Skip to main content
Organization member invitations are available on . Team server grants are available on .
Members are people who can sign in to an organization. They can join through an invitation or Directory Sync. Membership determines which organizations a user can see, which settings they can manage, and which servers they can access through organization and server roles.

​
Membership contract

Membership gives a person access to an organization. It does not automatically grant access to every restricted server unless the person is an organization admin or the server has a default role.
Use service accounts for durable automation. User-owned keys should stop being relied on when that user leaves the organization.

​
Member lifecycle

1

Add a person

Organization admins can invite a person by email. An identity provider can also provision them through Directory Sync.
2

Activate membership

An invited person joins after accepting the invitation and completing sign-in. A directory-provisioned person joins when Horizon receives their active WorkOS organization membership.
3

Assign access

Give the member an organization role and, when needed, explicit server grants or team grants.
4

Review usage

Use users and request logs to understand how the member’s clients interact with deployed servers.
5

Remove access

Removing a member removes their organization membership, explicit server grants, and Horizon-managed Team memberships. Horizon keeps directory Team assertions because organization removal does not change identity-provider groups, but those assertions stop granting access. Reassign the billing contact before removing the member who currently holds it.

​
Invitation states

​
Roles

Server-level roles can further grant admin, editor, or viewer access to a specific server. See Authorization for the full resolution model.

​
Access changes

Organization removal and user deletion use different boundaries. Organization removal keeps identity-provider group assertions because the person can still belong to those groups. User deletion removes all local Team membership state so a replacement user cannot inherit stale access before directory sync confirms it.

​
Reviewing members

Review membership from three directions:
  • Organization view: who can sign in, who is admin, and who counts toward seats.
  • Server view: which people have explicit access and with what role.
  • Teams view: which groups a person belongs to and which servers grant access to those Teams.
For sensitive servers, review explicit grants, team grants, and the server default role together. A restrictive explicit grant is not useful if a Team or the server default gives the person broader access.

​
Operational guidance

  • Give admin access only to people who should manage billing contact assignment, organization settings, integrations, and access.
  • Use explicit server grants or team grants for members who need access to restricted servers.
  • Remove members promptly when they leave the organization.
  • Use service accounts for automation instead of adding shared human accounts.

Teams

Group members and review their shared server access.

Roles

Review the role model used by Horizon.

Authorization

See the full access resolution model for users and servers.