• Home
  • Integrations
  • SDKs
  • Guides
  • API docs
No results for ""
EXPAND ALL

EDIT ON GITHUB

Building teams in LaunchDarkly

Read time: 5 minutes
Last edited: Nov 17, 2021

Overview

Teams help large organizations to more easily manage their members and access in LaunchDarkly. This guide contains best practices for getting started using teams in LaunchDarkly and shows you how to create private teams.

Prerequisites

In order to complete this guide, you must have the following prerequisites:

  • An enterprise plan in LaunchDarkly. Teams is available to customers on an Enterprise plan. To learn more, read about our pricing. To upgrade your plan, contact Sales.
  • An owner / admin role in your LaunchDarkly account, or a custom role with team management permissions.

Concepts

This guide relies on the following concepts:

Members

Account members are people who work at your organization or have access rights to your organization's LaunchDarkly environment for another reason, such as contractors or part-time employees.

To learn more about members, read LaunchDarkly account members.

Teams

Teams are groups of your organization's members. A LaunchDarkly account administrator can give specific permissions to teams with custom roles that let them perform actions on different resources, such as projects or flags.

To learn more about teams, read Teams.

LaunchDarkly's built-in roles

LaunchDarkly has three built-in roles: reader, writer, and owner / admin. Every account member must have at least either one of these three built-in roles or a custom role. If you need to, you can also assign account members multiple custom roles to give them the exact set of permissions they need.

To learn more about built-in roles, read LaunchDarkly’s built-in roles.

Custom roles

Custom roles give you precise access control to everything in LaunchDarkly, including feature flags, projects, environments, metrics, and teams, so you can enforce access policies that meet your exact workflow needs.

To learn more about custom roles, read Custom roles.

Getting started with teams

Depending on your organization’s level of experience with LaunchDarkly, you can get started with teams in one of two ways. Here are the two levels:

  1. You're new to LaunchDarkly: You are one of the first members of your organization to use LaunchDarkly. Your colleagues have not yet been invited to LaunchDarkly or have not been actively using LaunchDarkly yet.
  2. You already use LaunchDarkly: Your organization is already actively using LaunchDarkly and you want to start using teams.

You're new to LaunchDarkly

If you are one of the first members of your organization to use LaunchDarkly and you need to invite others to LaunchDarkly, then take this approach.

To invite new account members, follow the steps outlined in Adding members to LaunchDarkly. When you invite new members, you must assign a built-in role or at least one custom role to each member.

Follow these guidelines when you assign a role:

  • Developers who not need write privileges to everything in your LaunchDarkly account can be assigned the built-in reader role. This grants read access to everything in your LaunchDarkly account, but write and modification access to nothing. Then, create a new team. Create a custom role that grants write access only to specific projects, environments, or flags that the team needs to do their jobs. Assign the custom role and the account members to the team. Team members inherit the custom roles assigned to the team. To learn how to create a team and assign members and custom roles to it, read Creating a team and Managing teams.

  • Administrators who require admin access to your LaunchDarkly account can be assigned an owner / admin built-in role when you invite them to LaunchDarkly. They will not lose this access if they are also added to a team in LaunchDarkly, because access granted to an individual member is aggregated with access granted to a team. To learn more, read Understanding how team roles interact with individual member roles.

You already use LaunchDarkly

If your organization is already actively using LaunchDarkly and you want to migrate into using teams, then take one of these approaches:

  1. Retain existing access: Use these recommendations for account members who should retain the same level of access as they currently have based on their individual member roles.
  2. Update access to be more restrictive: Use these recommendations in cases where you want to give a set of account members more focused, restrictive access than they currently have based on their individual member roles.

Retaining existing access

To change the access for a set of account members to be controlled by membership in a team, rather than individual roles, follow this procedure:

  1. Create a new team for a set of account members, and add their leads as team maintainers. To learn how, read Creating a team and Adding a team maintainer.

  2. Add the existing account members to the team. Then, assign a custom role with the same level of access as the original member role to the team. Follow the steps outlined in Managing teams to assign members and custom roles to the team. If you need to create a new custom role before assigning it to the team, follow the steps outlined in Creating custom roles and policies.

  3. Update each of the team member’s member roles to a role with less access, such as a built-in reader role or a custom role with limited access.

To update a member’s role:

  1. Navigate to Account Settings and click into the [Members] (https://app.launchdarkly.com/settings/members) tab.
  2. Find the member in the list of account members.
  3. Click Manage.
  4. Select the role you wish to assign in the dropdown under Member roles.
  5. Click Save role.

We recommend the above approach because access granted to an individual member is aggregated with access granted to a team. This means individual member access should be kept at a minimum in order to layer on team access. To learn more, read Understanding how team roles interact with individual member roles.

Updating access to be more restrictive

If you want to further restrict a team's current permissions, audit their existing permissions in LaunchDarkly and determine where you can restrict the scope. For example, if all developers were previously assigned the built-in writer role, you may want to create teams and assign more granular custom roles that only grant write permissions to certain projects, environments, or flags. This approach can be helpful from both a security and organizational perspective.

After you’ve completed the audit, we recommend taking the following steps:

  1. Create a new team for each group identified. Optionally, add the team leads as team maintainers. To learn how, read Creating a team and Adding a team maintainer.
  2. Add the members to the appropriate team. Then, assign a custom role with a more focused level of access to the team. Follow the steps outlined in Managing teams to assign members and custom roles to the team. If you need to create a new custom role before assigning it to the team, follow the steps outlined in Creating custom roles and policies.

Alternatively, you can update each of the team member’s roles to a role with less access, like a built-in reader role or a custom role with limited access.

To update a member’s role:

  1. Navigate to Account Settings and click into the Members tab.
  2. Find the member in the list of account members.
  3. Click Manage.
  4. Select the role you wish tot assign in the dropdown under Member roles.
  5. Click Save role.

Creating private teams

Sometimes a team and project should be kept private due to security or other organizational policies. In order to achieve this, all member and team custom roles for members who are not a part of the private team need to include a policy that restricts view access to the private team and project.

The following code sample restricts view and edit access to a project called project-1 and a team called team-1:

1[
2 {
3 "resources": ["proj/project-1"],
4 "actions": ["viewProject"],
5 "effect": "deny"
6 },
7{
8 "resources": ["team/team-1"],
9 "actions": ["viewTeam"],
10 "effect": "deny"
11 }
12]

Conclusion

In this guide, you learned some key concepts that provide a foundation for using teams, best practices for getting started using teams whether you're new to LaunchDarkly or have been using LaunchDarkly for some time, and how to create private teams.

Want to know more? Start a trial.

Your 14-day trial begins as soon as you sign up. Learn to use LaunchDarkly with the app's built-in quick start guide. You'll see how easy it is to manage the whole feature lifecycle from concept to launch to control.

Want to try it out? Start a trial.