The admin console acts on each member’s membership: their sessions in the workspace and their offboarding. When the account belongs to the organization, it also acts on the account itself. Everything happens from the member’s profile, in its “Account” section, and from the “Account requirements” card on the “Sign-in” page.
Managed account or personal accountLink to the Managed account or personal account section
At the top of the “Account” section, a badge shows the type of account.
| Badge | When | What the organization can do |
|---|---|---|
| “Account managed by the organization” | The address belongs to a domain verified by the organization, or the account was created through its single sign-on (SSO) or its directory (SCIM). | Act on the member’s sessions, their offboarding and the account itself. |
| “Personal account” | The person has their own Moon AI account. | Act on their sessions in the workspace and on their offboarding. The organization does not edit, reset or disable the account. |
Domains are verified on the “Sign-in” page: see Verify a domain.
The Account section of the profileLink to the The Account section of the profile section
Admin console › “Members” › row menu › “Open profile”, “Account” section.
| Row | Contents |
|---|---|
| “Sign-in” | The account’s address and its sign-in methods: password, single sign-on, Google, Microsoft, Apple, GitHub. |
| “Two-factor authentication” | “On” or “Off”, plus “Required by the organization.” when the organization requires it. |
| “Last activity” | The latest activity, or the latest sign-out done by the organization. |
| “Devices” | The open sessions (browser or Moon CLI). Visible to the people who can suspend this member. |
Actions on an accountLink to the Actions on an account section
| Action | Effect | For which accounts |
|---|---|---|
| “Sign out of the organization” › “Sign out” | Ends their sessions in this workspace and their Moon CLI sessions linked to the workspace. | All |
| “Sign out everywhere” | Ends every session of the account, on every device. | Managed |
| “Two-factor authentication” › “Reset” | Removes their second factor, which they must set up again. Offered when it is on. | Managed |
| “Password reset” › “Send” | Sends a code to the account’s address. You never see it. | Managed |
| “Name and email address” › “Edit” | Changes the name or the address, which must stay within your verified domains. | Managed |
| “Disable account” › “Disable” | The person can no longer sign in anywhere. Nothing is deleted. | Managed |
| “Enable account” › “Enable” | Reverses a deactivation done by the organization. | Managed |
Actions on a managed account require the “Manage security” permission. No one can act on their own account, on the owner’s account, or on the account of someone with more rights; only the owner can act on an admin. Moon AI refuses any action that would leave the organization without an active admin.
The organization never chooses a password and never signs in on behalf of a member.
Change the address of a managed accountLink to the Change the address of a managed account section
- “Account” section › “Name and email address” › “Edit”.
- Enter the “Name” or the “Email address”. The address must belong to one of your verified domains.
- Click “Save”.
The person is notified by email. Changing the address signs them out of all their devices: they sign in again with the new address. Their conversations and their access stay the same.
Offboard a memberLink to the Offboard a member section
The “Offboard” button in the “Account” section hands a member’s resources to someone else before removing them. It requires the “Remove members” permission.
- “Account” section › “Offboard”.
- Under “Resources to transfer”, tick the agents, knowledge bases, notes, prompts and tools to hand over. The ones they share are ticked by default.
- For a managed account, “Also transfer their private items” is offered: the organization owns this account, and therefore its work.
- Under “Who receives their resources?”, choose a member. That member becomes the owner; sharing does not change.
- Under “Then”, leave “Remove them from the organization” ticked to remove the person. For a managed account, also tick “Disable their account” if needed.
- Click “Transfer and remove”, or “Transfer” if you are not removing them.
Nothing is deleted. The private items of a personal account stay with the person. A disabled account can be enabled again from its profile.
To remove a member without handing over their resources: “Members” page, row menu › “Remove from organization”. See Manage members.
Account requirementsLink to the Account requirements section
Admin console › “Sign-in” › “Account requirements” card. They apply to every request made in the workspace, not to the members’ personal workspaces.
Require two-factor authenticationLink to the Require two-factor authentication section
- Turn on “Two-factor authentication”.
- Choose the “Grace period”: “Immediately”, 7, 14 or 30 days.
- Click “Apply”.
During the delay, a banner reminds members to set it up. After that, a member who has not done so stops at a screen that sends them to “Settings”: they cannot work in the workspace until it is set up.
“Members who have not set it up” shows how many are missing; “See who” lists them. “Change grace period” starts it again from today.
The second factor counts if it is set up in “Settings” › “Account and security” › “Two-factor authentication”: an authenticator app or a code by email. A passkey alone does not meet this requirement. When single sign-on is mandatory, the second factor of your identity provider counts: members linked to it have nothing else to provide.
Limit session lengthLink to the Limit session length section
“Maximum session length”: 1, 4, 8, 12 or 24 hours, 3, 7 or 30 days, or “No limit”. An older session is closed in the organization’s workspace, and the member signs in again.
Sign everyone outLink to the Sign everyone out section
“Sign everyone out” ends every session in the workspace, including yours, for example after a device is lost. Everyone signs in again. Personal workspaces are not affected.
Mandatory single sign-onLink to the Mandatory single sign-on section
The card shows the state of single sign-on: “Required”, “On, not required” or “Off”. It is set in the “Organization sign-in (SSO)” card: see Make the organization sign-in mandatory.
See alsoLink to the See also section
- Members, roles and invitations
- Domains and single sign-on
- Member accounts in the Organizations API