Skip to content

Team Best Practices

Follow these guidelines to keep your teams well-organized and secure.

Team Organization

  • Organize teams around functional boundaries (e.g., "Data Engineering", "Data Quality", "Analytics").
  • Use descriptive names that clearly indicate the team's purpose and scope.
  • Keep team sizes manageable. Smaller, focused teams are easier to audit and maintain.
  • Create teams for individual users. Use team-level access, not user-level.
  • Assign all datastores to the Public team. This defeats the purpose of team-based access control.

Permission Assignment

  • Assign the least privilege permission level needed for the team's work
  • Use Viewer or Reporter for teams that only need read access
  • Use Editor only for teams that need full datastore management capabilities
  • Review and update permissions when team responsibilities change

Public Team Usage

  • The Public team is meant for datastores that should be accessible to everyone in the organization
  • Avoid assigning sensitive datastores to the Public team
  • If users need no default access, keep the Public team with no datastores assigned

Membership Strategy

  • Add Service Users to teams to scope their access to specific datastores
  • Use Directory Sync with managed or self-hosted deployments to synchronize users, Teams, and Team membership from your identity provider
  • For self-hosted deployments using OIDC, just-in-time group sync is an add-only alternative. Removing an IdP group does not revoke Team membership, so pair it with a periodic reconciliation of Team membership against the group listing recorded for each account
  • Choose one authoritative Team membership strategy. If both methods are enabled, sign-in mapping can add a membership that Directory Sync previously removed
  • For more details on how team membership works with service users, see the Team Membership Strategy documentation

Regular Audits

  • Periodically review team membership to ensure users still belong to the correct teams
  • Remove users from teams when they change roles or responsibilities
  • Review which datastores are assigned to each team to avoid unnecessary exposure