Why do new SSO users join my team as Read-Only?

Last updated: October 12, 2026

If your team uses SSO and new users are landing with the Read-Only role, your team's Default Role for SSO is most likely not set. Team Owners can change it in a few clicks, and the change applies to everyone who joins after that.

What happens by default

When someone signs in to your team through SSO for the first time, Honeycomb assigns them your team's SSO Default Role. If no Default Role has been chosen:

  • Teams on plans that include the Read-Only role (Enterprise plans) add new users as Read-Only.

  • Teams on other plans add new users as Member.

Read-Only users can view and query everything public in the team but cannot create, edit, or delete anything, including Boards, Triggers, SLOs, and saved queries. See Team Permissions for the full breakdown.

Why your team may not have a Default Role set

The Default Role setting was added in May 2026. Teams that configured SSO before then have no Default Role set, so the fallback above applies. Teams that set up SSO after that chose a Default Role as part of setup.

Change the Default Role (Team Owners)

  1. From the main navigation menu, select Account > Team settings.

  2. Open the Team Details tab and find the Single Sign-On section.

  3. Under Default Role, choose Member, Owner, or Read-Only.

The change saves automatically and applies to users who join from that point on. You do not need to reconfigure SSO or your identity provider.

Fix users who have already joined

Changing the Default Role does not change the role of anyone already on the team. To update existing users:

  1. In Team settings, select the Users tab.

  2. Find the user and choose a new role from the Role column.

Roles are changed one user at a time. There is currently no bulk role change and no API for team member roles. If you have a large number of users to update, contact us through the support portal and we can help.

Related