What you will be able to do
- Invite users in batches with the right license and groups, and know who is allowed to send invitations
- Explain how email verification and SSO change the way an invitee redeems an invitation
- Keep user seats and billable seats aligned on Enterprise-tier and Starter plans
- Delete a user safely, and know what does and does not come back when they are re-invited
- Recognise when SCIM takes over adding and removing users
Key concept
A user occupies a licensed seat — Every user you add to a dbt account takes a license from a limited pool, so adding someone uses up a seat and deleting them frees one. Invitations, seat counts, billing and deletion all depend on keeping that pool balanced.
1.Who can invite, and how a batch invitation works
Adding a person to a dbt account always starts with an invitation, and the inviter needs two separate things. The first is permission. On a Starter account the inviter must have member or owner permissions. On an Enterprise-tier account they need admin, account admin, project creator or security admin permissions. The second is a license that allows the action: the admin sending the invitation must hold a Developer or IT license. A Read-Only license is not enough, whatever groups that user belongs to. The license types themselves are covered in [license types and mappings](lesson:5.3).
One invitation form can handle a whole team. Under Account settings → Users → Invite users, you paste addresses separated by commas, semicolons or new lines. You then pick one license type for the entire batch and choose the groups the invitees will join. Because the license is chosen in the invitation window, a mixed batch of developers and read-only viewers has to be sent as two invitations. The groups matter because every user must belong to at least one, and by default dbt also places new users in the Member and Everyone groups. What those groups can actually do comes from their [permission sets](lesson:5.2).
The seat limit is enforced when you click send. If the batch has more addresses than you have free licenses, dbt shows a warning and sends none of the invitations. It does not send the first few and drop the rest. To fix it, add seats or shorten the list, then send again.
Checkpoint 1 of 8· Put it in order
Put the steps for inviting a batch of users in order.
- 1.Open Account settings and select Users
- 2.Click Invite users
- 3.Enter the email addresses, separated by comma, semicolon or new line
- 4.Select the group(s) the invitees should belong to
- 5.Select the license type for the batch from the License dropdown
- 6.Click Send invitations
You choose the license and groups after entering the addresses and before sending, so the whole batch shares one license type.
“Select the license type for the batch of users from the License dropdown.”Source: docs.getdbt.com
Checkpoint 2 of 8· Exam question
A team on the dbt Cloud Developer plan currently has a single account owner and wants to bring on a second teammate with their own login. The owner opens Account Settings and clicks Invite Users, but no second user can be added. What must the team do to onboard the new teammate?
Correct answer: A — Upgrade the account to the Starter plan, since Developer-tier accounts cap out at a single user and can't invite teammates
- A. The Developer plan is scoped to a single user and has no path to add teammates without changing tiers. Moving to the Starter plan is the documented way to unlock multi-user invitations and seat billing.
- B. The Developer plan has no billing page for purchasing additional developer seats, because it is not designed to support more than one user. Seat purchasing only becomes available once the account is on a paid multi-user plan.
- C. There is no support-driven override that lifts the single-user restriction on a Developer plan account. The limitation is a plan-tier feature, not a configurable flag dbt Labs can toggle on request.
- D. SCIM provisioning is an Enterprise-only capability tied to SSO and cannot bypass the Developer plan's single-user limit. Attempting to configure it on a Developer plan account would not succeed.
2.Email verification and redeeming an invitation with SSO
Every new user has to verify their email address, and SSO does not remove that step. dbt does not allow automatic provisioning without email verification, and the rule cannot be bypassed. So an invitation only works if the email actually reaches the person. dbt sends the email from support@getdbt.com for every instance worldwide. If your mail filters treat that address as spam, the invitation never arrives. Link-rewriting tools such as Outlook Safe Links can also break the link in the email, so add the getdbt.com URL to their allowlists as well.
What happens after the user clicks the link depends on whether the account uses [single sign-on](lesson:5.5). A local user is asked to create an account, which includes setting a password. An SSO user clicks the link, chooses to join the account, and is then shown Authenticate with your enterprise login. Accepting the invitation does not finish the process for an SSO user. They have to log in through SSO to redeem it. Only then do their email and user details appear on the Users screen. Until that happens, the admin sees an invite record rather than a user.
Turning on SSO also changes who you can add. Once SSO is enabled, you can no longer add local users. Contractors and other temporary workers who are not in your identity provider cannot be invited as password users. Add them to your SSO service instead. Mistakes can be fixed from the invite record on the Users page. You can resend an invitation that went missing. You can revoke one sent to the wrong address and then send a new invitation to the correct one.
Checkpoint 3 of 8· Check yourself
An SSO-enabled account invites a new analyst. They click the email link and accept the invitation, but they don't appear on the Users screen. What is missing?
For SSO users, accepting the invitation is only part of the process. The user appears on the Users screen only after they authenticate with the enterprise login.
“Accepting the invite doesn't fully complete the process. The user must log in using SSO to redeem the invite and access the account.”Source: docs.getdbt.com
Sources1
3.Making room: seat counts on Enterprise-tier and Starter plans
Before you can invite more people than you have free licenses, you need more seats, and how you get them depends on the plan. On an Enterprise-tier plan, an admin with the right permissions changes the user seat count, and that one number covers it. The IT license does not count toward seat usage, so the account's single IT user does not take a developer seat.
A Starter plan tracks two numbers that have to agree. The developer user seat count controls how many people can be invited to the project. The developer billing seat count controls how many seats you pay for. To add developers, an account owner or admin first goes to Account settings → Billing, enters the new number of developer seats, and saves with Update Payment Information. Only after that do they send the invitations. The save fails if any payment field is empty, including the Billing address section. That catches out admins who only meant to change one number. A Developer-plan account cannot add more people at all and has to upgrade to Starter first.
| Plan | What you change | Detail to remember |
|---|---|---|
| Enterprise-tier | User seat count | An IT license does not count toward seat usage |
| Starter | Developer user seat count and developer billing seat count | Billing must be updated, with the billing address filled in, before inviting |
| Developer | Nothing: you cannot add people | Upgrade to the Starter plan to add more people |
Checkpoint 4 of 8· Match them up
Match each Starter-plan setting to what it controls.
Tap a term, then the definition that fits it.
Starter keeps invited users and billed seats as separate counts, and you change billing seats from the Billing page with this save button.
“Adjust your developer billing seat count, which manages the number of billable seats.”Source: docs.getdbt.com
Checkpoint 5 of 8· Exam question
An admin at a dbt Cloud Enterprise account opens a former contractor's record under Account Settings > Users, clicks Edit, then Delete, and confirms the deletion. Which statement accurately describes the result of this action?
Correct answer: A — The deletion is permanent, and restoring the person's access means sending a brand-new invite that creates a fresh user record
- A. Confirming the delete action removes the user record immediately and this cannot be undone as the same record. If the person needs access again, an admin has to invite them fresh, which creates a new user entry rather than reactivating the old one.
- B. There is no thirty-day suspended holding state for deleted users in dbt Cloud. The delete action takes effect immediately once confirmed, not after a waiting period.
- C. dbt Cloud has no audit-log rollback mechanism that reverses a confirmed user deletion. Once the delete is confirmed, the only way back is a new invitation.
- D. Deleting a user removes their record and group memberships entirely rather than reassigning them elsewhere. There is no automatic transfer of a deleted user's group memberships to any group.
Sources3
4.Deleting a user, and what a re-invite brings back
Deleting a user is quick, and it cannot be undone. Only an account owner or someone with admin privileges can do it. Go to Account settings → Users, select the user, click Edit, then click Delete in the bottom left. After Confirm Delete, the user is removed straight away, with no extra password prompt. The same Edit pane is where you change an existing user's license, so an admin who means to downgrade someone can delete them instead with two clicks.
The main reason to delete a user is to free a license. Removing someone with a Developer license opens their seat for another person, or lets admins lower the total number of seats. On a Starter plan, deleting the user does not change the bill. To stop paying for the seat, go back to Billing, enter the lower number of developer seats, fill in every payment field, and click Update Payment Information. When you're done, the user count and the billing count should match.
A deleted user can't be restored as the same record. The only way back is a new invitation. If you re-invite the same email address, their personal profile information and linked accounts such as GitHub are kept, unless the user removed that connection on the other service. Their permissions and access settings are not kept. The re-invited user starts with whatever license and groups the new invitation gives them. Any project and environment access from [role-based access control](lesson:5.6) has to be set up again.
Checkpoint 6 of 8· Check yourself
A Starter account owner deletes three developers to cut costs. Which statement is accurate?
Deleting frees seats for reuse, but on Starter the billable seat count is changed separately on the Billing page.
“follow these steps to lower the license count to avoid being overcharged”Source: docs.getdbt.com
Checkpoint 7 of 8· Exam question
A user on an Enterprise account holds a Read-Only license but is also a member of the Account Admin group. Which two statements correctly describe this user's effective access? (Select 2)(Select 2)
Correct answers: A, C — They retain read access to job run history and dbt Catalog documentation, since Read-Only licenses still expose artifacts; They cannot edit environment variables or trigger deploy jobs, because the license overrides the group's permission set
- A. A Read-Only license is designed to preserve visibility into artifacts such as run history and Catalog documentation. That read access remains available regardless of which groups the user also belongs to.
- B. License type always overrides group permission sets, so an elevated group like Account Admin cannot grant action rights a Read-Only license withholds. The user would not be able to trigger job runs despite the group membership.
- C. Because a Read-Only license does not inherit rights from any permission set, actions like editing environment variables or triggering deploy jobs stay blocked no matter which group the user sits in. This is the documented override behavior of license type over group assignment.
- D. Creating account-owner-scoped service tokens is an administrative action, and the Read-Only license blocks administrative actions outright. Group membership in Account Admin does not restore that capability.
5.When SCIM takes over adding and removing users
On Enterprise and Enterprise+ accounts that use Okta or Entra ID, SCIM can manage users from the identity provider instead of from dbt. The admin creates or disables a user in the IdP, and SCIM applies that change in dbt in near real time. Supported features include user provisioning and deprovisioning, profile updates, and group creation and management. In practice, an employee leaving the IdP also leaves dbt, with no one opening the Edit pane.
Turning on SCIM changes the manual workflow described above. Inviting users, updating user details and changing group memberships are all disabled by default. New users are also no longer added to the default groups automatically. You can turn these actions back on with Allow manual updates, but keep it off so that SCIM-managed users stay in sync with the IdP. Before enabling SCIM, create an Account Admin group in the IdP and a dbt group with the same name that has the Account Admin permission set. Without it, admins can be removed from the default Owner group and lose admin access.
Checkpoint 8 of 8· Check yourself
After SCIM is enabled with default settings, an admin tries to invite a contractor from Account settings → Users. What happens?
With SCIM on, manual actions such as inviting users are turned off by default so the IdP stays the source of truth.
“Manual actions such as inviting users, updating user information and updating group memberships are disabled by default”Source: docs.getdbt.com
Sources5
Exam traps
Each one states something that sounds right. Open it to see what is actually true.
1.Re-inviting a deleted user with the same email brings back their previous groups and permissions.Why is that wrong?
Profile information and linked accounts are kept, but permissions and access settings are reset and must be assigned again.
Covered in Deleting a user, and what a re-invite brings back
2.On a Starter plan, deleting a developer automatically lowers the bill.Why is that wrong?
Deleting frees the seat, but the billable developer seat count must be lowered separately under Billing to avoid being overcharged.
Covered in Deleting a user, and what a re-invite brings back
3.For an SSO account, the invitee is onboarded as soon as they accept the email invitation.Why is that wrong?
The SSO user must also authenticate through SSO to redeem the invitation; only then do they appear on the Users screen.
Covered in Email verification and redeeming an invitation with SSO
4.If a batch has more addresses than free licenses, dbt sends invitations until the seats run out.Why is that wrong?
dbt shows a warning and sends none of the invitations.
Sources
Every claim above is drawn from one of these pages, quoted as it was written on the date shown.
- 1.
“must have admin, account admin, project creator, or security admin permissions.”
↩︎ Who can invite, and how a batch invitation works“The admin inviting the users must have a developer or IT license.”
↩︎ Who can invite, and how a batch invitation works“you will receive a warning when you click Send Invitations and the invitations will not be sent.”
↩︎ Who can invite, and how a batch invitation works“Automatic provisioning without email verification is not allowed. This is a security requirement that cannot be bypassed.”
↩︎ Email verification and redeeming an invitation with SSO“Make sure that traffic from the support@getdbt.com email is allowed in your settings to avoid emails from going to spam or being blocked.”
↩︎ Email verification and redeeming an invitation with SSO“Once SSO is enabled, you will no longer be able to add local users.”
↩︎ Email verification and redeeming an invitation with SSO“Once revoked, generate a new invitation to the correct email address.”
↩︎ Email verification and redeeming an invitation with SSO“their personal profile information, including linked accounts, will persist”
↩︎ Deleting a user, and what a re-invite brings back“Your ability to invite users is limited to the number of licenses you have available.”
↩︎ Key concept“Any previously assigned permissions and access settings are reset, and you will have to reassign them.”
↩︎ Exam trap 1“Accepting the invite doesn't fully complete the process. The user must log in using SSO to redeem the invite and access the account.”
↩︎ Exam trap 3“you will receive a warning when you click Send Invitations and the invitations will not be sent.”
↩︎ Exam trap 4“Select the license type for the batch of users from the License dropdown.”
↩︎ Checkpoint“Accepting the invite doesn't fully complete the process. The user must log in using SSO to redeem the invite and access the account.”
↩︎ Checkpoint“Any previously assigned permissions and access settings are reset, and you will have to reassign them.”
↩︎ Prediction - 2.
“When you manually invite a user, you will assign the license in the invitation window.”
↩︎ Who can invite, and how a batch invitation works“Every user in dbt must be assigned to at least one group.”
↩︎ Who can invite, and how a batch invitation works - 3.
“Note, an IT license does not count toward seat usage.”
↩︎ Making room: seat counts on Enterprise-tier and Starter plans“Adjust your developer user seat count, which manages the users invited to your dbt project.”
↩︎ Making room: seat counts on Enterprise-tier and Starter plans“make sure you fill in all the payment details, including the Billing address section.”
↩︎ Making room: seat counts on Enterprise-tier and Starter plans“Click Confirm Delete to immediately delete the user without additional password prompts.”
↩︎ Deleting a user, and what a re-invite brings back“this will open up their seat for another user or allow the admins to lower the total number of seats.”
↩︎ Deleting a user, and what a re-invite brings back“follow these steps to lower the license count to avoid being overcharged”
↩︎ Exam trap 2“Adjust your developer billing seat count, which manages the number of billable seats.”
↩︎ Checkpoint“follow these steps to lower the license count to avoid being overcharged”
↩︎ Checkpoint - 4.https://docs.getdbt.com/faqs/Accounts/delete-usersOfficial docs
“To delete a user in dbt, you must be an account owner or have admin privileges.”
↩︎ Deleting a user, and what a re-invite brings back - 5.
“SCIM will automatically make those changes in near real-time downstream in dbt.”
↩︎ When SCIM takes over adding and removing users“we recommend keeping this setting disabled.”
↩︎ When SCIM takes over adding and removing users“Manual actions such as inviting users, updating user information and updating group memberships are disabled by default”
↩︎ Checkpoint