Teams and single sign-on
A workspace can have several people. Each is an admin or a member, and on the Business plan every change they make goes into an audit log, and they can sign in with your company's identity provider.
Workspaces
When you sign up you get a personal workspace, just for you. To work with others, create a team workspace with the workspace menu at the top of the dashboard's sidebar; the same menu switches between the workspaces you belong to and shows invitations waiting for you. Each team workspace has its own monitors, contacts, plan and members.
Members and roles
Invite people in Settings → Members: enter their email address and choose a role. They get an email with a link; once they sign in or sign up through it, they join the workspace.
| Admin | Member | |
|---|---|---|
| Monitors, tabs and maintenance windows | ✓ | ✓ |
| Notification contacts | ✓ | ✓ |
| Status pages | ✓ | ✓ |
| Incidents: acknowledge, comments, status page updates, post-mortems | ✓ | ✓ |
| On-call schedules, escalation policies, alert delays and repeats | ✓ | ✓ |
| Uptime report schedule, SLA reports and check export | ✓ | ✓ |
| Status page subscriber counts | ✓ | ✓ |
| Status page subscribers' addresses: list, export, remove | ✓ | — |
| The brand reports carry (name, logo, reply-to) | ✓ | — |
| Billing, credit and invoice details | ✓ | — |
| API tokens and connected agents | ✓ | — |
| Members and invitations | ✓ | — |
| Single sign-on and the audit log | ✓ | — |
Admins change roles and remove people in the same list. Anyone can leave a workspace, except its last admin: make someone else an admin first.
Seats
| Plan | Seats |
|---|---|
| Free | 1 |
| Pro | 3 |
| Business | 10 |
A pending invitation takes a seat until it is accepted or revoked. After a downgrade, everyone keeps access, but no one can be invited until fewer seats are in use.
Audit log
On the Business plan, Settings → Audit log lists every change in the workspace: who made it (a person, an API token or an agent), when, from which IP address, and which fields changed. Filter it by what changed, by person and by date. Values of secrets, check addresses and alert destinations are never kept, only that they changed. Entries are kept for a year, and the API reads them with GET /api/v1/audit-log (see the API reference).
Recording starts when the workspace moves to Business.
Single sign-on (SAML)
On the Business plan, admins set up SAML single sign-on in Settings → Single sign-on. It works with Okta, Microsoft Entra ID, Google Workspace and any other SAML 2.0 identity provider.
- Prove you own the domain. Enter your team's email domain, such as
example.com, and add the TXT record shown,_upheron-verification.example.com, at your DNS provider. Then choose Check DNS record. - UpHeron sets up the connection. We connect your domain and show the values your identity provider needs.
- Connect your identity provider. Create a SAML app with the ACS URL and entity ID shown. Send the user's email address as the NameID or as an attribute named
mail; first and last names are optional. Then give UpHeron your identity provider's metadata URL, its metadata XML, or its entity ID, sign-in URL and signing certificate. - Turn it on. Test the app in your identity provider first. Once it is on, everyone with an address at your domain signs in through your identity provider: on the sign-in page they enter their email address and are sent there. People who sign in that way for the first time join the workspace as members, while it has a free seat.
Turn it off or remove it in the same place; people then sign in with their own UpHeron sign-in again. If the workspace leaves the Business plan, single sign-on is switched off for it.