# Admin Console
Manage enterprise-wide directory, organization hierarchy, billing, SSO, domain verification, and Directory Sync from one Factory surface.
The Enterprise Admin Console is the central command center for managing Factory at enterprise scale. It gives enterprise account owners a dedicated platform surface to manage identity, directory, organization structure, billing, and enterprise-level governance across the customer's Factory deployment.
The Admin Console is intentionally separate from regular team settings and is not scoped to the currently selected organization. Team owners and managers can administer their own organizations, while enterprise owners retain control over identity, billing, hierarchy, and cross-organization membership visibility.
## Who can access the admin console
The Admin Console is reserved for enterprise account owners who can administer the enterprise account rather than only a local organization.
| User type | Access |
| --- | --- |
| Enterprise account Owner | Can access the Admin Console. |
| Organization Owner | Can access local organization settings, but not the enterprise Admin Console unless they are also a root Owner. |
| Manager | Can access team settings where their role allows it, but not enterprise-only Admin Console pages. |
| User | Does not see team settings or Admin Console surfaces. |
Direct navigation to restricted Admin Console pages shows restricted access. This gives customers a clear governance boundary: local ownership does not automatically grant enterprise administration.
## Admin console sections
The Admin Console includes four enterprise-level sections.
| Section | What it manages |
| --- | --- |
| Directory | Cross-organization membership visibility and membership management. |
| Organizations | Organization creation, hierarchy, organization-level controls, and usage limits. |
| Billing | Enterprise account billing and commercial administration. |
| Security & Identity | SSO, domain verification, and Directory Sync setup. |
## Directory
Directory shows members across the enterprise account and its organizations. Admins can search the directory, filter by organization, review member status, see whether memberships are UI-managed or Directory Sync-managed, and manage memberships when allowed.
Use Directory to answer:
- who has access to Factory across the enterprise;
- which organizations a user belongs to;
- which users are managed by Directory Sync versus manual assignment;
- which memberships need review during rollout or migration.
When Directory Sync controls a membership, make the change in the identity provider. When a membership is UI-managed and the admin has permission, the Admin Console can update it directly.
## Organizations
Organizations is where enterprise admins create and manage the organization hierarchy. Admins can search organizations, create a new organization under a selected parent, choose Global or a regional deployment, optionally copy enterprise-level controls, optionally copy the enterprise global usage limit, view directory members, manage Enterprise Controls, and manage global usage limits for a specific organization.
Use Organizations for:
- teams, business units, regions, subsidiaries, client groups, or departments with distinct operating boundaries;
- per-organization policy and usage boundaries;
- region and data residency selection at organization creation;
- service account and automation ownership review;
- controlled expansion from a pilot team to the broader enterprise.
For detailed setup steps, see [Organizations](/enterprise/structuring-and-managing-organizations).
## Billing
Billing gives enterprise account owners the commercial administration surface for the enterprise account. Billing stays with the enterprise root, reinforcing one commercial relationship even as usage expands across many organizations.
Use Billing to keep finance aligned with:
- the enterprise account and subscription;
- centralized invoice ownership;
- usage and commercial attribution that rolls up to the root;
- expansion across teams without disconnected billing accounts.
## Security and identity
Security & Identity gives enterprise admins direct access to identity configuration from the Admin Console. Admins can configure Single Sign-On, domain verification, Directory Sync, and IdP group mappings through the identity portal.
Security & Identity supports:
- SAML or OIDC-based SSO;
- domain verification;
- SCIM-based Directory Sync for automated provisioning;
- IdP group mappings to Factory organization role targets;
- one enterprise identity workflow for the root and its organizations.
For identity model details, see [Identity & Access](/enterprise/identity-and-access).
## Enterprise Controls for organizations
Enterprise admins can open Enterprise Controls for a specific organization from the Organizations page. This lets them tune policies per team without changing every other organization.
Use per-organization Enterprise Controls to:
- segment policy by team, region, or business unit;
- give regulated teams stricter controls;
- avoid one-size-fits-all governance across the enterprise;
- keep centralized oversight while allowing local policy variation.
Enterprise Controls include model policies, custom model access, autonomy ceilings, command allowlists and denylists, MCP policy, sandboxing, cloud session sync, Droid Shield, API key creation, managed computer availability, and session retention.
## Usage limits for organizations
Enterprise admins can set or remove a global monthly credit limit per user for a specific organization. This gives admins a practical way to manage adoption and spend boundaries at the team level.
Use organization usage limits to:
- manage cost exposure during expansion;
- give teams clear usage boundaries;
- support controlled pilots and staged rollout phases;
- separate global organization limits from individual user limits.
Root admins can copy root usage limits to a new organization during creation. Later root changes apply only to the organizations the enterprise admin selects.
## Recommended workflow
1. Confirm enterprise root ownership.
2. Design the hierarchy in [Organization Model](/enterprise/organization-model).
3. Create organizations in **Organizations**.
4. Configure SSO and domain verification in **Security & Identity**.
5. Enable Directory Sync if membership should be managed through IdP groups.
6. Map IdP groups to Factory organization role targets in the identity portal.
7. Review membership in **Directory**.
8. Configure Enterprise Controls and usage limits for each organization.
9. Confirm billing and usage attribution in **Billing**.
## FAQ
Team admins can manage local team settings where their role and root policy allow it. Enterprise administration is reserved for enterprise root Owners.
Yes. Security & Identity supports SSO, domain verification, and SCIM-based Directory Sync. Directory also indicates when memberships are managed by Directory Sync.
Yes. Enterprise admins can manage Enterprise Controls for individual organizations, which supports team-specific policy requirements.
Yes. Enterprise admins can set global monthly credit limits per user for specific organizations.
Understand the enterprise root, organization hierarchy, and governance boundaries.
Create organizations, configure users, and manage Directory Sync mappings.
Configure SSO, domain verification, Directory Sync, and roles.
Manage hard controls, session defaults, model policies, and safety settings.