Summary and recommendation
Help Scout user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
Help Scout uses three fixed roles - Owner, Administrator, and User - with no custom roles available. Mailbox-level access adds a secondary scoping layer, but only for the User role; Admins and the Owner always have access to every mailbox. User management lives at Manage → Users & Teams (https://secure.helpscout.net/settings/users/).
There is no full SCIM provisioning on Standard or Plus plans. JIT provisioning via SSO is available, but only on the Pro plan at $65/user/month (annual billing only), and it does not automate deprovisioning when a user is removed from your IdP.
Like every app that gates lifecycle automation behind a top-tier plan, the cost-benefit calculation depends heavily on team size and offboarding frequency.
Quick facts
| Admin console path | Your Account (avatar) → Manage → Users & Teams |
| Admin console URL | Official docs |
| SCIM available | Yes |
| SCIM tier required | Pro |
| SSO prerequisite | No |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Owner | Full account control: billing, plan changes, all settings, all mailboxes, user management, can delete the account. Only one Owner per account. | Cannot share Owner role; only one Owner exists at a time. Owner cannot be deactivated by other admins. | All plans | Counts as one paid seat (same per-user rate as other roles) | Ownership transfer requires the current Owner to reassign the role manually from account settings. |
| Administrator | Manage users, mailboxes, teams, workflows, and most account settings. Access all mailboxes by default. Can invite and deactivate users. | Cannot change billing/plan or transfer ownership. Cannot access billing settings. | All plans | Counts as one paid seat | Admins can grant or restrict mailbox access for Users but cannot restrict their own access or another Admin's access. |
| User | Respond to conversations in mailboxes they are assigned to. Can manage their own profile and notification settings. | Cannot access account settings, manage other users, create mailboxes, or view mailboxes they have not been granted access to. | All plans | Counts as one paid seat | Mailbox access is controlled per-mailbox by Admins/Owner. A User added to the account but not assigned to any mailbox cannot see any conversations. |
Permission model
- Model type: role-based
- Description: Help Scout uses three fixed roles (Owner, Administrator, User). There are no custom roles. Mailbox-level access can be toggled per user for the User role, providing a secondary layer of access scoping. Admins and Owners always have access to all mailboxes.
- Custom roles: No
- Custom roles plan: Not documented
- Granularity: Role level (3 fixed roles) plus per-mailbox access toggle for User-role members.
How to add users
- Log in as Owner or Administrator.
- Navigate to Manage → Users & Teams (https://secure.helpscout.net/settings/users/).
- Click 'Invite User'.
- Enter the invitee's email address.
- Select a role: Administrator or User.
- Optionally assign the user to one or more Teams.
- Click 'Send Invite'. The invitee receives an email to set their password and activate their account.
- After the user accepts, Admins/Owner can edit mailbox access from the user's profile.
Required fields: Email address, Role (Administrator or User)
Watch out for:
- Invitations expire; if the user does not accept, the invite must be resent.
- Adding a user immediately increases the seat count and billing on the next billing cycle.
- Users are not automatically added to any mailbox; mailbox access must be configured separately for User-role members.
- There is no bulk CSV import for users; each user must be invited individually unless using SSO JIT provisioning.
- SSO/JIT provisioning is only available on the Pro plan.
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | No | Not documented |
| Domain whitelisting | No | Automatic domain-based user add |
| IdP provisioning | Yes | Pro |
How to remove or deactivate users
- Can delete users: No
- Delete/deactivate behavior: Help Scout does not permanently delete user accounts. Users can only be deactivated (disabled). Deactivated users cannot log in and do not consume a paid seat, but their profile and conversation history remain in the account for audit and attribution purposes.
- Log in as Owner or Administrator.
- Navigate to Manage → Users & Teams (https://secure.helpscout.net/settings/users/).
- Locate the user in the list.
- Click the user's name to open their profile.
- Click 'Deactivate User'.
- Confirm the deactivation in the dialog.
| Data impact | Behavior |
|---|---|
| Owned records | Conversations previously assigned to the deactivated user remain in the mailbox and retain the user's name as the assignee. They are not automatically reassigned. |
| Shared content | Saved replies, notes, and other content created by the user remain accessible to the team. |
| Integrations | API keys or OAuth tokens issued to the deactivated user may stop functioning; any personal integrations tied to that user account should be reviewed and transferred before deactivation. |
| License freed | Yes. Deactivating a user removes them from the active seat count, reducing the billable user total at the next billing cycle. |
Watch out for:
- Conversations assigned to a deactivated user are not automatically reassigned; admins should manually reassign open conversations before deactivating.
- A deactivated user can be reactivated at any time, which will add a seat back to the billing count.
- The Owner account cannot be deactivated; ownership must be transferred first.
- Deactivation does not revoke active SSO sessions immediately; the user's SSO session may persist until it expires.
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| User seat (Standard plan) | All three roles (Owner, Admin, User). Access to core help desk features, 2 mailboxes, live chat, beacon. | $22/user/month billed annually (approximately $25/user/month billed monthly) |
| User seat (Plus plan) | All Standard features plus custom fields, advanced reporting, 5 mailboxes, HIPAA compliance add-on eligibility. | $44/user/month billed annually (approximately $50/user/month billed monthly) |
| User seat (Pro plan) | All Plus features plus SSO, JIT provisioning, concierge onboarding, higher API rate limits, unlimited mailboxes. | $65/user/month billed annually (Pro is annual-only) |
- Where to check usage: Manage → Users & Teams (https://secure.helpscout.net/settings/users/) shows all active users. Billing seat count is visible under Manage → Account → Billing.
- How to identify unused seats: Help Scout does not provide a native 'last login' column in the Users list. Admins must review conversation activity per user or use the Reports section to identify users with no recent activity. There is no built-in idle-user report.
- Billing notes: Billing is per active (non-deactivated) user seat. Deactivating a user frees the seat on the next billing cycle. Pro plan is annual billing only. Standard and Plus plans are available monthly or annually. Usage-based pricing (based on contacts/conversations) is a separate model available as an alternative to per-seat pricing on some plans.
The cost of manual management
Help Scout does not expose a last-login timestamp in the Users list. Identifying inactive seats requires cross-referencing the Reports section or reviewing per-user conversation activity manually - there is no built-in idle-user report.
There is no bulk CSV import - each user must be invited individually, which compounds at scale. Conversations assigned to a deactivated user are not automatically reassigned; admins must audit and manually redistribute open tickets before deactivating anyone, or risk orphaned conversations.
What IT admins are saying
The most consistent friction reported by Help Scout admins centers on three gaps: no bulk user import, no automated deprovisioning, and no visible last-login data in the admin console.
Teams managing more than a handful of agents feel these gaps acutely during onboarding and offboarding cycles.
The three fixed roles are also a recurring complaint. Teams that want to grant limited administrative capabilities - such as mailbox management without billing access - have no intermediate option between Administrator and User.
The cost jump to Pro for SSO and JIT provisioning is flagged as disproportionate for teams whose primary need is automated user lifecycle management rather than the full Pro feature set.
Common complaints:
- No bulk CSV import for users; each user must be invited one at a time, which is tedious for large teams.
- No native SCIM provisioning/deprovisioning; JIT via SSO is available on Pro but does not support automated deprovisioning when users are removed from the IdP.
- No 'last login' or activity timestamp visible in the admin user list, making it difficult to identify inactive seats without manual investigation.
- Conversations assigned to deactivated users are not automatically reassigned, requiring manual cleanup.
- Custom roles are not available; the three fixed roles are considered too coarse for teams that want to grant limited admin capabilities without full Administrator access.
- SSO and JIT provisioning are locked to the Pro plan ($65/user/month annual), which is a significant cost jump from Plus for teams that primarily want automated user management.
The decision
Every app in a support stack eventually surfaces the same tradeoffs - fixed roles, no bulk operations, and no native idle-user detection - and Help Scout is no exception.
The permission model is straightforward, and the mailbox-access toggle gives Admins meaningful control over what User-role members can see, making it a practical fit for teams that can accept manual provisioning workflows.
Teams that need automated provisioning and deprovisioning should evaluate whether the Pro plan cost is justified. JIT via SSO reduces onboarding friction but does not close the deprovisioning gap - removed IdP users are not automatically deactivated in Help Scout.
SCIM on Pro addresses the full lifecycle but requires SSO to be configured first and is limited to Okta, Microsoft Entra ID, and OneLogin as officially supported IdPs.
Bottom line
Help Scout's manual user management is functional but labor-intensive at scale. Teams on Standard or Plus plans should build explicit offboarding checklists to handle conversation reassignment and seat deactivation, since neither happens automatically.
The Pro plan's SCIM support resolves the lifecycle automation gap but represents a significant per-seat cost increase, annual billing is required, and Google Workspace is not an officially supported IdP.
Automate Help Scout workflows without one-off scripts
Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.
