admin
  changes is the COUNT, in the workspace's Members section. See
  [Billing and plans](/admin/billing#the-two-seat-pools).
- **Group-to-role mapping from your IdP.** SCIM creates people as members;
  admin is granted inside Dashies. See [SCIM directory sync](/admin/scim#what-is-not-supported).