Team access and SSO

Bring your team into Makini and give each person exactly the access their job needs. You can invite people one by one, or let your Google Workspace or Microsoft Entra ID directory decide who joins and with which role.

Your workspace

Your workspace is your company on Makini, and everyone you invite works inside it. A workspace holds one API application and one MCP application. Each has its own Client ID, connections and subscription. Open Organization settings from your avatar menu to see both and add the one you don't have yet.

The person who created the workspace is its owner. The owner can't be removed, so to hand the workspace over, open Organization settings and click Transfer ownership to pass it to another administrator.

Invite your team

Open Users

Click Users in the sidebar, then Invite user.

Enter their email address

Makini emails them a link to join the workspace. The link is valid for a limited time, and the list shows when it expires.

Assign roles

When they have joined, choose Change roles from their row menu.

While an invitation is pending, its row menu offers:

Resend invitation: sends a fresh email with a new link.

Cancel invitation: the emailed link stops working. You can invite the same address again at any time.

To take someone out of the workspace, choose Remove from workspace. The owner, the last admin and your own account can't be removed this way.

Roles and permissions

Access in the dashboard comes from roles. A member can hold several roles, and their permissions add up.

Admin is built in and can do everything. It can't be edited or deleted, and a workspace always keeps at least one admin.

Custom roles grant exactly the permissions you pick. On Users, click + beside Roles, name the role (for example "Analyst"), and tick its permissions.

The Roles list beside the members also works as a filter: select a role to see who holds it.

Permissions

Group	Permissions
Connections	View connections, their sync settings and the data explorer. Manage connections: create, connect, disconnect and configure syncing. Issue connection tokens, which read that connection's data. Edit field mappings. Edit data mappings.
Application settings	View settings, platforms and sync defaults. Change settings, redirect URIs and defaults. Manage client secrets. Manage platform credentials.
Webhooks	View webhook endpoints and their delivery settings. View the delivery log. Manage webhooks: add, edit and remove endpoints.
Team	View the team and its roles. Manage the team: invite and remove people, and create and assign roles.
Billing	View the plan, invoices and billing address. Manage billing: change the subscription and add applications.
MCP	View MCP users, roles and tool permissions. Manage them: create MCP users and roles, and set which tools they reach.
API logs	Read the request log, including request and response bodies.

Least privilege by design

Issuing connection tokens, managing client secrets and managing platform credentials are separate permissions, because each one hands out a live credential. Grant them only to the people who need them.

Managing the team lets someone change what everyone else can do, so treat it like admin access.

Anyone can sign in to Makini with a Google account or a Microsoft account instead of a password. The buttons are on the sign-in page.

Single sign-on for your directory

With single sign-on, people in your company directory join your workspace by signing in with their work account, and their roles come from the directory. Open Users → SSO to set it up. It needs the permission to manage the team, and a workspace has one SSO connection.

Google Workspace

Your team signs in with their Google accounts, and roles follow their organizational unit. You'll need to be a Google Workspace administrator.

Microsoft Entra ID

Your team signs in with their Microsoft work accounts, and roles follow their groups. You'll need to be an Entra administrator.

Google Workspace

Click Set up under Google Workspace and sign in as a Workspace administrator. Then map organizational units to Makini roles:

A rule covers the unit and its sub-units. The most specific rule wins, so a rule on /Engineering/Managers beats one on /Engineering, and a rule on / covers everyone.

People in a unit with no rule get the default role you choose.

Microsoft Entra ID

Click Set up under Microsoft and choose how to connect:

Connect with Makini (recommended): sign in once as an administrator and approve read-only access to your directory. There is nothing to set up in Azure.

Use your own app registration: your users sign in through an application in your own Entra tenant. Makini creates it and looks after its secret for you.

Use your own app registration, set up by hand: you register the application in Azure and enter its details. No administrator approval is needed.

Then map groups to Makini roles. Membership is transitive, so someone in a nested group counts as a member of the group that contains it. A person in several mapped groups gets every mapped role. People in no mapped group get the default role you choose.

How role rules apply

Rules apply when someone signs in through SSO for the first time. Changes in your directory later don't change roles in Makini, and roles you grant by hand are never touched.

Administrator access is never granted by a rule. Add admins from Users.

Refresh directory reloads your units or groups, so new ones appear in the mapping lists.

Remove stops new sign-ins from your directory joining the workspace and deletes the rules. Nobody already in the workspace loses membership or roles.

Several organizations

One person can belong to more than one workspace, for example as a consultant or a partner. To move between them, open your avatar menu and choose Switch organization. Makini remembers your choice the next time you sign in.

Notifications

Settings → Notifications controls the emails Makini sends you. Account and security emails, such as password resets and invitations, are always on. Product updates, such as announcements, digests and usage warnings, can be turned off.

Users and permissions: MCP users, roles and tool permissions for AI agents.

Team access and SSO

Your workspace#

Invite your team#

Roles and permissions#

Permissions#

Sign in with Google or Microsoft#

Single sign-on for your directory#

Google Workspace#

Microsoft Entra ID#

How role rules apply#

Several organizations#

Notifications#

Related#

Your workspace

Invite your team

Roles and permissions

Permissions

Sign in with Google or Microsoft

Single sign-on for your directory

Google Workspace

Microsoft Entra ID

How role rules apply

Several organizations

Notifications

Related