Contentful User Management Guide

• Model type: hybrid
• Description: Contentful uses a two-tier permission model. At the organization level, users are assigned one of three roles (Owner, Admin, Member) controlling org-wide capabilities. At the space level, users are assigned one of five built-in roles (Admin, Editor, Author, Translator, Viewer) or a custom role. Space-level permissions are highly granular and can be scoped by content type, locale, and action (create, read, update, publish, archive, delete). Users must be organization members before they can be added to a space.
• Custom roles: Yes
• Custom roles plan: Team plan and above
• Granularity: Space-level custom roles support per-content-type, per-locale, and per-action (create, read, update, publish, archive, delete) permission rules. Environment-level access can also be restricted.

1. Log in to Contentful and navigate to your Organization via the top-left organization switcher.
2. Go to Organization Settings → Organization members.
3. Click 'Invite users'.
4. Enter the invitee's email address.
5. Select the organization-level role (Owner, Admin, or Member).
6. Optionally, select one or more spaces and assign a space-level role for each.
7. Click 'Send invitation'. The invitee receives an email and must accept to gain access.
8. To add an existing organization member to a space: go to Space Settings → Space members → Add members, select the user, and assign a space role.

Required fields: Email address, Organization role (Owner, Admin, or Member), Space role (required if adding to a space at invitation time)

Watch out for:

• Invitations expire if not accepted; a new invitation must be sent if the link expires.
• Users must have a Contentful account or create one upon accepting the invitation.
• Adding a user to the organization does not automatically grant them access to any space; space roles must be assigned separately.
• On the Free plan, the organization is limited to 5 users total across all spaces.
• On the Lite plan, up to 20 users are included; additional users may incur overage charges depending on plan terms.
• SSO-enforced organizations may require users to authenticate via the configured IdP before they can accept invitations.

• Can delete users: Yes
• Delete/deactivate behavior: Contentful allows removing (deleting) a user from an organization or from a specific space. Removing a user from the organization revokes all access across all spaces in that organization. Removing a user from a space only revokes access to that space while retaining their organization membership. There is no 'deactivate' or 'suspend' state; removal is immediate and permanent for that organization/space. The user's Contentful account itself is not deleted-only their membership in the organization or space is removed.

1. To remove a user from the entire organization: go to Organization Settings → Organization members.
2. Locate the user in the member list.
3. Click the options menu (three dots) next to the user's name.
4. Select 'Remove from organization'.
5. Confirm the removal in the dialog. The user immediately loses access to all spaces in the organization.
6. To remove a user from a single space only: go to Space Settings → Space members.
7. Locate the user, click the options menu, and select 'Remove from space'.
8. Confirm the removal.

Watch out for:

• The Organization Owner cannot be removed without first transferring ownership to another member.
• Personal access tokens created by the removed user are not automatically invalidated; administrators should audit and revoke tokens manually.
• If SSO/SCIM is configured, deprovisioning via the IdP will remove the user from Contentful automatically; manual removal in the Contentful UI may also be required depending on SCIM configuration.
• Removing a user from a space does not remove them from the organization; they retain org membership and can be re-added to spaces.
• There is no audit log of content changes attributed to removed users visible in the standard UI on lower-tier plans.

• Where to check usage: Organization Settings → Subscription → Usage (shows current user count and plan limits)
• How to identify unused seats: Contentful does not provide a native 'last login' or 'inactive user' report in the admin UI. Administrators must cross-reference organization member lists manually or use the Contentful Management API (GET /organizations/{orgId}/users) to enumerate users and audit activity via API access logs if available on their plan.
• Billing notes: User seats are counted at the organization level. On the Free plan, the hard cap is 5 users. On the Lite plan, the included user count is 20; exceeding this may trigger overage charges. Enterprise plans typically negotiate a user count as part of the contract; overages are subject to contract terms. Seat reductions from removing users may not reflect in billing until the next billing cycle. Space add-ons (Medium, Large, XL, etc.) are priced separately from user seats.

Contentful provides no native last-login or inactive-user report in the admin UI. Identifying unused seats requires manually cross-referencing the Organization members list or querying the Management API - there is no one-click audit view. Personal access tokens created by removed users are not automatically revoked, so every offboarding requires a separate token audit step.

Invitation links expire silently; if a user does not accept in time, admins must re-send without any in-app alert.

Recurring friction reported by Contentful admins centers on three areas. First, SCIM and SSO are gated behind Enterprise (High Availability or Scale) plans, making automated lifecycle management unavailable to smaller teams entirely.

Second, the split between org-level and space-level membership management causes role gaps - a user added to the org is not automatically added to any space, and vice versa.

Third, there is no audit log of content changes attributed to removed users in the standard UI on lower-tier plans, which creates gaps in accountability after offboarding.

Common complaints:

• Complex plan requirements for features like custom roles and SSO, which are gated behind Team or Enterprise tiers.
• No native 'last login' or inactive user reporting in the admin UI, making it difficult to identify unused seats without using the Management API.
• Personal access tokens created by removed users are not automatically revoked, creating a potential security gap.
• Invitation links expire without clear notification to admins, requiring re-invitation of users who did not accept in time.
• Organization-level and space-level permissions are managed in separate locations, which can cause confusion when onboarding users.
• SCIM provisioning requires both SSO and an Enterprise plan, making automated user lifecycle management inaccessible to smaller teams.
• No bulk CSV import for users; large-scale user onboarding requires either manual invitation or SCIM/API integration.
• Admin management complexity for SCIM authorization, particularly around token generation and IdP configuration.

Manual administration in Contentful is workable for small, stable teams on Free or Lite plans where user counts are low and turnover is infrequent. For organizations managing more than 20 users, multiple spaces, or frequent role changes, the absence of inactive-user reporting and the two-location management model create meaningful ongoing overhead.

The goal of keeping every app in your environment consistently provisioned and deprovisioned becomes harder to sustain without either SCIM automation or a disciplined manual process - and SCIM requires an Enterprise contract with SSO already configured.

Bottom line

Contentful's permission model is thorough but deliberately split across two administrative surfaces, and the platform provides no native tooling to surface inactive users or automatically clean up access tokens on removal.

For teams on Enterprise plans with SSO in place, SCIM provisioning handles the lifecycle automation gap well. For everyone else, offboarding and seat auditing are fully manual processes that require consistent discipline to execute without leaving residual access behind.