Members and Roles

Use this page to understand organization roles, onboard members, and check what happens to seats when members leave. A completed purchase does not mean every member has access: verify that each user has joined the intended organization and has an available seat. Start at: the organization's Members page after signing in to Qoder CN. You can also enter the management console from the corresponding instance in the Alibaba Cloud Qoder console.

​

Four organization roles

Organizations have four member roles. Admins and Members occupy seats; Config Admins and Directory Members do not.

• Config Admin: Has full organization management permissions, can access the management console and manage organization members, and is responsible for the initial subscription purchase and organization creation, subsequent seat purchases, and renewals in the Alibaba Cloud console. Does not occupy a seat and cannot use paid features or Credits.
• Admin: Has organization management permissions and can access the management console. Can also use the advanced features and seat resources included in the subscription plan.
• Member: Can use the advanced features and seat resources included in the subscription plan. Has no organization management permissions.
• Directory Member: Used to sync organization members to Qoder CN without occupying seats when they join, allowing administrators to assign seats within the organization as needed. Cannot use paid features or Credits and has no organization management permissions.

Config Admin is intended for people responsible for subscription or organization management. When a Directory Member needs paid features, an administrator changes their role to Member and assigns a seat. Admins and Config Admins can perform the member management operations below. In these instructions, “administrators” includes both roles.

​

Role permissions

​

Add members

You can add organization members by configuring single sign-on.

Test-environment example. 全部成员 contains the seat summary and the 调整席位数量 / 添加成员 entries. Counts are sample data, not default allocations.

​

Join with SSO

Administrators can go to Organization Settings > Security & Identity to configure domain verification and single sign-on (SSO). Both SAML and OIDC are supported. See:

• Configure domain verification
• Configure SSO

After configuration is complete and SSO is enabled, any email account matching an enabled domain automatically joins your organization with the default role at sign-in. When configuring SSO, review the scope of the enabled domains to ensure that automatically joined users match your expectations.

• If the default role is Admin or Member, the user needs one available seat to join. If there are insufficient seats, automatic member addition fails. Contact a Config Admin to purchase more seats, or ask an administrator to change the default role, then try signing in again.
• If the default role is Config Admin or Directory Member, users join without occupying seats and are not limited by the number of available seats.

To let users join the organization first and use paid features later as needed, set the default role to Directory Member.

​

Check access after onboarding

Have the member sign in using the organization's configured method. In Members, verify their account, role, and seat; then have the member check the organization and access in the client.

• Not in the organization: check the invitation or identity-provider configuration.
• Joined but no seat available: compare purchased and occupied seats, and add seats if needed.
• A seat is available but Credits cannot be used: check organization balance, personal limits, and billing group limits.

​

Modify Member Roles

Administrators can change organization member roles. Go to Organization Settings > Member Management, select the target user, click the ... icon on the right, and select Edit Role. Role changes automatically adjust seat occupancy. There is no need to assign or release seats separately:

• Changing a Config Admin or Directory Member to Admin or Member occupies one available seat. If no seat is available, the change fails and the original role remains unchanged.
• Changing an Admin or Member to Config Admin or Directory Member releases the seat while keeping the user in the organization. In Enterprise, the seat becomes available immediately. In Teams, if the user has not used any Credits during the current usage period, the seat is returned and can be reassigned; otherwise, it cannot be reassigned during that period.
• Switching between Admin and Member retains the existing seat. Switching between Config Admin and Directory Member continues without occupying a seat.

For example, changing an Admin to Config Admin preserves organization management permissions while releasing the seat. Changing a Member to Directory Member removes access to paid features and Credits while retaining organization membership. A Config Admin cannot change their own role to Admin; another member with organization management permissions must make this change.

​

Remove members

Administrators can remove organization members at any time. The removal takes effect immediately as long as the organization continues to meet its minimum member-count and role requirements. Go to Organization Settings > Member Management, select the target user, click the ... icon on the right, and select Remove Member. After removal, the member leaves the organization and is downgraded to the trial plan. To reclaim a seat while retaining organization membership, change the user to Directory Member. To also retain administrative permissions, change the user to Config Admin. Removing a Config Admin or Directory Member does not release a seat. Note the following rules:

• Enterprise: When a member occupying a seat is removed, the seat is automatically released and becomes available. It can be reassigned to another member within the current usage period. Seats are assigned automatically in the background, so you do not need to select one manually. A seat can be occupied by only one member at a time.
  • Releasing a seat does not increase the organization's resource quota or Credits.
  • Knowledge in the enterprise knowledge base belongs to the organization and is not deleted or transferred when a member is removed.
• Teams: Because each seat includes a Credits quota, removing a member occupying a seat clears the remaining Credits on that seat. If the member has not used any Credits during the current usage period, the seat is returned and can be reassigned to another user. If they have used Credits, the seat cannot be reassigned during that period. The same seat return rules apply when changing to a role that does not require a seat.
• If SSO is enabled, also revoke the user's access to Qoder CN in your identity provider (IdP) to prevent them from automatically rejoining the organization via SSO.

​

Members and seat billing

Config Admins and Directory Members do not occupy seats, so you do not need to purchase additional seats for them. An available seat is required when changing their role to Admin or Member. Qoder CN charges based on the number of seats purchased and the subscription duration. The seat term starts when the order is successfully paid and the subscription takes effect. Assigning a seat to a specific member does not affect the start time or validity period of a purchased seat. Changing a Directory Member to Member uses an existing available seat in the organization. If additional seats are needed, they are billed according to the subscription rules for those seats. See Billing description and Add seats. When a member occupying a seat is removed or changed to a role that does not require a seat, any seat charges already incurred are non-refundable, and no refund is provided for the remaining time. Whether the seat can be reassigned depends on the plan. See Remove members.