Invite and configure your team

To help a colleague work with your data, choose what they can do and which data they can use, then invite them. After they join, check access from their account. An invitation or successful sign-in alone does not confirm membership or query access.

Before you start

• Check the workspace name in Settings before changing users or access.
• You need permission to invite users and manage groups. The invitation form requires a role.
• Know the person's exact email, the product actions they need, and the datasources they should use. Have a small approved query with a known result ready to check access.
• If you will configure SSO, you also need workspace SSO access and permission to manage SSO.

1. Prepare roles and data access

Open workspace Settings. Under Access, use Roles for product actions and Groups for datasource access. Users are people in the workspace; a persona or job title is not a permission role.

1. Under Roles, choose a role that permits the colleague's work. Admin is the built-in role and permits all workspace actions, including deletion. Its permissions cannot be edited. New workspaces also include an editable Member role. For a custom role, select New role, enter a name and select Create role. Configure its Features and Admin permissions before assigning it; a new custom role includes baseline workspace access, but you must choose the actions this colleague needs.
2. Under Groups, open the intended group or use New group > Create group. On its Datasources tab, choose the approved credential for each datasource the colleague needs. Confirm the saved selection.

The first credential on a datasource is initially assigned to Everyone. Review that assignment before adding group grants. No access removes only the selected group's credential contribution; Everyone and other grants may still apply. To run a query, a person needs datasource permission and exactly one distinct authorized credential. Admin or credential-management permission does not grant query access. See credential selection for conflicts and Datasources and credentials for connection setup.

2. Send and review the invitation

1. Open Settings > Users and select Invite user.
2. Enter the person's exact Email. Review the preselected Role and choose Member or the custom role prepared for this colleague. A role is required; create one first if none is available. Choose any prepared Groups with Add to groups. Group choices appear when groups exist and your permissions allow them.
3. If shown, review the datasource credential preview. It combines grants from Everyone with the selected role and groups. It does not test datasource permission, credential conflicts or a query; an empty preview does not prevent an invitation.
4. Select Send invite, then check the result and Pending invites.

To resend, use Resend invite from the pending row's actions menu. To change its proposed assignments, use Remove, review the confirmation, then send a new invitation. Resending alone will not change them.

3. Check recipient membership

Ask the colleague to follow the original invitation email with the invited identity. Then check that they appear under Users with the intended role and groups, and that their invitation is no longer pending.

Existing-account limitation: For an existing Querio account outside this workspace, the standard invitation's password or Google sign-in path does not add the account to the workspace. Opening the link while already signed in also redirects without accepting the invitation. Sign-in may succeed while the invitation remains pending.

If this happens, stop setup and contact Querio support or use Settings > Support. Include the workspace, invited email, sign-in method and observed invitation status. Do not send passwords, client secrets or full invitation links. Continue only after membership is established.

4. Review access as the colleague

Once the person is a workspace member:

1. Check their Users row and group memberships. The displayed role is their highest-ranked role, not their complete set of permissions. Changing Role there replaces other role memberships but preserves groups. A role's Members tab lists its users; manage role assignments from Users.
2. Share an Explore or board with the intended access. Have the colleague open it in their own session.
3. If they need to query, have them select the intended datasource and run the small approved query. Inspect the executed code and compare its result with the known answer.

Seeing an Explore or its stored results does not establish query access. If access fails, review datasource permission and grants from Everyone, roles, groups and existing direct assignments. Credential selection explains missing and conflicting credentials; Verify an answer covers checking results.

Single sign-on

Configure SSO with your identity-provider administrator when your workspace needs it. The current configuration page says Okta OIDC; confirm compatibility for your provider before changing the sign-in policy.

Existing-account restriction: An existing Querio account outside this workspace with no identity linked to this SSO connection is rejected before its invitation can be accepted. Do not rely on SSO to resolve the existing-account invitation limitation. Contact support if this affects the colleague.

1. Open Settings > Single sign-on and select Set up SSO, or Edit SSO for an existing connection. If the action is unavailable, check workspace SSO access and your management permission.
2. On Configure Single Sign-On, enter the approved settings:

3. Select Save SSO. Check for Single sign-on configured, then select Return to Querio and confirm the displayed domain and mode.
4. Test sign-in with an intended, eligible account. Check its workspace membership and data access using the steps above.

Disabled prevents SSO through this connection. Optional permits SSO without enforcing it. Enforced requires SSO in the applicable sign-in flow; check eligible accounts before relying on it. Saving the configuration does not test sign-in, assign roles or groups, or authorize a database query.