Summary and recommendation
Windsurf user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
Windsurf offers a two-role permission model - Admin and Member - on its Teams plan, with RBAC controls unlocked only at Enterprise. Every app in your stack that touches developer identity will need a provisioning strategy; for Windsurf, that strategy is entirely manual on Teams and SCIM-automated only on Enterprise.
The admin console lives at windsurf.com/team and covers invitations, usage monitoring, and billing in one place.
Quick facts
| Admin console path | windsurf.com → Log in → Team Dashboard (top-right account menu) |
| Admin console URL | Official docs |
| SCIM available | Yes |
| SCIM tier required | Enterprise |
| SSO prerequisite | No |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Member | Access to Windsurf IDE with allocated credits; can use all AI features within credit limits set by admin. | Cannot manage billing, invite other users, view team usage dashboards, or modify team settings. | Teams or Enterprise | $30/user/month (Teams); $60/user/month (Enterprise with ZDR) | Each member consumes one paid seat; free-tier users cannot be mixed into a Teams/Enterprise org without being assigned a paid seat. |
| Admin | Can invite and remove members, manage billing, view team usage and credit consumption, configure SSO (Teams+), and manage SCIM/RBAC (Enterprise only). | Cannot assign custom roles below Enterprise tier; cannot configure SCIM provisioning on Teams plan. | Teams or Enterprise | Consumes one paid seat at the same per-user rate as Member. | Admin role is not a free/non-seat role; the admin also occupies a billable seat. |
Permission model
- Model type: role-based
- Description: Windsurf uses a two-role model (Admin and Member) on Teams. Enterprise adds RBAC controls allowing more granular permission configuration. Custom roles are an Enterprise-only feature.
- Custom roles: Yes
- Custom roles plan: Enterprise
- Granularity: Coarse on Teams (Admin vs. Member only); finer-grained RBAC available on Enterprise, details not fully documented publicly.
How to add users
- Log in to windsurf.com and navigate to the Team Dashboard.
- Select 'Members' or 'Invite Members' from the left navigation.
- Enter the invitee's email address.
- Assign a role (Admin or Member).
- Send the invitation; invitee receives an email to accept and create or link their Windsurf account.
- Seat is billed once the invitation is accepted.
Required fields: Email address, Role (Admin or Member)
Watch out for:
- Seats are billed upon invitation acceptance, not at the time of sending the invite.
- Inviting users beyond the current seat count triggers an immediate prorated billing charge.
- SSO enforcement (Teams plan) requires users to authenticate via the configured IdP before accessing the product.
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | Unknown | Not documented |
| Domain whitelisting | Unknown | Automatic domain-based user add |
| IdP provisioning | Yes | Enterprise |
How to remove or deactivate users
- Can delete users: Unknown
- Delete/deactivate behavior: Windsurf's public documentation does not clearly distinguish between deactivation and permanent deletion of a user account within a team. Removing a member from the team dashboard revokes their access to the team's resources and frees the seat. Whether the underlying Windsurf account is deleted or merely removed from the org is not explicitly documented publicly.
- Log in to windsurf.com and navigate to the Team Dashboard.
- Select 'Members' from the left navigation.
- Locate the user to remove.
- Select the remove/revoke option next to the user's name.
- Confirm removal; the seat is freed at the next billing cycle or immediately depending on billing terms.
| Data impact | Behavior |
|---|---|
| Owned records | Not explicitly documented. AI conversation history and generated code artifacts are associated with the individual user account; behavior upon removal from a team is not publicly specified. |
| Shared content | Not explicitly documented. Windsurf does not have a native shared-workspace file model comparable to document SaaS tools; code lives in the user's local IDE. |
| Integrations | Not explicitly documented. Any IDE-level integrations configured by the removed user would cease to function under their credentials. |
| License freed | Seat is freed upon removal; credit pool impact for Teams/Enterprise pooled credits is not explicitly documented. |
Watch out for:
- If SCIM is configured (Enterprise), deprovisioning via the IdP is the recommended removal path; manual removal may conflict with SCIM sync state.
- Removing a user does not automatically delete their personal Windsurf account; they retain access to any personal Free/Pro subscription.
- Billing cycle timing for seat release is not explicitly documented in public-facing docs.
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| Free | 25 credits/month, single user, no team features | $0 |
| Pro | 500 credits/month, individual user, no team admin features | $15/user/month |
| Teams | Pooled credits, team dashboard, SSO (Okta, Entra, Google Workspace), admin console, priority support | $30/user/month |
| Enterprise | Everything in Teams plus SCIM provisioning, RBAC, Zero Data Retention (ZDR), volume discounts for 200+ users, dedicated support | $60/user/month (standard); volume discounts available at 200+ seats |
- Where to check usage: Team Dashboard → Usage (shows per-member and aggregate credit consumption)
- How to identify unused seats: Team Dashboard → Members list shows last-active or credit-usage data per member; specific 'inactive user' reporting is not documented as a named feature.
- Billing notes: Add-on credits available: $10/250 credits (Pro); $40/1000 pooled credits (Teams/Enterprise). Teams and Enterprise use a pooled credit model. Billing is per-seat per-month. Volume discounts apply at 200+ users on Enterprise. Windsurf was acquired by Cognition in July 2025; pricing and billing infrastructure may be subject to change.
The cost of manual management
Invitations are sent one at a time through the Team Dashboard - no CSV bulk-import path is publicly documented. Seats are billed on acceptance, not on invite, so timing matters when headcount changes mid-cycle.
Removing a member frees the seat, but billing-cycle timing for that release is not explicitly documented, which creates reconciliation risk at scale.
The cost gap between SSO and SCIM is steep: Teams at $30/user/month includes SSO but requires a jump to Enterprise at $60/user/month for automated provisioning. For orgs managing every app through a single IdP lifecycle, that delta is the core trade-off to evaluate.
What IT admins are saying
The most consistent friction point raised in community discussions is the SCIM-behind-Enterprise gate. Teams-plan customers who want automated lifecycle management have no middle path - it's manual dashboard work or a full tier upgrade.
The credit model (consumption-based, pooled on Teams/Enterprise) adds a second layer of unpredictability; add-on pricing at $40/1,000 pooled credits is widely flagged as expensive for variable-usage teams.
Windsurf's acquisition by Cognition in July 2025 has introduced uncertainty around pricing stability and roadmap continuity. Documentation gaps - particularly around what happens to user data and credits on removal - are a recurring complaint with no current resolution documented publicly.
Common complaints:
- Enterprise plan required for SCIM provisioning; Teams plan does not include automated user lifecycle management.
- SSO is available on Teams ($30/user/month) but SCIM requires upgrading to Enterprise ($60/user/month), creating a significant cost jump for automated provisioning.
- No publicly documented CSV bulk-import path for adding users; invitations appear to be one-at-a-time via the dashboard.
- Lack of clarity in public documentation about what happens to user data and credits when a member is removed from a team.
- Acquisition by Cognition in July 2025 has raised community concerns about pricing stability and product roadmap continuity.
- Credit model (consumption-based) makes seat cost unpredictable for teams with variable usage; pooled credits help but add-on pricing is seen as expensive.
The decision
If your team is on the Teams plan and needs automated provisioning today, the answer is: you cannot get it without upgrading. Every app that supports SCIM in your environment can be lifecycle-managed through your IdP; Windsurf joins that group only at Enterprise tier.
Evaluate whether the $30/user delta is justified by headcount volume and offboarding risk.
For orgs already on Enterprise, SCIM via Okta, Microsoft Entra ID, or Google Workspace is the supported path. OneLogin is not listed as a confirmed IdP. Manual removal remains an option but conflicts with SCIM sync state if both are used simultaneously.
Bottom line
Windsurf's manual administration is straightforward for small teams comfortable with one-at-a-time invitations and dashboard-based offboarding, but it does not scale cleanly.
The absence of bulk import, the ambiguity around seat-release timing, and the hard SCIM gate at Enterprise make it a tool that rewards teams who either stay small or commit fully to the Enterprise tier with IdP-driven lifecycle management.
Acquisition-related uncertainty is a real factor; verify current pricing and documentation directly with Windsurf before making tier decisions.
Automate Windsurf workflows without one-off scripts
Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.
