Cursor Team Members, Roles & Seat Types (Admin Guide)

Three roles answer one question: who can administer the team. Members and Admins both get full product access, and the difference is what they can change. Unpaid Admin is the outlier, with admin controls but no paid seat.

The role question that actually comes up is who gets Admin, and the honest answer is fewer people than ask for it. Admin bundles billing, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., member management and analytics together, which is a strange combination in practice: the person who should be watching spend is rarely the person who should be editing your SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. configuration. Cursor does not split those capabilities, so the only control you have is how many people hold the role.

Unpaid Admin covers the other half of that problem, and it turns out to be the cleanest way to handle it. Same administrative capabilities, no product access, no seat cost, so IT and finance hold the controls they need without a $40 line each. It cannot cover everyone, though: one paid member always has to remain, so the last paid seat is not convertible.

A seat type sets how much included usage someone gets, separate from their role. Standard covers most engineers; Premium is for the few who routinely run out, with 5x the usage. Unpaid Admin sits outside both, with no product access.

Seat type is independent of role: a Member or Admin can hold either Standard or Premium. Admins upgrade or downgrade seat type from the member context menu. Upgrades apply immediately with pro-rated billing; downgrades take effect at the next renewal while the user keeps Premium through the current cycle.

Seat type is also the decision most often made wrong in advance. Premium carries 5x the included usage at three times the price, so it pays for itself only for people who genuinely exhaust the Standard allowance, and I suspect that group is smaller than the number of people who ask. You cannot know who is who before there is usage data, and the upgrade path is short: immediate, pro-rated, done from the member menu.

The default should be Standard for everyone, including the people who insist otherwise.

Downgrades run the other way and the asymmetry is worth planning around. A downgrade lands at the next renewal and the person keeps Premium for the rest of the cycle, so a mid-cycle correction never shows up on this month's invoice. If you are trimming to hit a number this month, neither downgrades nor removals will do it: a removed member who used any credits keeps their seat until the period ends as well.

There are four ways to add people, from a one-off email invite up to SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and domain matching that let teammates join on their own. Which one you reach for depends on how much you want to manage by hand. Removal happens from the member context menu, and it is permanent for that person's data.

1. 1Email invite: click Invite Members and enter addresses; users receive email links.
2. 2Invite link: copy a shareable link from the same dialog (revoke regularly or prefer SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition.).
3. 3SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition.: users auto-join when they sign in with a configured SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. identity provider.
4. 4Domain matching: with a verified domain, teammates can join from the dashboard without a direct invite.

The four methods differ mostly in how much you trust the boundary. An email invite is explicit and slow. A shareable link is fast, lives a long time and lets in whoever has it, which makes it the one to revoke on a schedule instead of leaving it in a Slack channel from March. SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. and domain matching move the boundary out to your identity provider or your verified domain, which is where it belongs once the team is past a few dozen people.

Admins remove members from the context menu. If the member consumed any credits, their seat stays occupied until the billing period ends; billing adjusts with pro-rated credit on the next invoice. Removed users lose Memories and Cloud Agent data permanently.

That last sentence is the part to read twice. There is no export step and nothing to restore from afterwards, so when a departing engineer leaves behind a cloud agent history somebody else will need, pull it before the removal goes through rather than after. The billing side looks after itself.

Domain matching and invite-domain restrictions are for Teams that manage membership inside Cursor. Domain matching lets anyone with a verified company email self-join; restrict invites to verified domains blocks invitations outside your domains. If you use SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. on Enterprise, membership flows from your identity provider instead and these manual domain controls are superseded.

The part of SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. that belongs on this page rather than the provisioning one is roles, because SCIM does not map them. Everyone arrives as a Member, so promoting an Admin stays a manual step in the Cursor dashboard even when membership is entirely automated. Teams that assume the identity provider carries the whole picture discover this the first time an admin leaves and nobody left can reach the billing settings.

Both domain controls need at least one verified domain, and both are available only while you are not provisioning through SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition.. Which is the right way round. Once the directory owns membership, leave the domain toggles off so there is exactly one way in.