Using Shorebird across your scaled company just got a lot easier. Today, we’re announcing the enterprise console: one page where you can see and manage your company’s entire Shorebird footprint, including domains, organizations, people, activity, billing and security.
This is one of the biggest releases we’ve shipped for enterprise teams, so here are the highlights.
Your whole company on one page
The enterprise console lives at console.shorebird.dev/enterprise, and enterprise owners, admins and billing managers reach it from the organization switcher. From the console, you can see your enterprise’s claimed domains, every organization attached to it, and every member. We also automated a lot of regular busywork:
- Organizations auto-attach. If an employee signs in with their company account and creates an organization, it’s attached to your enterprise and shows up in the console.
- Your domain’s accounts are yours. When your enterprise claims an email domain, accounts on that domain become members of your enterprise. They don’t need to sign in again.
- Auto-add to organizations. Pick default organizations with , and people at your domains join them as a Viewer or Developer the next time they sign in with their company account. The console shows which organizations are defaults.
Provision people from Okta or Entra ID with SCIM
Your identity provider already knows who works at your company; you shouldn’t have to keep a second list by hand. Shorebird supports SCIM 2.0 user provisioning and is tested with Okta and Microsoft Entra ID. Other identity providers that send standard SCIM 2.0, such as OneLogin and JumpCloud, use the same settings. Once it’s connected, your identity provider adds people when you assign them the Shorebird app, keeps their names current, and deactivates them when they leave, which removes them from every organization and revokes their sessions and API keys.
Enterprise owners set up SCIM from the Security tab of the enterprise console. See the SCIM setup guide.
Manage the members of any organization
Enterprise customers shared with us that they wanted better tools to get a “bird’s-eye” view of organization membership, so we’ve added tools for this specific purpose. Now, as an enterprise owner or admin, you can open any organization from the Organizations tab and manage it without joining. You can:
- List the organization’s members.
- Add members, change their roles and remove them.
- List the organization’s apps.
- Change whether it’s a default organization.
Control members and guests across your enterprise
With our improved guest access controls, you can manage granular access across the whole company from the console:
- Add colleagues without invitations. Organization admins in your enterprise can add someone from the company directory right away. That person gets an email saying they were added, with a link to the organization.
- Set a guest policy. You can set a company-wide guest policy from the console, such as allowing no guests at all, or only guests from your agency’s domain.
- Offboard someone in one step. removes a person from every organization and app in your enterprise and revokes their sessions, API keys and invitations.
- Remove guests. Remove one guest or every guest at once. The confirmation shows how many people are affected, and removals are recorded in the audit log.
Enterprise roles (Owner, Admin, Billing manager and Member) are separate from organization roles, so the people who manage your account don’t get access to your apps by default. Learn more in the Enterprise Roles documentation.
Track your quota usage
The enterprise console has a Billing tab for enterprise owners and billing managers. It shows your contract, usage and invoices, and meters installs against the contract: what’s included, this period’s count, and any overage.
- Each organization’s owner. The Billing tab lists the owner of each organization your contract covers, by name and email, so you know exactly who to talk to about an organization’s usage.
- Patch installs by organization. A chart shows patch installs by organization, day by day or as a running total against your included installs. Use it to see whether you’re headed for overage before renewal, or to look back at earlier periods.
The new Billing manager role gives finance staff your enterprise’s bill without access to its apps, people or policies.
One audit log for your enterprise
Security teams need a comprehensive, historical record of actions taken in your company, and we’ve improved Shorebird’s auditing capabilities dramatically.
Our audit log records enterprise-level events such as domains being added, a sign-in method being required for a domain, admin changes and organizations being attached. Changes Shorebird staff make to your enterprise or its organizations are recorded too. Audit log entries now carry a lot more detail:
- The IP address and user agent of the person who acted, even when they acted through the console or the MCP server
- The type of credential used (a signed-in session or an API key), with session details
- Clear labels for service accounts and CI jobs signed in with OIDC
- New events for app creation and patch note edits
We also now support exporting audit logs to your SIEM. Visit our Audit Log documentation for more details.
What’s next
There’s a lot more, but in an effort not to turn this post into a dissertation, we’ve left some things out. Take a look around, and visit our enterprise docs for more detail. We think you’ll like it as much as we do.
