Invite and approve people

Joining a team takes two things: an invitation, which reserves a seat for an email address, and an approval, in which an admin and the new person compare a 6-digit code before the new Mac gets the team’s keys. Signing in alone, by email or SSO, never gives a Mac the keys.

Invite people

Owners and admins invite from the console’s Members page (Invite people) or from Settings › Team › Members › Invite… on an admin’s Mac. Enter one or more email addresses and a role: Member or Admin.

• Each invitation reserves a seat. With no free seat, the console says so (“Add seats in Billing first”); the owner or a billing manager adds seats in Billing. See Billing and seats.
• The person gets an email with a Join link and a download link. The email holds no secret: it only lets that address ask to join.
• Before the team’s keys are set up, you can invite only admins: the first of them sets up the keys on their Mac. Everyone else can be invited once the keys exist.
• Invitations expire. The Members table shows each person’s state, such as Invited · not joined yet, Invited · can set up keys or Waiting for approval, with Resend invitation (it sends the email again) and a way to cancel it. Change role… works on an invitation too, until that person has asked to join.
• If the policy Invitations only to verified domains is on, only addresses in your verified domains can be invited.
• With SCIM, your identity provider can create invitations too.

Inviting someone as Admin gives them admin rights once they join, the same as a promotion.

Approve a new person’s Mac

When an invited person clicks Join in Cloak Proxy, every admin’s Mac shows a request in Settings › Team › Join requests, for example: “Alex (alex@acme.com) wants to join Acme on ‘Alex’s MacBook Pro’. Signed in with SSO: yes.” Admins also get a device request notification on their Mac, and the console’s overview lists people waiting. A request lasts 10 minutes: if it lapses, the person clicks Join again.

1. Click Compare Codes…. Your Mac shows “Compare this code with Alex (alex@acme.com): 123 456. Read it to them on a call or in chat; don’t approve if it differs.”

2. Read the code to the person over a channel you trust, such as a video call or your team chat. Don’t send it by email to an address you haven’t checked.

3. When they confirm it matches, approve. On their Mac they click Codes Match.

4. Their Mac receives the team key and the keys of any restricted spaces they’re listed in, and starts syncing.

Click Deny for a request you don’t recognize. The comparison is what stops a dishonest server, or someone who took over the person’s email, from slipping in a Mac of their own: if anything in between changed the keys, the two codes differ.

Approving widens access

An approved Mac can read every open space at once, and the restricted spaces its owner is listed in. Approve only Macs you’ve checked with the person.

A member’s further Macs

A member adds another Mac the same way, and approves it from one of their own Macs after comparing codes there. An admin’s Mac approves only a person’s first Mac; when automatic approval after SSO is on, an approver Mac can also admit a member’s further Mac. Up to 5 Macs per person, or the number in the Devices per member policy.

Promote, demote and change roles

Owners and admins change a person’s role from the console (Members › ⋯ › Change role…) or from Settings › Team › Members › Change Role….

• Making someone an admin widens power, so the console can only ask for it. An admin’s Mac shows “Owner asked to make Alex an admin. Approve?” and the change happens only when an admin clicks Approve in Settings › Team. Until then the console shows the person as Active · admin role waiting for approval. For someone who is only invited, the console changes the invitation’s role at once.
• Demoting an admin runs automatically the next time an admin’s Mac is online, because it never widens access.
• A team must keep at least one admin. The console refuses to remove or demote the last one.

Approve Macs automatically after SSO

Teams that use SSO can let chosen admin Macs approve some Macs without a code comparison. It’s off by default, and only an admin’s Mac can turn it on, in Settings › Team › Security › Approve Macs automatically after SSO, where you also pick the approver Macs (admin Macs that are usually on). The setting is signed into the team’s member list, so Subcloak’s server can’t turn it on.

When it’s on, an approver Mac that is running admits a new Mac without a code only if all of these hold:

• the request is from someone who is already a member of the team (a brand-new person’s first Mac still needs a code comparison);
• our server reports that the person signed in through the team’s SSO in the last 15 minutes;
• the person is within the Devices per member limit.

The person’s other Macs show “Your new Mac … was approved automatically after SSO. Was this you?”, with Not My Mac to remove it. Every Mac admitted this way shows via SSO in the device list, changes the Team Security code, and appears in the audit log.

The trade-off

When this is on, Subcloak’s server and your identity provider decide which Macs join for members who aren’t admins. If either were compromised, a Mac they control could be admitted as one of those members. Until someone removes it, it can read everything in the team’s open spaces, including their history. It can’t write anything that applies, change who’s in the team, hand out keys or read restricted spaces until the member compares a code between their two Macs. Admins’ Macs are never approved automatically. When this is off, a person compares a code for every new Mac, and neither can admit one.

The console shows the setting read-only on SSO & SCIM: “New Macs: approved by a person comparing a code” or “approved automatically after SSO (set on an admin’s Mac)”.

Related

Spaces, roles and permissionsWhat each role can do.

Remove people and leave a teamWhat removal does and when keys change.

Single sign-onOIDC: Okta, Microsoft Entra ID, Google Workspace and other OIDC providers. SAML is coming later.

Billing and seatsWho takes a seat, and adding seats.