Segment User Management

Segment grants access at the workspace and source/destination levels. Use this guide to manage how the collaborator is invited, updated, and offboarded.

Access Requests at a Glance

• Add User Access explains how to invite the service account and assign workspace roles.
• Update Access & Roles covers adjusting source permissions, roles, and token rights.
• Remove User Access documents the deprovisioning workflow.

Roles to Maintain

• Workspace Owners/Admins: Manage billing, workspace settings, and SCIM/SSO. Keep client ownership primary; grant the collaborator only if the collaborator administers Segment.
• Workspace Members: Standard role for the collaborator on implementation or analytics engagements.
• Source/Destination Access Controls: Additional scoping for sensitive data or marketing endpoints. Document which sources the collaborator can manage.

Governance Checklist

• Track which environments (production, staging, development) the collaborator can access and review quarterly.
• Export the Workspace Audit Log or user list after changes and store it with IAM documentation.
• Confirm SCIM/SSO group mappings align with contractual scope before inviting the collaborator.
• Record any public/private API tokens shared with the collaborator and note their rotation schedule.