Teams

Teams group organization members so that you can review and grant server access for the group. A Horizon-managed Team is the default team type. A directory Team mirrors a group from an identity provider through Directory Sync.

​

Team types

Horizon shows where each Team is managed.

​

Find a Team

Open Govern and select Teams. Use the search field to find a Team by name. Select a Team to review its members and server grants.

​

Create a Team

If you can manage Teams, you can create a Horizon-managed Team.

1. Open Govern and select Teams.
2. Select Create team.
3. Enter a Team name.
4. Select Create team.

​

Manage members

A Horizon-managed Team can include active organization members and active service accounts. Team membership lets you grant server access to the group instead of maintaining each server grant separately. To add a member:

1. Open the Horizon-managed Team.
2. Select Add member on the Members tab.
3. Search for an organization member or service account.
4. Select the member or service account, then select Add member.

To remove a member:

1. Open the member action menu on the Members tab.
2. Select Remove member.
3. Review the access warning, then confirm the removal.

Removing a member can remove server access that the actor receives through the Team. Access from another Team, an explicit grant, or the server default role remains unchanged.

​

Delete a Team

You can delete a Horizon-managed Team from its detail page.

1. Open the Team.
2. Select the action menu.
3. Select Delete team.
4. Review the membership and server grant counts.
5. Confirm the deletion.

Deletion permanently removes the Team, its memberships, and its server grants. Updates can take a moment to apply.

​

Manage a directory Team

Use the connected identity provider to change a directory Team’s name or membership. Horizon preserves a directory Team and its server grants when its source group becomes unavailable. The Team state identifies why its membership is inactive. In both states, Horizon keeps the server grants so a restored source can reuse them. The saved grants provide no access while the Team has no active members. Horizon does not make these Teams available for new server grants. If a person loses organization membership, Horizon keeps the last directory assertion but removes its link to the Horizon user. The assertion cannot grant access until the person rejoins the organization. Horizon keeps it because organization removal does not change the identity provider group. If the Horizon user is deleted, Horizon removes all Team membership rows for that user. This prevents a replacement user from inheriting the deleted user’s Team access before a new directory sync. If the identity provider still assigns the email to the group, the next sync recreates a pending assertion. Use Sync now on the Teams page to request a directory update when this action is available. See Directory Sync for setup and sync guidance.

​

Server access

A Team grant assigns a server role to each current Team member. Team grants combine with explicit member grants and grants from other Teams. Add, change, or remove a Team grant from the server’s Access > Members page. Use the Team’s Servers tab to review all server grants for that Team. See Roles for the complete server access model.