Table of contents
How people, spaces, and roles fit together
Fugo gives you full control over who can access your account and what they can do.
Whether you're onboarding a single teammate or rolling out Fugo across a large organization, this article covers everything in one place: inviting members, organizing teams into spaces, customizing permissions with roles, and connecting your identity provider for single sign-on.
Think of it this way:
Workspace - your entire Fugo account. Every invited user belongs to the workspace.
Spaces - optional sub-groups inside the workspace (e.g. "Marketing", "Retail East"). A user belongs to exactly one space at a time.
Roles - a named set of on/off permissions (e.g. "Manager", "Viewer"). Every user is assigned one role. Roles are workspace-wide, not per-space.
Admins space: Users who are not assigned to any regular space appear in a special system space labeled Admins (marked with an Admin badge in your spaces list). This isn't a space you create — it's where workspace-level members live. You can't rename or delete it.
The People tab - your full member list
To get here: open the Settings modal from your Account menu in the left sidebar. Then select the People tab under Team.
The People page shows every member of your workspace in a Members table.
Use the Search members bar in the top right to filter by name or email. The table columns are:
Name - display name and avatar. Pending invitees are badged Invited.
Email
Role - a dropdown you can change inline (except for your own account). Changes take effect immediately.
Space - the space this member currently belongs to.
⋮ menu - per-member actions including removing or deleting the user.
👆 Tip: You cannot change your own role from this screen. Ask another admin to update it for you.
Inviting someone to your workspace
1. Go to Settings → People.
2. Click Invite People in the top-right corner.
3. In the dialog that appears, enter the person's email address.
4. Optionally select a Space from the dropdown to place them in a specific space right away. Leave it blank to add them at the workspace level.
5. Select a Role from the dropdown.
6. Click Invite People. The invitee receives an email with a link to accept.
While the invite is pending, the person appears in the member list with an Invited badge. Their role and space can't be edited until they accept:
☝️ Tip: Invitation links are protected by reCAPTCHA. If a send fails with a security error, the system will retry automatically up to two times before showing an error message.
Join workspace requests
Instead of always inviting people manually, you can let people request access and approve them yourself.
Enabling join requests
1. Go to Settings → People.
2. At the top of the page, find the Join Workspace Requests panel.
3. Toggle Allow join requests on.
When this is on, anyone who signs up with a matching email domain can send a request to join your workspace.
Requesting to join - the new user's view
When a new user creates a Fugo account with an email domain that matches your workspace, they're shown a Join a Workspace popup before entering the CMS:
It lists any matching workspaces and shows a Request to join button next to each one:
Once they click it, the button changes to Requested and they're shown a confirmation that your workspace administrator will be notified to approve their request:
From the same popup, users who don't find a matching workspace - or who want a completely separate account - can instead click Create new workspace to start their own.
Reviewing and acting on requests
Pending requests appear in the list below the toggle. For each request you'll see the requester's email and the date submitted. You have three options:
Add as Tenant Member - approves the request and adds them to the workspace without a specific space assignment.
Add as Tenant Admin (via the dropdown arrow next to the approve button) - approves and grants admin-level access.
Reject - declines the request. The request is marked Rejected in the list.
Use the refresh button next to the Join Workspace Requests heading to fetch the latest requests:
Removing users
There are two ways to remove someone from your workspace. Both options are available from the ⋮ menu on a member's row in the People tab, or from the member's ⋮ menu in the Spaces tab.
Delete User Completely
Permanently deletes the user from the entire workspace. This cannot be undone. The user will no longer be able to log in to this workspace.
Remove from Space
Removes the member from their current space. Their account and workspace access remain intact - they simply move to the Admins space until reassigned. Use this when you want to reorganize without revoking access entirely.
The Spaces tab - organizing your team
To get here: open the Settings modal from your Account menu in the left sidebar. Then select the Spaces tab under Team.
The screen is split into two panels:
Left panel - the list of all your spaces, each showing a member count. The currently selected space is highlighted.
Right panel - the members of the selected space, showing each person's name, email, and role. Use the Search spaces bar in the top right to filter by name.
Space labels you'll see in the list:
Default - new members who aren't assigned to a specific space are automatically placed here.
Admin - the system space for workspace-level members. Read-only; cannot be renamed or deleted.
ℹ️ Note: Owner-role members show an Admin Space only badge in the member list. They can't be moved to a regular space because their access is workspace-wide, not space-scoped.
When to use spaces - and when not to
Spaces are a hard organizational boundary. Every asset in Fugo - screens, playlists, media, and dashboards - is fully isolated per space. Members in one space have no visibility into the assets of another. A screen in "Retail East" is invisible to anyone working in "Marketing," and vice versa.
This makes spaces the right tool when you want completely separate working environments within a single account, for example:
Resellers or agencies managing Fugo on behalf of multiple clients, where each client should only ever see their own screens and content
Large organizations with divisions that operate independently and should never share content or screens
Multi-location businesses where each location manages its own screens and has no need to see what other locations are doing
Spaces are not a content scheduling or targeting tool. If your goal is to control which content plays on which screen at which time, that's what playlists are for - not spaces. You don't need separate spaces to run different content in different areas; a single space with well-organized playlists handles that entirely.
☝️ Tip: A good rule of thumb: if these users need to be completely unaware of each other's screens and content, use spaces. If they just need different publishing permissions or different content schedules, stay in one space and manage it through roles and playlists.
Creating a space
1. In Settings → Spaces, click the + button at the top of the spaces list.
2. Enter a Space name. Names must be unique, under 255 characters, and cannot contain :/, http, or <.
3. Optionally search for and select members to add to the new space right away. Pending (invited) users and Admin Space members are not shown in this list.
4. Click Create Space.
5. Your new space will now be listed in the left-hand Spaces panel. Any selected members are automatically moved from their current space into the new one:
Renaming a space
1. Hover over a space in the list to reveal the action icon, then click the edit (pencil) icon.
2. Type the new name in the inline text field that appears.
3. Press Enter or click the ✓ button to save, or click ✗ to cancel.
Default spaces and the Admins space cannot be renamed.
Setting a default space
1. Hover over a space in the list to reveal the action icons, then click the set default (circular check mark) icon.
3. A confirmation dialog will appear - click Set as Default to confirm.
Once set, new members without an explicit space assignment will automatically be placed here.
Deleting a space
1. Hover over a space in the list to reveal the action icons and click the delete (trash) icon.
2. Confirm the deletion in the confirmation dialogue box.
Before the space is removed, all members in it are automatically relocated to the default space.
ℹ️ Note: Deleting a space is permanent and cannot be undone. Members are safely moved to the default space before deletion completes. The default space and the Admins space cannot be deleted.
Moving users between spaces
Each team member row has a ⋮ actions menu.
The available options depend on the member's role:
Move to Space - opens a searchable list of all other spaces. Select a destination and confirm. The member is moved immediately. If no other spaces exist yet, this option is hidden.
Create New Space - available from within the Move to Space dialog. Creates a new space and moves the member there in one step.
Remove from Space - removes the member from their current space without deleting their account. They move to the Admins space until reassigned.
Owner protection: If a member holds the Owner role and is the only Owner in the workspace, the Remove and Delete actions are blocked. Assign the Owner role to another member first, then come back to remove or delete the original.
The Roles tab - custom permission sets
To get here: open the Settings modal from your Account menu in the left sidebar. Then select the Roles tab under Team.
The screen is split into two panels:
Left panel - the list of all roles in your workspace. The default role is marked Default. Fugo comes with several pre-built roles out of the box (Owner, Manager, Content Creator, Publisher, Viewer, Billing Manager, Quick Caster, and others). You can edit these or create fully custom roles on top of these, depending on your plan.
Right panel - the permission toggles for the selected role, organized by feature area.
Setting a default role
1. Hover over any non-locked role in the list to reveal the action icons.
2. Click the Set as default (cicrular checkmark) icon.
3. Confirm in the dialog box that appears.
New users who join or are invited without an explicit role will automatically receive this role.
Editing roles
If you are on the Core or Enterprise pricing plan, you can edit the permissions assigned to a role.
1. Select the role you want to edit from the roles list in the left-hand panel.
2. Use the permission toggles in the right-hand panel to edit the permissions for that role. Click Save Changes when you're done.
Creating a role
If you are on the Enterprise pricing plan, you can create new roles with fully custom permissions.
1. Click the + button at the top of the roles list.
2. A new role called "New Role" will be created with all permissions turned off. You'll find it at the bottom of your role list. Click it to open its permissions panel.
3. Toggle the permissions you want on or off (see Permissions explained below for more detail on permissions). Click Save Changes when you're done.
Deleting a role
If you are on the Enterprise pricing plan, you can delete roles.
1. Hover over a role in the list and click the delete (trash) icon.
2. Confirm the deletion in the dialogue box that appears.
Any users currently assigned to that role will be reassigned to the default role.
ℹ️ Note: The Owner role and the current default role are locked - their permissions cannot be edited and they cannot be deleted. This protects against accidentally losing administrative access to your workspace.
Permissions explained
Each role can have any combination of the following permissions toggled on or off:
Screens
View screens - can see the Screens page and screen details.
Edit screens - can create, rename, configure, and delete screens.
Quick cast to screens - can use the Quick Cast feature to push content to a screen instantly.
Playlists
View playlists - can see playlists.
Publish playlists - can publish a playlist to screens.
Edit playlists - can create, edit, and delete playlists.
Studio Content
View studio content - can see content in Canvas Studio.
Edit studio content - can create and edit studio designs.
Media
View media - can browse the media library.
Upload/remove media - can upload new files and delete existing ones.
Channels
View channels - can see channels/apps.
Edit channels - can create and configure channels.
Dashboards
View dashboards - can see dashboards.
Edit dashboards - can create and modify dashboards.
Billing
View billing - can see billing information and plan details.
Edit billing - can change plans and payment information.
People and Spaces
View people - can see the member list.
Invite/remove people - can invite new members and remove existing ones.
View spaces - can see the spaces list and membership.
Edit spaces - can create, rename, and delete spaces, and move members between them.
Roles
View roles - can see the roles list and their permission configurations.
Assign role to user - can change the role assigned to a member.
Edit roles - can create, modify, and delete custom roles.
Single Sign-On (SSO)
Fugo supports single sign-on through two protocols: SAML 2.0 and OpenID Connect (OIDC). Once configured, members with a matching email domain can sign in to Fugo using your organization's existing credentials, without needing a separate Fugo password.
A few things to know before you start:
Only one SSO provider can be active at a time.
SSO requires your Fugo account to be accessed over HTTPS. It will not work on insecure connections.
To get here: open the Settings modal from your Account menu in the left sidebar. Then select the Single Sign On tab under Team:
Choosing a protocol
When you click Set up SSO, Fugo asks you to choose between SAML 2.0 and OpenID Connect. The right choice depends on what your identity provider supports and how your IT team prefers to configure it:
SAML 2.0 - the right choice for most enterprise setups. Works with Google Workspace, Okta, and Azure AD, among others. Configuration is certificate-based and requires a bit more setup upfront.
OpenID Connect (OIDC) - a more modern, lightweight option. Works with Okta, Auth0, and Google. Configuration uses client credentials and is generally simpler to set up.
If you're not sure which to use, check with whoever manages your identity provider. They'll know which protocol your organization has configured.
Setting up SAML 2.0
Before starting, you'll need the following from your identity provider:
Go to Settings → Single Sign-On and click Set up SSO.
Select SAML 2.0.
Fill in the following fields:
Provider Name - a display name for this connection (e.g. "Okta SAML").
Login URL - the SSO endpoint URL your IdP uses to receive login requests (sometimes called the SAML SSO URL or Redirect URL in your IdP).
Logout URL - the endpoint your IdP uses to handle logouts.
Domains - the email domain(s) whose users should be routed through this SSO connection (e.g.
yourcompany.com). Separate multiple domains with commas.Certificate - the X.509 signing certificate from your IdP, in PEM format. Fugo strips the header and footer lines automatically, so you can paste the full certificate as-is.
Signature Algorithm - select the algorithm your IdP uses to sign SAML assertions: RSA-SHA1, RSA-SHA256, or RSA-SHA512. RSA-SHA256 is the most common default.
Click Save.
Once saved, Fugo displays two values you'll need to enter into your identity provider:
Redirect URL (ACS) - the Assertion Consumer Service URL where your IdP sends the SAML response after authentication.
Entity ID - Fugo's unique identifier, used by your IdP to recognize Fugo as a trusted service provider.
Copy both of these into your IdP's SAML application configuration to complete the setup.
Setting up OpenID Connect (OIDC)
Before starting, create an application in your identity provider and note the client credentials it generates.
Go to Settings → Single Sign-On and click Set up SSO.
Select OpenID Connect.
Fill in the following fields:
Provider Name — a display name for this connection (e.g. "Okta OIDC").
Domains — the email domain(s) whose users should be routed through this SSO connection. Separate multiple domains with commas.
Client ID — the client ID issued by your identity provider for your Fugo application.
Client Secret — the client secret issued by your identity provider.
Identity Provider Domain — the base domain of your IdP (e.g.
your-org.okta.com,accounts.google.com). Fugo uses this to automatically discover the necessary endpoints.
Click Save.
Once saved, Fugo displays the value you need to enter in your IdP:
Redirect URL (Callback) — the URL your IdP should redirect users back to after authentication. Paste this into your IdP application's allowed redirect URIs.
How SSO login works for your team
Once SSO is configured, here's what members with a matching email domain experience:
They go to the Fugo login page and enter their work email address.
Fugo detects that their email domain is covered by an SSO configuration and routes them to your identity provider to authenticate.
After authenticating with their organization credentials, they're redirected back to Fugo and signed in.
Members whose email domains don't match your SSO configuration will continue to sign in with their Fugo email and password as normal.
☝️ Tip: Fugo also shows Sign in with Google and Sign in with Microsoft buttons on the login page for teams using those providers. These are quick-access shortcuts that work alongside your SSO configuration.
Editing or removing your SSO configuration
Once SSO is active, your Settings → Single Sign-On page shows a summary card with your provider name, protocol, configured domains, and status. From here you can:
Edit - update any of the configuration values. If you're editing an OpenID Connect setup, your client secret is masked; leave the field as-is to keep the existing secret, or type a new value to replace it.
Delete - removes the SSO configuration entirely. Before confirming, note that once deleted, members who relied on SSO to sign in will no longer be able to access Fugo through your identity provider. They will need to use a Fugo email and password, or be re-invited.
Need more help?
If you run into issues creating spaces, roles, or managing users - our team is here to help! You can reach us via the handy support chat box in the CMS or email support@fugo.ai.
If you're looking to add SSO to your account, reach out to your account manager or sales@fugo.ai.