> ## Documentation Index
> Fetch the complete documentation index at: https://docs.horizon.prefect.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Teams

> Group organization members and manage shared server access.

export const teamCollaborationPlans = "Developer and Enterprise";

export const serverRolesPlans = "Enterprise";

Teams group organization members so that you can review and grant server access for the group.
A Horizon-managed Team is the default team type.
A directory Team mirrors a group from an identity provider through [Directory Sync](/administration/directory-sync).

<Note>
  Team management is available on {teamCollaborationPlans}.
  Team server grants are available on {serverRolesPlans}.
</Note>

## Team types

Horizon shows where each Team is managed.

| Type                 | Managed in           | Available actions in Horizon                                            |
| -------------------- | -------------------- | ----------------------------------------------------------------------- |
| Horizon-managed Team | Horizon              | Create the Team, manage its members, review access, or delete the Team. |
| Directory Team       | An identity provider | Review the Team, its members, and its server grants.                    |

## Find a Team

Open **Govern** and select **Teams**.
Use the search field to find a Team by name.
Select a Team to review its members and server grants.

## Create a Team

If you can manage Teams, you can create a Horizon-managed Team.

1. Open **Govern** and select **Teams**.
2. Select **Create team**.
3. Enter a Team name.
4. Select **Create team**.

## Manage members

A Horizon-managed Team can include active organization members and active service accounts.
Team membership lets you grant server access to the group instead of maintaining each server grant separately.

To add a member:

1. Open the Horizon-managed Team.
2. Select **Add member** on the **Members** tab.
3. Search for an organization member or service account.
4. Select the member or service account, then select **Add member**.

To remove a member:

1. Open the member action menu on the **Members** tab.
2. Select **Remove member**.
3. Review the access warning, then confirm the removal.

Removing a member can remove server access that the actor receives through the Team.
Access from another Team, an explicit grant, or the server default role remains unchanged.

## Delete a Team

You can delete a Horizon-managed Team from its detail page.

1. Open the Team.
2. Select the action menu.
3. Select **Delete team**.
4. Review the membership and server grant counts.
5. Confirm the deletion.

Deletion permanently removes the Team, its memberships, and its server grants.
Updates can take a moment to apply.

## Manage a directory Team

Use the connected identity provider to change a directory Team's name or membership.
Horizon preserves a directory Team and its server grants when its source group becomes unavailable.
The Team state identifies why its membership is inactive.

| State                  | Meaning                                                                         |
| ---------------------- | ------------------------------------------------------------------------------- |
| Group missing in IdP   | The directory is connected, but its latest snapshot does not contain the group. |
| Directory disconnected | The Team's source directory is frozen or no longer connected.                   |

In both states, Horizon keeps the server grants so a restored source can reuse them.
The saved grants provide no access while the Team has no active members.
Horizon does not make these Teams available for new server grants.

If a person loses organization membership, Horizon keeps the last directory assertion but removes its link to the Horizon user.
The assertion cannot grant access until the person rejoins the organization.
Horizon keeps it because organization removal does not change the identity provider group.

If the Horizon user is deleted, Horizon removes all Team membership rows for that user.
This prevents a replacement user from inheriting the deleted user's Team access before a new directory sync.
If the identity provider still assigns the email to the group, the next sync recreates a pending assertion.

Use **Sync now** on the Teams page to request a directory update when this action is available.
See [Directory Sync](/administration/directory-sync) for setup and sync guidance.

## Server access

A Team grant assigns a server role to each current Team member.
Team grants combine with explicit member grants and grants from other Teams.
Add, change, or remove a Team grant from the server's **Access** > **Members** page.
Use the Team's **Servers** tab to review all server grants for that Team.
See [Roles](/roles#team-grants) for the complete server access model.