Table of contents

Fugo gives you full control over who can access your account and what they can do.

Whether you're onboarding a single teammate or rolling out Fugo across a large organization, this article covers everything in one place: inviting members, organizing your team into spaces, customizing permissions with roles, and connecting your identity provider for single sign-on.

Think of it this way:

Everything in this article lives under one roof: open the Settings modal from your Account menu in the left sidebar, then look at the Team section of the left-hand navigation.

There's no single dedicated "team management" page in Fugo - People, Spaces, Roles, and Single Sign-On are separate tabs within this shared Team settings menu, alongside Company info, Billing, Space Billing, Fallback playlist, and API keys.

Which of these tabs you personally see depends on your permissions, not just whether you're an admin. Tenant Admins see every tab automatically, but a non-admin user can also see the People tab if their role has the View people permission, the Spaces tab with View spaces, and the Roles tab with View roles - each tab checks for its own permission independently.

Single Sign-On and API keys are the exception: those two are always restricted to Tenant Admins, regardless of individual permissions, since they affect how your entire workspace authenticates and integrates with other systems.

To get here: Settings → Team → People.

The People tab shows every member of your workspace in a Members table. Use the Search members bar in the top right to filter by name or email. The table columns are:

From the People tab, click Invite people in the top-right corner.

In the dialog that appears:

Click Invite people and the invitee receives an email with a link to accept. While the invite is pending, they appear in the member list with an Invited badge, and their role and space can't be edited until they accept.

Instead of inviting everyone manually, you can let people request access to your workspace themselves and approve them as they come in - useful for larger teams where new users shouldn't have to wait on an admin to send the first invite.

Toggle Allow join requests on at the top of the People tab.

Once enabled, anyone who creates a Fugo account using an email address on a matching domain sees a "Join a workspace" prompt before entering the CMS, with a Request to join button. They can also choose to create a separate workspace of their own instead:

Pending requests appear in a list below the toggle, showing the requester's email and the date submitted:

For each one you can:

Use the refresh control next to the requests list to pull the latest pending requests.

From a member's ⋮ menu in the People tab, you have one option: Delete user completely. This permanently deletes the user from the entire workspace - it can't be undone, and the user can no longer log in to this workspace at all.

If you just want to reorganize someone out of their current space without revoking their access entirely, do that from the Spaces tab instead - see Moving users between spaces below.

To get here: Settings → Team → Spaces.

The screen is split into two panels: a left-hand list of all your spaces (each showing a member count, with the currently selected space highlighted), and a right-hand panel showing the members of the selected space - name, email, and role. Use the Search spaces bar to filter the list by name.

Two labels you'll see in the spaces list itself: Default marks the space new members land in automatically, and Admin marks the system space for workspace-level members - it's read-only and can't be renamed or deleted.

Members holding the Owner role show an Admin space only badge, since Owner access is workspace-wide rather than tied to one space.

Spaces are a hard organizational boundary. Every asset in Fugo - screens, playlists, media, and dashboards - is fully isolated per space. Members in one space have no visibility into another space's assets. For example, a screen in "Midwest" is invisible to anyone working in "Southeast," and vice versa.

This makes spaces the right tool when you need genuinely separate working environments inside one account - for example:

Spaces are not a content scheduling or targeting tool. If your goal is to control which content plays on which screen and when, that's what playlists are for - not spaces. A single space with well-organized playlists can run different content in different areas without needing separate spaces at all.

Click the + button at the top of the spaces list.

Enter a space name, and optionally search for and select members to add right away (pending invitees and Admin space members won't appear in this list).

Click Create space to finish - any members you selected are moved from their current space into the new one immediately.

Space names must be unique, 255 characters or fewer, and can't contain :/, http, or <.

Hover over a space to reveal its action icons, click the edit (pencil) icon, type the new name inline, then press Enter or click the checkmark to save. Default spaces and the Admin space can't be renamed.

Hover over a space, click the Set as default icon, and confirm. From then on, new members without an explicit space assignment are placed here automatically.

Hover over a space, click the delete (trash) icon, and confirm. All members in that space are automatically relocated to the default space before it's removed. This is permanent and can't be undone; the default space and the Admin space can't be deleted.

Each member row has a ⋮ actions menu with options that depend on the member's role:

To delete a user's account entirely, use the People tab instead - see Removing users above.

If you need to control how many screen licenses each space is allowed to use - so one space can't quietly consume your whole account's license pool - that's handled separately in Settings → Team → Space Billing, not from this tab.

It's a billing-level control (each space must keep at least as many licenses as it has paired screens).

To get here: Settings → Team → Roles.

The screen is split into two panels: a left-hand list of every role in your workspace, and a right-hand panel of permission toggles for whichever role is selected. Fugo ships with a set of built-in roles out of the box:

...and others - and you can adjust their permissions or create fully custom roles on top of them, depending on what your role permissions allow (see below).

Built-in roles can be edited but can't be renamed.

Every role's permissions are organized into the same nine categories, and each permission can be toggled on or off independently for that role:

Hover over any unlocked role in the list, click Set as default, and confirm. New users who join or are invited without an explicit role selection automatically receive this role.

Select a role from the left-hand list, then use the toggles in the permissions panel to turn individual permissions on or off, and click Save changes.

This is controlled by the Edit roles permission on your own role, not by your subscription plan - if your role doesn't have Edit roles enabled, the toggles and save button are disabled for you, regardless of which pricing plan your workspace is on.

Click the + button at the top of the roles list (requires the Edit roles permission). A new role called "New Role" is created with every permission turned off, and it's added to the bottom of your roles list - select it to start toggling on the permissions it should have.

Hover over a role and click the delete (trash) icon, then confirm (requires the Edit roles permission; built-in roles, the Owner role, and your current default role can't be deleted). Any users currently holding the deleted role are automatically reassigned to your workspace's default role.

To get here: Settings → Team → Single sign-on.

This tab is only visible to Tenant Admins, and it also requires a Fugo plan that includes SSO - if yours doesn't, the tab shows a lock icon and clicking it opens an upgrade prompt instead of the configuration screen.

Fugo supports single sign-on through two protocols: SAML 2.0 and OpenID Connect (OIDC). You can only have one provider active at a time, and your identity provider's URLs must use HTTPS. If you haven't set anything up yet, this tab shows an empty state prompting you to connect an identity provider so your team can sign in using your organization's existing credentials.

SAML 2.0 works with Google Workspace, Okta, Azure AD, and other SAML 2.0 identity providers. OpenID Connect (OIDC) works with Okta, Auth0, Google, and other OpenID Connect providers - it's not limited to any single provider.

Provide the following from your identity provider:

Once you save, Fugo displays a Redirect URL (ACS) and Entity ID for you to copy into your identity provider's application settings to complete the connection.

Provide the following from your identity provider:

Once you save, Fugo displays a Redirect URL (callback) for you to copy into your identity provider's application settings.

Once configured, team members enter their work email on Fugo's sign-in screen as usual. If the email's domain matches one of your configured SSO domains, they're redirected to your identity provider to authenticate and sent back to Fugo signed in.

Email addresses on non-matching domains sign in the normal way, with a Fugo email and password.

The SSO tab shows a summary card with your provider name, protocol, domains, and status (Active or Not configured). From here you can edit the configuration (the OIDC client secret field is masked - leave it blank to keep the existing secret) or delete it entirely.

Deleting removes the connection immediately; members who relied on it to sign in will need to be re-invited or given a Fugo password to get back in, so confirm before deleting on a workspace with active users.

If you run into any trouble with people, spaces, roles, or single sign-on, reach out through the chat box in your Fugo account or email support@fugo.ai - our team is happy to help.

Not on Fugo yet? You can try it free at www.fugo.ai/app.