Only people you trust can change your fleet.
Identity & Access keeps your workspace to your own company, gives each person the access their job needs, and puts sign-in behind your identity provider when you're ready.
- Free on the Team plan, with no device or user limits
- Roles and permissions with Business
- Single sign-on with Enterprise
The problem
A console that can install software on every Mac in the company is a powerful thing to have a login for. Shared accounts, departed employees who still have access, and everyone holding full admin rights are how a management tool becomes a risk of its own.
What you get
Only your company gets in.
Set an allowed domain, and only people with an email address at your company can join the workspace. Everyone signs in with a one-time email link or their Apple, GitHub, Google, or Microsoft account, so there's no Workbrew password to leak.
The right access for each person.
On Business, give each member a role. Read can see everything, Write can manage devices, policies, and commands, and Administrator can also manage members, integrations, and settings. Workbrew never lets you demote the last administrator.
Sign-in through your identity provider.
On Enterprise, connect your identity provider over SAML or OIDC. Once SSO is set up for your domain, it's the only way in: email links and social sign-in stop working for that domain, and existing sessions end.
How it works
An allowed domain means only people with an address at your company can join the workspace. On Business, each member gets a role, so someone who only needs to look can't change anything.
On Enterprise, Workbrew sets up single sign-on with you for your verified domain. From then on, sign-in for that domain goes through your identity provider, so someone you remove there can't sign in to Workbrew either.
Frequently Asked Questions
With a one-time link sent to their email, or with an Apple, GitHub, Google, or Microsoft account. On Enterprise, they can sign in through your own identity provider instead.
Three, on Business and Enterprise, each including the one before it. Read can see everything in the workspace. Write can also manage devices, policies, commands, default software, and package requests. Administrator can also manage members, integrations, notifications, and settings.
SSO is part of Enterprise, and Workbrew sets it up with you over SAML or OIDC. Once it's on for your domain, it's enforced automatically. Console login and SSO enforcement explains what changes for your team.
Deploy Workbrew free
Bring your team into Workbrew, on the free Team plan.