Members Menu

Viewing Your Team

When you open the Members section, you see a table of everyone in your organization. Each row shows one team member with key information.

The table displays:

• Username: Their Galaxy login name (how you find them when adding)
• Role: Their role in the organization (Owner, Admin, Developer, or Viewer). The owner shows as fixed text. For everyone else, this is a dropdown you can change if your role allows it.
• Email Notifications: Toggle for organization activity emails (deployment alerts, database changes, billing updates)
• 2FA Status: Whether they have 2FA enabled and which method they're using (Authenticator App or Email)

You can't enable 2FA for someone else, but you can check to make sure they've set it up.

---

Roles and App Permissions

Organization roles control team and resource access. The Owner has full access and is the only role that can transfer ownership or move apps between accounts. Admins and Developers can manage apps, while Viewers have limited access. The Members page's App permissions matrix lets eligible users tailor access to app features for each role.

The matrix controls app features across every app in the organization. It doesn't set permissions for an individual member or a specific app. Database access and organization-level actions continue to follow their existing rules.

App Permission Defaults

Unless changed in the matrix, role permissions use these defaults. An owner always has every app permission.

These are defaults, not fixed role definitions. Changing a role's app permissions affects all members with that role in the organization.

Configure App Permissions

The App permissions panel appears below the members table. It lists app features as rows and organization roles as columns. Select or clear a checkbox to change access for that role. Variables combines access to application environment variables and Meteor settings.json; the control enables or disables both together.

• Owners can edit Admin, Developer, and Viewer permissions.
• Admins can edit Developer and Viewer permissions, but not Admin permissions.
• Developers can view the matrix when they can access organization settings, but can't edit it. Viewers and users without organization settings access can't manage members.
• Owner permissions are always enabled and can't be changed.

Select Save changes to apply edits, or Cancel to discard the current draft. Unsaved selections don't change access. If another authorized user saves changes first, reload the latest matrix before saving your edits.

Managing member roles is a separate control: use the Role dropdown in the member's row. Only owners and admins can change roles. You can't assign Owner from that dropdown; use Transfer Ownership in Organization Settings.

Changing a Member's Role

Find the member in the table and use the Role dropdown to pick Admin, Developer, or Viewer. The change takes effect right away.

A few things to know:

• You can't assign Owner from the dropdown. To hand off ownership, use Transfer Ownership in Organization Settings.
• The owner's row is fixed. It shows "Owner" as text, not a dropdown.
• Only owners and admins can change roles. If your role can't, the dropdown is disabled and hovering it tells you why.

---

Adding Team Members

Want to bring someone new onto your team? They need their own Galaxy account first.

What Access Do They Get?

New members start as Viewer. Their access to app features follows the organization's Viewer settings in the App permissions matrix. To change app access, update the Viewer permissions; changing a member's role affects their other organization access too.

About billing access: Billing sits outside the role system. Whether members can see billing information depends on your organization settings. The owner can restrict billing access in the Settings Menu. If set to "Only Organization Owner," members won't see payment methods or invoices.

---

Managing Member Settings

Once someone is part of your organization, you can control a few key settings.

Email Notifications

Each member has a toggle for email notifications.

• Notifications on: They get emails about events, alerts, deployments, and changes
• Notifications off: No email notifications, but their role-based access stays the same (useful if they prefer checking the dashboard manually)

Toggle the checkbox in the "Email Notifications" column. Takes effect immediately.

2FA Status

Look at the 2FA column to see each member's status:

• 2FA Enabled (App): Using an authenticator app (best option)
• 2FA Enabled (Email): Using email-based 2FA (still good, less secure)
• 2FA Disabled: No 2FA set up (security risk)

You can't enable 2FA for someone else. Encourage team members without it to set it up. Point them to the Security Menu guide.

---

Removing Members

Sometimes you need to remove someone. Maybe they left the company, or you need to reduce access.

Find the member in the table and click "Remove" on their row. Confirm, and they're instantly removed with all access lost.

What happens when you remove someone:

• Can't access the organization anymore
• Can't see apps and databases
• Can't deploy applications or make changes
• Ongoing deployments they started keep running, but they can't manage them
• Their personal Galaxy account stays active (they just lose access to your organization)

Removing someone is instant and irreversible. Made a mistake? You'll need to add them back manually, and they'll rejoin as a Viewer.

---

Pro Tips

Start people at the right role. New members land as Viewer. Only bump them to Developer or Admin when they actually need to deploy or manage the team.

Require 2FA from day one. When inviting new team members, ask them to enable 2FA before accessing production systems. Make it standard practice.

Monitor 2FA status regularly. Check the Members page occasionally to confirm all team members still have 2FA enabled. Quick security audit.

Use notification toggles wisely. Some want all alerts, others prefer checking manually. Respect preferences.

Keep admin access tight. Only owners and admins can change roles. Hand out Admin sparingly, and use Developer for people who just need to ship.

Offboard properly. When someone leaves, remove them immediately. Don't leave old members with access to sensitive resources.

---

Common Questions

---

What's Next?