Last updated August 20, 2026

Heroku offers two types of team structures: regular and Enterprise. Both support collaboration, but Enterprise Teams include advanced features for larger organizations. This article covers the actions allowed to each role.

• Admin: Full control over all resources, users, and settings.
• Member: Can view and create resources, but can’t manage users or team settings.
• Viewer: Read-only access to resources.
• Collaborator: Not a full team member, but can be invited to specific apps for limited access.

*: Must also have billing permission on Enterprise Account if Enterprise Team.

Access

Find all the users in a team under the Access tab.

When you provision a team it only has one user, the admin user that requested the team. This initial admin can add other users to the team and give them the appropriate access. Each non-Enterprise team can have up to 25 team members and each Enterprise team can have up to 500 members.

Admin, Member, Viewer, and Collaborator Roles

Users in a team can be admins, members, viewers, or collaborators.

Admin

An admin user controls membership to the team, can view billing information, and can perform any action on any app owned by the team. Admin users can:

• Access all apps in the team
• Add, remove, and modify users in the team
• View resource usage across the team
• Manage invoices and billing for the team
• Rename the team
• Transfer, create, and delete apps in the team

Users accountable for spend, development processes, and security posture are typically the admin role. Only existing admins can add admin users. A team must have at least one admin user. The last administrator in a team can’t be removed to enforce this rule.

Member

Only team admins can add member users. Assigning a user the member role gives them read-only access to all apps within the team. Admins can grant additional access to members on a per-app basis. Members can:

• List all apps in the team
• View admins & members in the team
• View resources for the team
• Transfer personal apps into the team
• Create apps in the team

Users in the member role can view all apps and see basic details about each app. By default, they can’t perform any other operations on the app. You must grant users in the member role additional permissions on a per-app basis to perform development and operational tasks on specific apps. Members who have the manage permission on an app (including admins) can grant other members additional permissions.

Users in the member role can create apps within, and transfer apps to, a team. Members automatically get all permissions on the apps they create and can grant other members-specific permissions on their apps. The member role is commonly assigned to the in-house developers working on your apps.

Viewer

A viewer is a limited role that enables users to view apps and pipelines, spaces, users (Access tab), and resources.

Collaborator

Collaborator users don’t belong to your team but have app-specific permissions. Collaborator users can’t:

• List or access other apps that belong to the team
• View the list of team users
• Create or transfer apps to the team

Third-party collaborators not trusted to view all apps in the team can be granted permissions on specific apps. You don’t have to add them to a team or assign them a role in a team. For example, you can grant contractor developers assigned to a specific project access to only the apps that are part of that project.

For more information about how to grant members and non-team members permissions on specific apps, see Managing App Permissions. For more information about the capabilities granted per role, see Teams Permissions and Allowed Actions.

Additional Reading

• Managing Team Roles and App Access
• App Permissions
• Managing App Permissions
• Pipeline Ephemeral App Permissions
• Managing Access in Enterprise Accounts