Invite & Manage Members

Add and manage your organization members to ensure the right people have access to Bitwarden.

[!NOTE] Different user provisioning methods This article discusses only one of the available methods to invite users and manage your subscription’s seat count:

• All organizations can manually invite users and update the seat count.
• Teams and Enterprise organizations can use SCIM.
• Teams and Enterprise organizations can use Directory Connector.
• Enterprise organizations can invite members using a shareable invite link.
• Enterprise organizations can use just-in-time (JIT).

Add new members

To ensure the security of your organization, Bitwarden applies a three-step process for adding and onboarding a new member: invite → accept → confirm. This is designed to facilitate secure sharing between organizations and users by maintaining end-to-end encryption.

Invite

[!TIP] Enterprise policy before inviting users For Enterprise organizations, Bitwarden recommends configuring Enterprise policies prior to inviting members to ensure compliance on entrance to your organization. Once users have entered the accept state, they will be subject to organization policies.

Choose a method to invite a user to your organization:

Email invite

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

Product switcher 2. Navigate to Members and select + Invite member:

Invite member to an organization 3. Select the By email tab:

• Enter the Email address where new users should receive invites. You can add multiple users at a time by comma-separating email addresses.
• Select the Member role to be applied to new users. Member role will determine what permissions these users will have at an organizational level.
• In the Groupstab, select which groups to add this user to.
• In the Collectionstab, select collections to give this user access to and what permissions they should have to each collection.
• Click Save to invite the designated users to your organization.

Invite by link

Enterprise organizations can generate a shareable invite link that anyone with the URL can use to request to join the organization, provided their email domain is on the link's allowed list. This lets administrators distribute invites through their preferred communication channels such as Slack or Teams messages, instead of relying on individual emails sent from Bitwarden.

Copy link

Valid invite links will consist of the following structure:

plain text https://vault.bitwarden.com/#/join/{inviteLinkCode}?key={inviteKey}

To generate an invite link:

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

Product switcher 2. Navigate to Members and select + Invite member:

Invite member to an organization 3. Choose the By link tab. 4. Enter one or more Allowed domains. While using invite links:

• Only email addresses on these domains can use the link to join.

• At least one domain must always be present, you cannot generate an unrestricted link.

• Allowed domains provide additional security to links. You should only allow trusted domains. Broad domains such as gmail.com are not recommended.

• If the organization has a claimed domain, the claimed domain will be pre-populated in the field.

[!NOTE] Restrict link domain Allowed domains provide more control over who is able to attempt to join your organization. Additionally, please note that allowed domains are a different mechanism than Claimed domains. If your organization has a claimed domain, it will be automatically populated in the allowed domains for the first link generated. 5. Select Copy link and share through your preferred channel.

[!NOTE] To accept invite link In order to accept an invite link, a member's email address must be verified. Cloud accounts will typically be verified during sign-up. If an email is not verified, unverified users may log in to the web app and select Verify Email.

Refresh or restrict a link

The invite link does not expire on its own. To invalidate it, select Refresh to generate a new link, immediately deactivating the old one.

[!NOTE] invite link for enterprise users Invite links are available for Enterprise organizations. If your organization was downgraded from Enterprise, existing links will no longer work and the By link tab will be unavailable.

[!NOTE] Invitations expire Email invitations expire after five days, at which point the member will need to be re-invited. Re-invite members in bulk by selecting each member and using the ⋮ Options iconsto select Resend invitations:

Resend invitations in bulk

If you're self-hosting Bitwarden, you can configure the invitation expiration period using an environment variable.

Link invitations will not expire unless the link is rotated or manually deactivated.

Accept

In order for a user to accept an organization invite:

Email invite

Invited users will receive an email from Bitwarden inviting them to join the organization. Clicking the link in the email will open the Bitwarden web app, where the user can log in or create an account to accept the invitation:

Organization invitation

You must fully log in to the Bitwarden web app to accept the invitation. When you accept an invitation, an administrator will need to confirm access. Once confirmed, you'll be notified that you can access the organization. Additionally, organization members will have their email automatically verified when they accept an invitation.

Link invite

Invited users will receive a link through organization administrator's preferred method, such as email, Slack, Teams, etc. Once users have verified that the link is from a reliable source, clicking the link will redirect them to the organization invitation:

Open organization invite link

To join the organization:

• New users: Complete the fields shown in the dialogue to create a new Bitwarden account.
• Existing users: Select Log in located under the create account dialogue. Existing users must have an email verified account in order to accept an organization invitation.

Once you accept an invitation, an administrator will need to confirm access. Once confirmed, you'll be notified that you can access the organization.

[!NOTE] Link failure checklist The email address used to log in or create a new account while accepting an invite link will be verified against the organization's list of allowed domains. If using the link is unsuccessful, check:

• The address domain is a match to the organization's list of allowed domains.
• The administrators have not deleted, rotated, or deactivated the link.
• Your existing Bitwarden account is compliant with organization policies such as Single organization.
• You have not previously accepted an invitation to join this organization.

[!NOTE] Accepted status require compliance The following policies will require compliance before users can be confirmed. These policies include:

• Single organization
• Require two-step login

Confirm

To confirm accepted invitations into your organization:

1. Log in to the Bitwarden web app and open the Admin Console using the product switcher:

Product switcher 2. Navigate to Members. 3. Select any Accepted users and use the ⋮ options menu to ✓ Confirm selected:

Confirm member to an organization 4. Verify that the fingerprint phrase on your screen matches the one your new member can find in Settings → My account:

*Fingerprint phrase *

Each fingerprint phrase is unique to its account, and ensures a final layer of oversight in securely adding users. If they match, select Submit.

[!NOTE] Clear cache and cookie to restore fingerprint phrase prompt If Never prompt to verify fingerprint phrases has been toggled on, fingerprint phrase verification can be reactivated by clearing the browser cache and cookies.

Manage existing members

From the Members page, you can also review and update individual members' accounts, like adding them to groups, collections, or the Secrets Manager. Select the ⋮ Menu icon for available options per user:

Update member

Member statuses

Members can have one of the following statuses relative to your organization:

Invite staged members

To move a staged member into the invite flow so they receive an invitation email, use the invite them by link from the Admin Console. Once they interact with the invitation link and complete the flow, they'll move into the Accepted status.

Review 2FA and account recovery status

The Members page also notes which users have set up certain features in the Policies column. The 🔑 Key icon means the member is enrolled in account recovery. The 🔒 Lock icon is present when two-step login is used:

2FA status

Download list of members

If you want to view or share a list of all organization members outside of the Admin Console, owners, admins, and custom role users with Manage users permission can export a .csv. This is available to all organizations.

To export your member list, go to Members and select the ⬇️ Download icon:

Export member list

[!NOTE] Custom role, account recovery, member export Custom role users with Manage account recovery permission but not Manage users permission can download a .csv that only shows members who are enrolled in account recovery. All other members are excluded from the file.

Included data

The member list export includes the following information about each account:

[!TIP] Check collection access via Member access report Enterprise organizations can review the Member access report to learn which collection(s) members have access to, their level of permission within each assigned collection, and more.

Update members' account email and name

If your organization uses claimed domains and a member does not have a master password, administrators can change the member's email address and name.

Remove members

The Members page is also where you can withdraw someone from an organization. There are three methods:

• Temporarily revoke access
• Permanently remove access
• Delete organization member accounts

[!WARNING] Danger Zone Deleting an account or organization is permanent, cannot be undone or restored, and will delete all associated vault data. You may want to export data before proceeding with account or organization delete:

• Export individual vault data.
• Export organization vault data.