Global roles
Every user in Collabase has a single global role that determines their baseline access to the platform.| Role | What they can do |
|---|---|
| Admin | Full access to all settings, spaces, and system configuration. Admins can manage users, groups, and identity providers. |
| Collaborator | Can create and edit content in any space they are granted access to. Cannot access system settings. |
| Viewer | Read-only access to spaces and pages they are explicitly granted. Cannot create or modify content. |
Global roles set the ceiling for what a user can do. Space-level roles further restrict access within a specific space. See Permissions for the full model.
Managing users
Navigate to Settings → Users to see all users in your instance. The users table shows each user’s name, email, global role, creation date, last login, and directory source (Local, LDAP, Google, GitHub, Microsoft, etc.).Adding a user
Note the generated password
Collabase generates a one-time password automatically. Copy the credentials and share them securely with the new user. The user must change their password on first login.
Changing a user’s role
In the users table, use the role dropdown on any row to change that user’s global role. The change takes effect immediately.Disabling and re-enabling a user
Click the disable button (the ban icon) on a user’s row to prevent them from logging in without deleting their account. Their content and history are preserved. Click the enable button (the checkmark icon) to restore access.Editing a user’s profile
Click a user’s name to open the profile panel. You can update their full name, email, phone, job title, and department. For users managed by an external identity provider (LDAP or SSO), profile fields are locked and can only be updated from your external directory.Removing a user
Click the trash icon on any user row to permanently delete the account. This action cannot be undone.Unlocking a locked account
If brute-force protection is enabled, accounts lock after too many failed login attempts. A locked indicator appears on the user’s row. Open the user profile panel and click Unlock Account to restore access immediately.Groups
A group is a named collection of users. Instead of granting space access to individual users, you grant access to the group — all members of the group inherit that access automatically. Use groups to manage access for teams, departments, or any logical set of users. When someone joins or leaves a team, you add or remove them from the group rather than updating every space individually.Creating a group
Name the group
Enter a name (required) and an optional description that explains the group’s purpose.
Adding members to a group
Go to the Members tab
The Members tab shows all current members. Scroll down to the Add Member section.
Granting a group access to a space
Open the group and go to the Space Access tab
This tab lists all spaces the group currently has access to.
Select a space
Choose the space from the dropdown. Only spaces your instance knows about are listed.
Select a role
Choose the role the group members will have within that space (available roles are defined in the space’s role configuration).
SCIM v2 provisioning
Collabase implements SCIM 2.0, which lets your identity provider (Okta, Microsoft Entra, JumpCloud, etc.) automatically provision and deprovision users and groups. SCIM endpoints:| Resource | Endpoint |
|---|---|
| Users | /api/scim/v2/Users |
| Groups | /api/scim/v2/Groups |
| Service provider config | /api/scim/v2/ServiceProviderConfig |
| Schemas | /api/scim/v2/Schemas |
Authorization header.
Generating a SCIM token
Navigate to Settings → Users
Scroll to the SCIM section or look for the SCIM token management area in the settings page.
Generate a new token
Click Generate Token. Collabase displays the token once — copy it immediately and store it securely.
How SCIM provisioning works
When your identity provider pushes a user or group to Collabase via SCIM:- New users are created with the default global role configured on your identity provider connection.
- Updated users have their profile fields (name, department, job title) synced from the directory.
- Deprovisioned users have their accounts disabled in Collabase — their content is not deleted.
- Groups are created or updated in Collabase and their memberships are kept in sync.