Summary and recommendation
Greenhouse user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
Greenhouse user management is handled through Configure > Users, accessible only to Site Admins. Every app in your stack has some version of role-based access, but Greenhouse layers site-level roles (Site Admin, Job Admin, Interviewer) with per-job permission scopes, meaning the same user can hold different access levels across different job postings.
Custom roles with granular permission selections are available only on Advanced or Expert plans.
Quick facts
| Admin console path | Configure > Users (top navigation bar, requires Site Admin role) |
| Admin console URL | Official docs |
| SCIM available | Yes |
| SCIM tier required | Advanced or Expert |
| SSO prerequisite | Yes |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Site Admin | Full access to all Greenhouse configuration, users, jobs, reports, and integrations. Can manage all other users and roles. | No documented restrictions within the platform. | All plans | Included in subscription; Greenhouse does not publish per-seat pricing publicly. | Site Admin role should be granted sparingly; there is no secondary super-admin tier above it. |
| Job Admin | Can manage specific jobs they are assigned to, including moving candidates through stages, scheduling interviews, and editing job details within their assigned jobs. | Cannot access Configure settings, manage other users, or view jobs they are not assigned to. | All plans | Included in subscription. | Job Admin permissions are scoped per job; a user may be Job Admin on some jobs and not others simultaneously. |
| Interviewer | Can view candidate profiles for interviews they are scheduled on, submit scorecards, and view their own interview schedule. | Cannot manage jobs, move candidates through stages, or access Configure settings. | All plans | Included in subscription. | Interviewers only see candidates they are directly scheduled to interview; broader candidate visibility requires a higher role. |
| Recruiter (built-in permission set) | Can manage candidates, move them through pipeline stages, create and edit jobs (if granted), and access recruiting reports. | Cannot access site-wide configuration or manage users unless also granted Site Admin. | All plans | Included in subscription. | Recruiter is a permission set applied on top of a base role, not a standalone role in all configurations. |
| Custom Role | Granular permissions configured by a Site Admin; can combine specific capabilities from multiple built-in roles. | Cannot exceed the permissions of Site Admin. | Advanced or Expert plan (not available on Essential/base plans) | Included in plan subscription if plan supports custom roles. | Custom roles are only available on higher-tier plans; customers on lower tiers are limited to built-in roles. |
Permission model
- Model type: hybrid
- Description: Greenhouse uses a combination of fixed built-in roles (Site Admin, Job Admin, Interviewer) and permission sets (Recruiter, Coordinator) that can be layered. On Advanced and Expert plans, Site Admins can create custom roles with granular permission selections. Job-level permissions are scoped per job, allowing the same user to have different access levels across different job postings.
- Custom roles: Yes
- Custom roles plan: Advanced or Expert
- Granularity: Permissions can be scoped at the site level, job level, and candidate level. Granular options include: view/edit candidates, manage offers, manage job settings, view confidential fields, manage users, and access specific report types.
How to add users
- Log in as a Site Admin.
- Navigate to Configure > Users via the top navigation bar.
- Click the 'Add User' button (or 'Invite User' depending on UI version).
- Enter the user's first name, last name, and email address.
- Select the appropriate user role or permission set.
- Optionally assign the user to specific jobs or departments.
- Click 'Send Invitation' to email the user an activation link.
Required fields: First name, Last name, Email address, User role or permission set
Watch out for:
- The invited user must activate their account via the emailed link before they can log in; there is no admin-set password option.
- If SSO is enforced, the user's email domain must match the SSO configuration or they will be unable to authenticate.
- Assigning a user to jobs is separate from setting their role; a user with Job Admin role but no job assignments has no effective access.
- Greenhouse does not support bulk CSV import of users through the standard UI; users must be added individually or via SCIM provisioning.
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | No | Not documented |
| Domain whitelisting | No | Automatic domain-based user add |
| IdP provisioning | Yes | Advanced or Expert (SCIM requires SSO to be configured first) |
How to remove or deactivate users
- Can delete users: No
- Delete/deactivate behavior: Greenhouse does not allow permanent deletion of user accounts. Users can only be deactivated (disabled). Deactivated users cannot log in and do not appear in active user lists, but their historical data, activity logs, scorecards, and candidate interactions are retained for audit and compliance purposes.
- Log in as a Site Admin.
- Navigate to Configure > Users.
- Locate the user by searching their name or email.
- Click on the user's name to open their profile.
- Click the 'Disable User' button (or 'Deactivate').
- Confirm the deactivation in the dialog prompt.
| Data impact | Behavior |
|---|---|
| Owned records | All candidate records, scorecards, notes, and activity attributed to the deactivated user are retained and remain visible to Site Admins and other authorized users. |
| Shared content | Job postings, interview kits, and other shared content the user contributed to remain intact and accessible to other team members. |
| Integrations | If the user was the owner of any integration credentials or API keys, those connections may need to be reassigned or reconfigured manually. |
| License freed | Deactivating a user frees up their seat for billing purposes on plans where seat count affects pricing, but Greenhouse's quote-based model means the practical billing impact depends on contract terms. |
Watch out for:
- Deactivated users can be reactivated by a Site Admin at any time; reactivation restores their previous role and permissions.
- If a deactivated user was the sole owner of a job or approval workflow step, those workflows may stall and require reassignment before deactivation.
- SCIM-based deactivation (via IdP) sets the user to disabled in Greenhouse but does not delete the account, consistent with manual deactivation behavior.
- Users deactivated via SCIM retain all historical data; the IdP deprovision event maps to the Greenhouse 'disable' action only.
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| Full User Seat | Access to Greenhouse recruiting platform with role-based permissions; applicable to Site Admins, Job Admins, Recruiters, and Coordinators. | Included in subscription; Greenhouse pricing is quote-based and not published per-seat publicly. |
| Interviewer / Limited Access | Restricted access for users who only need to submit scorecards and view their interview schedule. May not consume a full seat depending on contract terms. | Varies by contract; Greenhouse does not publish separate interviewer seat pricing. |
- Where to check usage: Configure > Users - filter by 'Active' status to see current active user count. No dedicated license usage dashboard is documented in official help articles.
- How to identify unused seats: Site Admins can review the Users list and sort or filter by 'Last Login' date to identify users who have not logged in recently. No automated unused-seat report is documented.
- Billing notes: Greenhouse uses quote-based, contract-driven pricing. Seat counts and billing adjustments are managed through the customer's account manager or contract renewal process, not through a self-serve billing portal. Deactivating users may reduce seat count at renewal depending on contract terms.
The cost of manual management
Adding users is a one-at-a-time operation - Greenhouse has no bulk CSV import through the standard UI. Every app provisioned manually carries the same hidden cost: job-level permission assignment does not sync via any automated method, so Site Admins must manually assign users to jobs after each invite.
Deactivation is the only offboarding option; permanent deletion is not supported, which creates overhead for teams managing data privacy workflows.
What IT admins are saying
The most consistent friction reported by admins centers on three gaps. First, SCIM provisions user accounts but not group memberships or job-level permissions - those require a manual follow-up step in the UI every time.
Second, Azure Entra ID carries a documented 40-minute sync interval, which visibly slows both onboarding and offboarding. Third, reactivating a previously deactivated user can silently restore stale permissions if role assignments were not cleaned up before deactivation.
Common complaints:
- No group provisioning via SCIM - only individual user accounts can be provisioned; group/role assignment must be done manually in Greenhouse after provisioning.
- 40-minute Azure Entra ID sync delay for SCIM provisioning, which can slow onboarding and offboarding workflows.
- Cannot fully delete users through SCIM or the UI - deactivation is the only option, which some admins find insufficient for data privacy compliance workflows.
- No bulk CSV import for users - each user must be added individually via the UI or provisioned through SCIM, which is only available on higher-tier plans.
- Job-level permission assignment is manual and does not sync via SCIM, requiring Site Admins to manually assign users to jobs after provisioning.
- Reactivating a previously deactivated user can inadvertently restore old permissions if role assignments were not cleaned up before deactivation.
The decision
SCIM provisioning requires the Advanced or Expert tier and SSO must be fully configured before SCIM can be enabled - teams on lower-tier plans are limited to manual, one-by-one user management. If your IdP is Azure Entra ID, factor in the 40-minute sync delay when setting SLA expectations for access provisioning.
For teams where job-level permission accuracy matters, no automated path currently covers that gap; it remains a manual step regardless of provisioning method.
Bottom line
Greenhouse gives Site Admins a workable but deliberately constrained user management surface.
The role model is well-structured for recruiting workflows, but the absence of bulk import, the SCIM group provisioning gap, and the mandatory manual step for job-level permissions mean that access hygiene scales poorly as headcount grows.
Teams on Advanced or Expert plans with a well-configured IdP will get the most automation coverage, but should plan for a persistent manual layer around job assignments and permission audits.
Automate Greenhouse workflows without one-off scripts
Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.
