Chargebee User Management Guide

• Model type: hybrid
• Description: Chargebee uses a set of predefined built-in roles (Administrator, Manager, Support, Finance) combined with the ability to create custom roles on higher-tier plans. Custom roles allow administrators to select specific module-level permissions (e.g., read-only vs. read-write per feature area).
• Custom roles: Yes
• Custom roles plan: Performance or Enterprise
• Granularity: Module-level (per feature area such as Subscriptions, Customers, Invoices, Reports, Settings); read vs. read-write distinction per module.

1. Log in as an Administrator.
2. Navigate to Settings > Team & Security > Users.
3. Click 'Invite User'.
4. Enter the invitee's email address.
5. Select a role (built-in or custom, depending on plan).
6. Click 'Send Invite'.
7. Invitee receives an email and must accept the invitation to activate their account.

Required fields: Email address, Role

Watch out for:

• Invitation must be accepted by the invitee before the account is active; pending invites can be resent or cancelled.
• The inviting user must have Administrator role.
• Custom roles are only selectable on Performance or Enterprise plans.
• If SSO is enforced, new users must authenticate via the configured IdP after accepting the invite.

• Can delete users: No
• Delete/deactivate behavior: Chargebee does not permanently delete user accounts. Administrators can deactivate (disable) a user, which revokes their login access. The user record is retained in the system for audit and historical purposes.

1. Log in as an Administrator.
2. Navigate to Settings > Team & Security > Users.
3. Locate the user to be deactivated.
4. Click the options menu (three dots or 'Edit') next to the user.
5. Select 'Deactivate' or 'Disable User'.
6. Confirm the action.

Watch out for:

• Deactivated users cannot log in but their historical activity and audit logs are preserved.
• API keys are not automatically invalidated when a user is deactivated; administrators must manually revoke them.
• There is no bulk deactivation option in the UI; each user must be deactivated individually.
• If SSO is enabled, revoking access in the IdP does not automatically deactivate the user in Chargebee unless SCIM provisioning is configured.

• Where to check usage: Settings > Team & Security > Users (shows list of all active and pending users)
• How to identify unused seats: Review the Users list for accounts with no recent login activity. Chargebee does not natively surface a 'last login' timestamp in the UI as of available documentation; administrators must manually review or use audit logs.
• Billing notes: Chargebee does not charge per user seat. Billing is based on monthly billing volume processed through the platform (with overage fees on Performance plan above $100K/month). Adding or removing users has no direct impact on subscription cost.

Every app in a mature SaaS stack demands its own offboarding checklist, and Chargebee surfaces two friction points that slow teams down. First, there is no bulk deactivation: each user must be disabled individually through the UI.

Second, deactivating a user does not automatically revoke their API keys - those must be hunted down and invalidated separately.

The platform retains no native 'last login' timestamp in the user list, so identifying stale accounts requires a manual audit of activity logs. For teams managing frequent contractor or vendor access, this adds recurring overhead with no shortcut.

The most consistent complaint from practitioners is that SSO is gated to the Enterprise plan, leaving Starter and Performance customers without federated login. A related gap: only one IdP can be configured at a time, which creates friction for organizations mid-migration between identity providers.

When SSO is active, two-factor authentication is disabled with no fallback MFA option - a security posture concern flagged repeatedly in community threads. Users on Performance plan also report that overage fees above $100K/month billing volume can surface unexpectedly if monitoring is not in place.

Common complaints:

• SSO is restricted to Enterprise plan, making it inaccessible to smaller teams on Starter or Performance plans.
• Only a single IdP can be configured at a time for SSO.
• Two-factor authentication (2FA) is disabled or unavailable when SSO is enabled, leaving no fallback MFA option.
• Overage fees on the Performance plan are reported as unclear or unexpected by some users.
• No bulk user import via CSV; users must be invited one at a time through the UI.
• SCIM provisioning for automated user lifecycle management requires Enterprise plan, which is cost-prohibitive for mid-market customers.
• No native 'last login' visibility in the user management UI, making it difficult to identify inactive accounts.

Chargebee's manual user management is workable for small, stable teams but does not scale cleanly. The one-at-a-time invite and deactivate flow, combined with no CSV import and no last-login visibility, means every app offboarding event requires deliberate manual steps rather than a repeatable process.

Teams that need SSO, automated provisioning, or custom roles should budget for Enterprise. Performance plan unlocks custom roles but not SSO - a meaningful gap if identity governance is a priority.

Bottom line

Chargebee is a billing-first platform, and its user management reflects that priority: functional for small admin teams, but under-equipped for organizations that need automated lifecycle controls.

No per-seat cost removes one variable, but the absence of bulk operations, native last-login data, and SSO below Enterprise means that every app connected to a departed employee's Chargebee access requires a manual, step-by-step remediation.

Teams with high user turnover or strict access review cadences will feel the gap most acutely.