User Management

A "user seat" refers to a license for a single user within an organization. A user seat, while occupied by a member of your organization, grants that member access to Bitwarden services under your specific plan. A user seat is not permanently attached to that member; when they leave the organization that user seat is made available for use by a new member.

Bitwarden cloud Teams and Enterprise organizations will automatically scale up user seats as you invite new users. You can set a seat limit on scaling to prevent your seat count from exceeding a specified number, or manually add seats as desired. Regardless of how you choose to add seats, you will need to manually remove seats you're no longer using.

Adding and removing user seats will adjust your future billing totals. Adding seats will immediately charge your payment method on file at an adjusted rate so that you will only pay for the remainder of the billing cycle (month/year). Removing seats will cause your next charge to be adjusted so that you are credited for time not used by the already-paid-for seat.

To set a limit on the number of seats your organization can scale up to:

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

   

2. Navigate to Billing → Subscription and check the Limit subscription checkbox:

   

3. In the Seat limit input, specify a seat limit.

4. Select Save.

To manually add or remove seats to your organization:

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

   

2. Navigate to Billing → Subscription.

3. In the Subscription seats input, add or remove seats using the hover-over arrows:

   

4. Select Save.

To ensure the security of your organization, Bitwarden applies a 3-step process for onboarding a new member, invite → accept → confirm.

To invite users to your organization:

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

   

2. Navigate to Members and select the  Invite User button:

   

3. On the Invite user panel:

   • Enter the Email address where new users should receive invites. You can add up to 20 users at a time by comma-separating email addresses.

   • Select the Member role to be applied to new users. Member role will determine what permissions these users will have at an organizational level.

   • In the Groups tab, select which groups to add this user to.

   • In the Collections tab, select collects to give this user access to and what permissions they should have to each collection.

4. Click Save to invite the designated users to your organization.

note

Invitations expire after 5 days, at which point the user will need to be re-invited. Re-invite users in bulk by selecting each user and using the  options menu to Resend invitations:

If you're self-hosting Bitwarden, you can configure the invitation expiration period using an environment variable.

Invited users will receive an email from Bitwarden inviting them to join the organization. Clicking the link in the email will open the Bitwarden web app, where the user can log in or create an account to accept the invitation:

You must fully log in to the Bitwarden web app to accept the invitation. When you accept an invitation, you will be notified that you can access the organization once confirmed. Additionally, organization members will have their email automatically verified when they accept an invitation.

To confirm accepted invitations into your organization:

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

   

2. Navigate to Members.

3. Select any Accepted users and use the  options menu to  Confirm selected:

   

4. Verify that the fingerprint phrase on your screen matches the one your new member can find in Settings → My account:

   

Each fingerprint phrase is unique to its account, and ensures a final layer of oversight in securely adding users. If they match, select Submit.

To remove users from your organization:

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

   

2. Navigate to Members.

3. Select the users you want to remove from the organization and use the  Options menu to  Remove:

Removing a user from your organization does not delete their Bitwarden account. When a user is removed they can no longer access the organization or any shared items and collections, however they will still be able to log in to Bitwarden using their existing master password and access any individual vault items.

Depending on the particulars of your implementation, you may be able to use one of the following methods to delete a Bitwarden user account that belongs to a deprovisioned user:

1. If you have a claimed domain, any users with account email addresses that have a matching domain (e.g. jdoe@mycompany.com) can be outright deleted by organization administrators, instead of only being able to be removed from the organization:

   

2. If you are self-hosting Bitwarden, an authorized admin can delete the account from the System Administrator Portal.

3. If the account has an @yourcompany.com email address that your company controls, you can use the delete without logging in workflow and confirm deletion within the @yourcompany.com inbox. For more information, see Delete an Account or Organization.

Instead of completely removing members, you can also temporarily revoke access to your organization and its vault items. To revoke access:

1. In the Admin Console, navigate to Members.

2. Select the members you want to revoke access for and use the  Options menu to Revoke access:

   

Users with revoked access are listed in the Revoked tab and will:

• Not have access to any organization vault items, collections, and more.

• Not have the ability to use SSO to login, or Organizational Duo for two-step login.

  • If the member does not have a master password, they'll still be able to use trusted devices to login but only be able to access their individual vault.

• Not be subject to your organization's policies.

• Not occupy a license seat.

To restore access to a user:

1. In the Admin Console, navigate to Members.

2. Open the Revoked members tab.

3. Select the users you want to restore access for and use the  Options menu to Restore access:

   

Users who are not compliant with certain policies will not be able to have their access restored until they take steps to become compliant. When you restore access to a user, they don't need to go through the invite → accept → confirm workflow again.

The 2FA status of users can be viewed from the Members page. If the user has a  icon, two-step login has been enabled on their Bitwarden account.