Managing User Permissions and Access in Span

Last updated: November 12, 2026

Overview of Permission Groups

Span uses permission groups to control what users can see and do within the platform. The main permission levels are:

  • Owner – The highest level of access. Owners can see and do everything in Span, including the Permissions Group page and Cost Data.

  • Admin – Admins have access to almost everything in Span, except the Permissions Group page and Cost Data.

  • Manager – Managers can view metrics for their team and direct reports.

  • Team Member – The default role; users can only see their own data and a limited set of metrics.

  • Observer – Observers are not part of the engineering organization and won't appear in metrics or reports. They can be granted varying levels of visibility through permission groups.

You can also create custom permission groups with fine-grained control — for example, granting access to all team DORA metrics without giving full Admin or Owner privileges.

How to Change a User's Permission Group

Only members of the Owners permission group can modify permission groups.

  1. Go to Settings > Permission Groups.

  2. Click on the permission group you want to manage (e.g., "Admins" or "Owners").

  3. On the first page of the wizard, use the autocomplete field to add users to the group.

  4. Click Save & Exit in the top right corner.

Note: Changing a user's permission group does not by itself enable login. If the user needs to sign in, confirm their person profile has Access Type: Account.

If you need to be added to the Owners group yourself, ask an existing Owner to grant you access.

Adding a New User to Span

If a user doesn't yet have an account in Span, you can invite them through People Management as a team member and assign the appropriate role (for example, contributor). Their access settings can later be reviewed and updated in People Management. When requesting access for a new user, it helps to provide:

  • The user's email address

  • The desired permission level (e.g., Admin, Owner, Manager)

  • Optionally, their team, manager, and any direct reports (if they are part of the engineering organization)

Note: If you cannot invite or update the user through People Management, you may not have the required permissions. Contact a Span admin in your org, or Span support for assistance.

Once added, users can sign in at span.app/auth/login.

Once added, users can sign in at span.app/auth/login.

Setting Up an Account with Full Visibility (No Engineering Profile)

If you want to give someone — such as an IT or executive stakeholder — full access to Span without including them in engineering metrics or reports, you can:

  1. Create a new Person in People Management, set their Member Type to Observer so they won't appear in engineering metrics or reports, and make sure their Access Type is set to Account if they need to sign in to Span.

  2. Add them to the Owner (or Admin) permission group so they have the appropriate level of visibility.

Troubleshooting Login Issues

User sees an error when logging in

If a user encounters an error when trying to sign in, check the following:

  • Ad blockers: Ad blockers can interfere with Span's authentication endpoints. Ask the user to disable their ad blocker for span.app and try again.

  • Missing person record: The user may not have a person record in Span. Contact Span support to have them added.

  • Insufficient permissions: The user may have a record but lack the appropriate permission group. Add them to the correct group via Settings > Permission Groups.

  • SSO/Okta provisioning: If your organization uses SSO, the user may need to be provisioned through your identity provider before they can log in.

  • Access Type not set to Account: A user must have Access Type: Account on their person profile in order to sign in. Updating a user's permission group or role alone may not be sufficient if their access type is not set correctly.

  • Inactive SSO connection: If SSO is configured but users still cannot log in, check Settings > Single Sign-On and confirm the connection is active. An SSO connection that exists but is inactive can block login attempts.

  • Incomplete SSO setup: If the SSO configuration appears present but authentication is not working, open Settings > Single Sign-On and use Continue Setup to complete any missed configuration steps.

User is redirected to span.app/not-found

This can happen when the environment is still being provisioned, or when the user does not yet have Admin or Owner permissions. Ensure the user has been granted at least Admin-level access.

Duplicate user accounts

If a user appears to have duplicate records (e.g., due to multiple email addresses), contact Span support. The team can merge the records and ensure data such as GitLab usernames is associated with the correct account.

Managing Permissions When SCIM is Enabled

If your organization uses SCIM provisioning (e.g., via Okta), some user attributes may be managed by your identity provider. However, you can still manually assign users to permission groups in Span:

  1. Go to Settings > Permission Groups.

  2. Click on the desired group (e.g., "Managers").

  3. Manually add the user using the autocomplete field and save.