How to Set Up a Cursor Team (Plans, Invites, SSO & MDM)

Creating a team is one flow, whether you start fresh or upgrade an existing account.

1. 1If you're new to Cursor, go to cursor.com/team/new-team to create an account and a team in one flow.
2. 2If you already use Cursor, open your dashboard and click Upgrade to Teams.
3. 3Enter a team name and choose monthly or annual billing.
4. 4Invite members by email. Each new member is charged pro-rata for the rest of the billing period.
5. 5Optional: turn on domain matching in team settings, so teammates with a verified, matching email domain can join without an invite.

If you intend to use SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., verify a domain before the invites go out. Domain verification is required for SSO and for the domain-matching toggle at the end of the flow. Invites work either way, but verifying first lets SSO or domain matching be the way in from day one, instead of a shareable invite link. Invite links have a long expiry, and anyone holding one can join.

Domain matching is also a spending decision. Each self-join can add a paid seat, so on a large verified domain you trust the domain instead of approving each person. Restricting invites to verified domains does a different job: it blocks invitations to addresses outside your domains.

Check contractors' team memberships before you invite them. Cursor's setup docs say an account on a Teams plan belongs to one team at a time. Anyone in a client's Cursor team would first need that team's admin to remove them, because members can't remove themselves. Cursor's help center and The X SubscriptionThe subscription Cursor is sold through: one plan for Grok, Cursor and X, with Free, Plus, Premium, Super and Ultra tiers, per-seat Teams, a weekly included pool for Cursor models shared with Grok, and third-party models billed at API list price from prepaid credit. Press Enter for the full definition. docs, though, say people can belong to more than one workspace and switch between them. Ask contractors to check the week before, not on the kickoff call.

Invite in waves rather than all at once. A first wave of ten surfaces proxy and identity problems while you still have time to fix them, and it gives you ten people who can answer questions for the next forty.

SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. is optional at setup and costs nothing extra on Teams and Enterprise. New users enroll automatically the first time they sign in through your identity provider, and SSO is the standard answer in a security review. On Teams, an admin configures it in Team Settings after the team exists. Cursor recommends org-level SSO for most Enterprise organizations, configured once in the organization's settings. Pair it with enforced Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. before you add seats.

SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. sits in the middle of the identity path. Domain verification comes before it, and SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. on Enterprise requires an active SSO connection. That argues for doing it during setup, because the work is the same size later, against more accounts.

Under a dozen engineers with no identity provider in place, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. adds little, and domain matching covers the join path with far less setup. The trade is offboarding, which domain matching does nothing for. Above that size, or wherever a security team approves tooling, we would treat SSO as required and configure it before the first invite.

Cursor's SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. page says there is no separate switch for enforcing SSO: once domain verification and the SSO connection are both active, everyone on that domain must sign in with SSO. Its members page still lists "SSO enforcement options" among the SSO features. Plan as if enforcement starts the moment both are active, and finish the assignments in your identity provider first. Assign each user to the Cursor app directly or as a direct member of an assigned group, because nested groups often fail. For anyone left out, the identity provider returns "User is not assigned to this application", and Cursor can't let them in.

Cursor bills per active paid seat, not for licenses bought in advance. New members are charged pro-rata for the rest of the billing period, and the renewal date stays fixed. On The X SubscriptionThe subscription Cursor is sold through: one plan for Grok, Cursor and X, with Free, Plus, Premium, Super and Ultra tiers, per-seat Teams, a weekly included pool for Cursor models shared with Grok, and third-party models billed at API list price from prepaid credit. Press Enter for the full definition., someone who accepts an invite takes an unused seat if one exists, and a new seat is bought only when every seat is taken.

A removed member loses access right away, but billing lags. On The X SubscriptionThe subscription Cursor is sold through: one plan for Grok, Cursor and X, with Free, Plus, Premium, Super and Ultra tiers, per-seat Teams, a weekly included pool for Cursor models shared with Grok, and third-party models billed at API list price from prepaid credit. Press Enter for the full definition., their seat stays on the plan until you reduce seats, and a reduction applies at the end of the period. The setup docs add that someone who used any credits before removal holds the seat until the period ends.

So trimming seats lowers the next invoice, not the current one. Because the renewal date holds, a team that doubles in March pays pro-rated charges for the new seats instead of starting a new cycle.

Monthly or yearly is the billing choice to think through. Cursor's members page says yearly billing saves 20% and can't switch back to monthly mid-plan, but its steps are the ones Cursor's help center gives for legacy plans. On The X SubscriptionThe subscription Cursor is sold through: one plan for Grok, Cursor and X, with Free, Plus, Premium, Super and Ultra tiers, per-seat Teams, a weekly included pool for Cursor models shared with Grok, and third-party models billed at API list price from prepaid credit. Press Enter for the full definition., you pick monthly or annual when you change plans in the billing dashboard, so confirm the yearly price for your seats there.

A team needs at least one admin and one paid member at all times, so confirm the first paid user is active before you change your own role.

Download builds for every platform at cursor.com/download. Cursor's setup docs link MDM guides for Omnissa Workspace ONE, Microsoft Intune (Windows and Mac) and Kandji. If your network uses Zscaler, a proxy or a VPN that blocks HTTP/2, set HTTP Compatibility Mode to HTTP/1.1 under Cursor Settings → Network.

Those links go to each vendor's own guide for deploying a custom app, so you package the standard download yourself whichever vendor you use. If yours isn't listed, find its equivalent guide and budget time for packaging in the rollout plan. Network setup is a separate job, and the network configuration page has the allowlist and the streaming tests.

Before you pin a version in MDM, check that it is 1.5 or newer. Team usage analytics only collect data from clients on 1.5 or higher, so an older pinned build won't report to the dashboard, and an adoption chart promised to leadership comes up empty. Pin forward, and set an update cadence the fleet can keep.