> ## Documentation Index > Fetch the complete documentation index at: https://docs.replit.com/llms.txt > Use this file to discover all available pages before exploring further. # Account and Workspace Admins > Account admins and workspace admins are distinct roles. Account admins manage billing and every workspace under your account, while workspace admins manage only the workspaces they belong to. **This page applies to the Enterprise plan only.** Separate account admin and workspace admin roles exist only on Enterprise. On the **Core** and **Pro** plans, your account has a single **account admin** (typically the account owner) and there is no separate workspace admin role. If you're on Core or Pro, see [Managing Members](/teams/identity-and-access-management/managing-members) and [Roles, Groups and Access](/teams/identity-and-access-management/groups-and-permissions) instead—the **Admin** role described there is your account admin. On the Enterprise plan, Replit separates administrative responsibility into two distinct roles: **account admins** and **workspace admins**. Splitting these roles lets you give someone full control over a single workspace without also handing them billing and account-wide control. This page explains what each role does, how they differ, and how to configure them. ## How the two roles relate Your Replit **account** is the billing entity that owns your subscription, seats, and one or more **workspaces** (your organizations)—Enterprise accounts can contain more than one. The two admin roles map onto these two scopes: * **Account admins** govern the whole account. They control billing and have administrative access across every workspace under the account. * **Workspace admins** govern only the specific workspace (or workspaces) they belong to. They have no billing access and no control over other workspaces. Every account admin is automatically an admin in every workspace under the account, so an account admin is effectively a superset of a workspace admin. A workspace admin is not an account admin and cannot manage billing or other workspaces. Account-wide. Manages billing, seats, security settings, and every workspace under the account. Workspace-scoped. Manages members and resources within their own workspaces only. ## What each role can do Both roles administer workspaces—the difference is *which* workspaces. An account admin administers every workspace under the account, while a workspace admin administers only the workspaces they belong to. | Capability | Account admin | Workspace admin | | ---------------------------------------------------------------- | :-----------: | :-------------: | | Manage members in workspaces they administer | Yes | Yes | | Manage apps, groups, and resources in workspaces they administer | Yes | Yes | | View and edit billing, payment methods, and invoices | Yes | No | | Edit, cancel, or restore the subscription | Yes | No | | Add, remove, and assign seats | Yes | No | | Set spending and usage limits | Yes | No | | Create new workspaces | Yes | No | | Manage other account admins | Yes | No | | Administer every workspace under the account | Yes | No | | Configure SAML, SCIM, audit logs, and security contacts | Yes | No | Workspace admins hold administrative power scoped to their own workspaces, while account admins hold every administrative power across the entire account. Billing, seat management, subscription changes, and account-wide security controls require an account admin. A workspace admin cannot perform these actions, even within their own workspace. ## Configuring account admins Account admins are managed from the **Seats** tab in your settings. Adding an account admin grants account-wide administrative access and automatically makes that person an admin in every workspace under the account. ### Promote a member to account admin From your settings, open the **Seats** tab. This tab lists the people in your account along with their current role. Find the member you want to promote, open the actions menu, and select **Promote to account admin**. The change takes effect immediately. ### Demote an account admin Demoting an account admin removes their account-wide and billing access. By default, demotion does not remove them from their workspaces—they keep workspace access independently of account admin status. From your settings, open the **Seats** tab. Find the account admin, open the actions menu, and select **Demote from account admin**. The change takes effect immediately. A few rules protect your account from losing administrative access: * You cannot demote yourself. * You cannot remove the last account admin. Your account must always have at least one. * You cannot demote the owner of a personal account. ### SCIM-provisioned admins If you provision users through [SCIM](/teams/identity-and-access-management/scim), a user assigned the **Admin** role by your identity provider becomes an **account admin**. To create a workspace-scoped admin, assign the **Workspace admin** role in Replit rather than through your identity provider. ## Configuring workspace admins Assign the workspace admin role to give someone full administrative control of a specific workspace without granting account-wide or billing access. This is useful when a team lead should run their own workspace but should not manage the subscription or other teams. Open the workspace whose admin you want to assign, then go to its **Members** page. Find the member, open their role selector, and choose **Workspace admin**. The member gains administrative access scoped to that workspace only. A workspace admin's access stops at the workspaces they belong to. They cannot access billing, manage seats, or administer other workspaces—those actions require an account admin. ## Choosing the right role * Assign **account admin** to people who own billing, manage the subscription and seats, configure security settings, or need oversight across every workspace. * Assign **workspace admin** to people who run a single team or workspace and should manage its members and resources without touching billing or other workspaces. ## Next steps Learn how roles and custom groups control access across your organization. Add, remove, and assign roles to members of your organization. Automate user provisioning and role assignment from your identity provider. Control your billing capacity and the number of seats you pay for.