Summary and recommendation
AfterShip user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
AfterShip uses a role-based access control model with four default roles - Owner, Admin, Manager, and Support Agent - available across all plans. Enterprise customers can additionally configure custom roles with granular permission flags.
There is no native SCIM provisioning; every app in your stack that lacks SCIM requires manual offboarding, and AfterShip is no exception. SSO via SAML 2.0 is available on the Enterprise plan only, with JIT provisioning supported through Okta and Entra ID.
All user management is handled through the admin dashboard at Manage Organization > Members.
Quick facts
| Admin console path | Manage Organization > Members |
| Admin console URL | Official docs |
| SCIM available | No |
| SCIM tier required | Enterprise |
| SSO prerequisite | No |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Owner | Full permissions across all organization and product settings. Can invite members, transfer ownership, configure SSO, manage billing, and perform all admin actions. | Cannot be removed from the organization by any other member. Can only exit via ownership transfer. | All plans (one per organization) | Included; counts as one seat on paid plans | Only one Owner is permitted per organization. Ownership transfer requires typing CONFIRM and either entering account password or receiving a verification code via registered email. |
| Admin | Can manage organization-level settings and billing/subscription settings. Can edit roles of other members (except other Admins or Owner). | Cannot change the role of another Admin. Cannot invite members (invite is Owner-only per legacy docs; newer docs indicate owner/admin/roles with permissions can manage members). | All plans | Counts as one paid seat on Team/Enterprise plans | An Admin cannot modify the role of another Admin. Role reassignment requires member/create+edit and role/view permissions. |
| Manager | Can manage orders and feature settings within the product. | Cannot manage organization-level settings, billing, or member roles. | All plans | Counts as one paid seat on Team/Enterprise plans | |
| Support Agent | Can view orders only. | Cannot edit orders, manage settings, or manage members. | All plans | Counts as one paid seat on Team/Enterprise plans | |
| Member (legacy) | Full permissions. Applicable only to users created before the current RBAC model was introduced. | Not assignable to new users; legacy role only. | Legacy accounts only | Counts as one paid seat | This role cannot be assigned to new members. Existing legacy members retain it until role is changed. |
| Custom Role (Enterprise only) | Tailored permissions defined by the organization. Managers can design roles with specific permission sets matching team responsibilities. | Not available on non-Enterprise plans. | Enterprise | Counts as one paid seat | Custom role configuration requires contacting the AfterShip support or sales team. Only one role per account per organization is supported via the Members API. |
Permission model
- Model type: hybrid
- Description: AfterShip uses role-based access control (RBAC) with four predefined default roles (Owner, Admin, Manager, Support Agent) available on all plans. Enterprise customers can additionally create custom roles with granular permission sets. Each account is assigned exactly one role per organization.
- Custom roles: Yes
- Custom roles plan: Enterprise
- Granularity: Role-level for non-Enterprise (coarse-grained: Owner/Admin/Manager/Support Agent). Enterprise custom roles support granular permission flags such as member/create, member/edit, member/remove, and role/view.
How to add users
- Log in to the AfterShip admin dashboard.
- Navigate to Manage Organization > Members.
- Click 'Add members'.
- Enter the member's email address and select a role.
- Click 'Add'.
- AfterShip sends an invitation email with a link to set up or log in to an AfterShip account.
- If the email already has an AfterShip account, the invitation is accepted automatically.
- If the email does not have an account, the member is marked as 'pending' until they accept and register.
Required fields: Email address, Role selection
Watch out for:
- Only the Owner can invite members per legacy documentation; newer Shipping help docs indicate owner, admin, or roles with member/create permission can manage members - verify current behavior in your product version.
- For public (non-Enterprise) plans, a valid payment method must be on file before adding members, as charges apply immediately upon member acceptance.
- For Enterprise plans, member additions are constrained by the seat quota defined in the Sales Order.
- Pending members do not count against seat quota and are not charged until they accept the invitation.
- If the invited email already has an AfterShip account, the invitation is auto-accepted - no email confirmation step occurs.
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | No | Not documented |
| Domain whitelisting | No | Automatic domain-based user add |
| IdP provisioning | Yes | Enterprise (SAML 2.0 SSO with JIT provisioning) |
How to remove or deactivate users
- Can delete users: Yes
- Delete/deactivate behavior: AfterShip uses a 'Remove from organization' action rather than a deactivate/suspend state. Clicking the dropdown icon next to a member's name and selecting 'Remove from organization' immediately removes their access. There is no soft-deactivate or suspend option documented. The Owner cannot be removed; ownership must be transferred first.
- Log in to the AfterShip admin dashboard.
- Navigate to Manage Organization > Members.
- Click the dropdown icon next to the target member's name.
- Select 'Remove from organization'.
- Confirm the action.
| Data impact | Behavior |
|---|---|
| Owned records | Not explicitly documented. AfterShip does not publish details on what happens to shipments, returns, or other records owned by a removed member. |
| Shared content | Not explicitly documented. |
| Integrations | Not explicitly documented. API keys and integrations tied to the removed member's account may need to be reviewed separately. |
| License freed | Seat is freed immediately upon removal for public plans. For Enterprise plans, the seat count against the Sales Order quota is reduced. |
Watch out for:
- The Owner cannot be removed; ownership must be transferred to another existing member before the current owner can leave.
- Only owners, admins, or roles with the member/remove permission can perform removals.
- No documented deactivate/suspend state - removal is permanent from the organization context.
- Removing a member does not delete their AfterShip account; it only removes their membership in the organization.
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| Team seat | Full product access, custom roles and permissions, 2FA, SSO via Google/Shopify/BigCommerce. | $10/member/month billed annually; $12/member/month billed monthly |
| Enterprise seat | Everything in Team plus enterprise SAML SSO, company console, member management API, custom API rate limits. | Custom pricing (contact sales) |
- Where to check usage: Manage Organization > Members (shows active, pending, and total member count against quota)
- How to identify unused seats: Pending members who have not accepted invitations are visible in the Members section and do not consume a paid seat. Admins can review the member list for pending status and resend or cancel invitations for unused seats.
- Billing notes: For public (Team) plans, charges apply as soon as a member accepts an invitation - not when the invite is sent. Pending and declined requests do not result in charges. Trial seats automatically convert to paid seats at trial end if members are present. Annual billing is charged as a single upfront invoice (e.g., $120/seat/year at $10/month rate). For Enterprise plans, seat count is defined in the Sales Order; additions beyond quota require a contract amendment.
The cost of manual management
Every app without SCIM creates a manual offboarding obligation, and AfterShip has no native SCIM support on any plan. Removing a member requires navigating to Manage Organization > Members, locating the user, and confirming removal - there is no bulk action or IdP-triggered deprovisioning.
On Team (public) plans, charges begin the moment a member accepts an invitation, not when it is sent, so delayed offboarding directly translates to unnecessary seat spend. Pending invitations do not incur charges but must be actively monitored and cancelled if unused.
Enterprise seat additions beyond the contracted quota require a formal contract amendment, adding procurement friction to routine onboarding.
What IT admins are saying
Recurring themes in user feedback center on billing surprises and access management friction. Charges on public plans activate immediately upon invitation acceptance, which catches admins off guard when onboarding multiple users.
Ownership transfer is the only path to removing an Owner, creating an operational bottleneck if the original owner loses account access. SSO configuration requires backend involvement from the AfterShip Accounts team and cannot be completed entirely through the admin UI.
Reviewers also flag that custom roles, enterprise SSO, and certain customization features are gated behind the Enterprise plan, with no self-serve upgrade path for those capabilities.
Common complaints:
- Users report confusion over billing cycles and unexpected charges when members are added, particularly on public plans where charges begin immediately upon invitation acceptance.
- Some users report difficulty canceling subscriptions and receiving refunds, with complaints that the cancellation process is not self-serve.
- Reviewers note significant price jumps between plan tiers and frustration that certain features (e.g., custom roles, enterprise SSO, language customization) are locked behind the Enterprise plan.
- Only the Owner can transfer ownership, which creates an operational bottleneck if the original owner loses access to their account or email.
- SSO setup requires backend involvement from the AfterShip Accounts team and cannot be self-configured entirely in the admin UI.
- No native SCIM provisioning is available, meaning automated deprovisioning via IdP is not supported - offboarding must be done manually in the AfterShip admin.
Community observations (summarized from cited discussions):
- Some users report confusion over billing, costly upgrades, and frustration with restricted features on lower tiers. - GetApp aggregated review summary, 2025 (https://www.getapp.com/operations-management-software/a/aftership/reviews/)
- Some users note that pricing can be high for smaller businesses, especially when scaling up. - G2 aggregated review summary, 2026 (https://www.g2.com/products/aftership/reviews)
Representative quotes (verbatim):
It's totally a scam, I got billed on a plan which I'm not aware of, and somehow I can not cancel it.
- Trustpilot user review, 2025–2026 (https://www.trustpilot.com/review/www.aftership.com)
The decision
AfterShip is a reasonable fit for teams already on or willing to commit to the Enterprise plan, where SAML SSO with JIT provisioning reduces some onboarding friction. For teams on Team or lower plans, every provisioning and deprovisioning action is fully manual, with no IdP automation available.
The absence of SCIM means offboarding is a deliberate, per-user action - a meaningful compliance and security consideration for organizations with high employee turnover or strict access review requirements. Custom roles require contacting AfterShip support to configure, which limits self-serve role governance.
Teams that need automated lifecycle management should factor in the ongoing manual overhead before committing to a non-Enterprise tier.
Bottom line
AfterShip covers the basics of role-based access control but leaves a significant operational gap with no native SCIM provisioning on any plan. Every app without automated deprovisioning increases offboarding risk, and AfterShip requires manual removal for every departing user regardless of plan.
Enterprise customers gain SAML SSO with JIT provisioning, which partially offsets this, but custom role configuration still requires vendor involvement. Teams managing a large or frequently changing workforce should weigh the manual overhead carefully against the cost of Enterprise licensing.
Automate AfterShip workflows without one-off scripts
Stitchflow builds and maintains identity workflows for your exact setup. We cover every app, including the ones without APIs, and run deterministic trigger-to-report workflows with human approvals where they matter.
