> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Devin Desktop Guide for Admins

> Enterprise admin guide for deploying Devin Desktop at scale. Configure SSO, SCIM, RBAC, analytics, and team management for large organizations.

# Devin Desktop Guide for Enterprise Admins

> **Purpose**   This guide helps enterprise *platform / developer-experience* administrators plan, roll out, and operate Devin Desktop for organizations with **large enterprise teams**.  It is intentionally *opinionated* and links out to detailed “how-to” docs per topic.  Treat it both as a **read-through guide** *and* as a **check-list** when onboarding.

***

## 1.   Audience & Pre-Requisites

| | Details |
| - | - |
| **Who should read** | Platform / Dev-Ex admins, Corporate IT, Centralized Tooling teams |
| **Assumed knowledge** | Basic Devin Desktop terms (team, role), Enterprise IdP concepts (SAML, SCIM), CLI usage |
| **Out-of-scope** | Deep security / compliance internals → see **Security & Compliance** docs |

***

## 2.   Quick-Start Checklist

1. Confirm organization-wide settings
2. Set up **SSO** (Okta, Microsoft Entra ID, Google; see SAML docs for others)
3. Enable **SCIM** & map IdP groups → Devin Desktop *teams*
4. Define **role** & **permission** model (least privilege)
5. Configure **Admin Portal**: team view & security controls
6. Distribute **Devin Desktop clients/extensions** to end users
7. View **analytics dashboards** & **API access tokens**

> Use this list as your “Day 0” deployment tracker.

***

## 3.   Core Devin Desktop Concepts

* **Team** – flat collections of members; no nested teams. Teams (also called *Groups*) drive **role assignment** and **analytics grouping**, letting you scope permissions and view usage metrics per cohort.
* **Roles & Permissions** – predefined RBAC; admins are primarily responsible for **team management**, **Devin Desktop feature settings**, and **analytics**. Built-in roles usually cover these needs, but creating a custom role with *analytics-view* permission lets team managers and leads see metrics for their own teams. (<a href="/desktop/accounts/rbac-role-management" target="_blank">RBAC docs</a>)
* **Admin Portal** – centralized UI for user & team management, credit usage, SSO configuration, feature toggles (<a href="/desktop/cascade/web-search" target="_blank">Web Search</a>, <a href="/desktop/cascade/mcp" target="_blank">MCP</a>, <a href="/desktop/cascade/app-deploys" target="_blank">Deploys</a>), analytics dashboards/report export, service keys for API usage, and role/permission controls.
* **Agents & Workspaces** – Devin Desktop IDE and JetBrains Plugins are Agentic

### 3.1   Admin Portal Overview

The Admin Portal provides centralized management for all Devin Desktop enterprise features through an intuitive web interface. Core capabilities include:

#### User & Team Management

* Add, remove, and manage users across your organization
* Configure teams with proper role assignments
* User status and activity monitoring

#### Authentication & Security

* Configure SSO integration with major identity providers
* Set up SCIM provisioning for automated user lifecycle management
* Manage role-based access controls (RBAC)
* Create and manage **service keys** for API automations with scoped permissions

#### Feature Toggles & Controls

> **Important:** These feature controls affect behavior for your entire organization and can only be modified by administrators. New major features with data privacy implications are released in the "off" state by default to ensure you have control over when and how they're enabled.

Team settings let you enable, disable, or restrict Devin Desktop features for every member: available models and the default model, terminal auto-execution and command permissions, sandboxing, MCP servers and registries, web search, extensions and the extension marketplace, conversation sharing, Devin, and more. Manage them in the Devin app under **Settings → Enterprise → Devin Desktop**, or in the legacy Windsurf dashboard at <a href="https://windsurf.com/team/settings" target="_blank">windsurf.com/team/settings</a>.

See the [Devin Desktop admin controls reference](/desktop/controls) for every team setting, what it does, and which plans include it, along with the MDM device policies and system-level files you can deploy alongside them. Settings that store additional data or telemetry are noted there.

The Admin Portal also manages these integrations:

**PR Reviews (GitHub Integration)**

* Install Devin Desktop in your team's GitHub organization
* Enable PR review automation and description editing
* <a href="/desktop/windsurf-reviews/windsurf-reviews" target="_blank">Learn more about Windsurf PR Reviews</a>
* **We recommend <a href="https://app.devin.ai/review" target="_blank">Devin Review</a> as our new and improved code review experience.** <a href="https://docs.devin.ai/work-with-devin/devin-review" target="_blank">Learn more</a>.

**Knowledge Base Management**

* Curate knowledge from Google Drive sources for your development teams
* Upload and organize internal documentation and resources
* <a href="https://docs.windsurf.com/context-awareness/overview#knowledge-base-beta" target="_blank">Learn more about Knowledge Base</a>

***

## 4.   Identity & Access Management

> **Recommendation:** Use **SSO plus SCIM** wherever possible for automated provisioning, de-provisioning, and group management.

### 4.1   Single Sign-On (SSO)

| | Guidance |
| - | - |
| **IdPs supported** | Okta, Microsoft Entra ID, Google (others via generic SAML) |
| **Recommended approach** | Create Devin Desktop-specific *app* in IdP; use **role-based** group assignments rather than org-wide `All Employees` group |
| **Common pitfalls** | Email suffix mismatches, duplicate user aliases |

*See the <a href="/desktop/accounts/sso-scim" target="_blank">SSO & SCIM Setup Guide</a> for step-by-step configuration for Okta, Microsoft Entra ID, Google, and Generic SAML.*

### 4.2   SCIM Provisioning

* **Why** – automated user lifecycle & team membership management at scale
* **Capabilities**
  * Create / deactivate **users** automatically
  * Create **teams** automatically (or manage manually)
  * Users can belong to **multiple teams**
  * Custom team creation via SCIM API (<a href="/desktop/accounts/sso-scim" target="_blank">docs</a>)
* **Mapping strategies**
  * 1 IdP group → 1 Devin Desktop team (simple, most common)
  * Functional vs. project-based group prefixes (e.g. `proj-foo-devs`)
* **Things to decide**
  * Which groups to *exclude* (e.g. interns, contractors)
  * Renaming rules when IdP group names change
* **Caution**: SCIM should remain your **source of truth**—mixing SCIM and manual / API updates can create drift. Use the API mainly for adding supplemental groups.

***

## 5.   User & Team Management at Scale

* Flat *team* → design team taxonomy carefully (no nesting to fall back on)
* Users can belong to **multiple groups**. Groups are used to view analytics
* Today, SCIM does not support assigning roles to users. SCIM only supports assigning users to Groups

***

## 6.   Analytics & API Access

### 6.1   Built-In Analytics

| Dashboard | Use-case |
| - | - |
| **Adoption Overview** | Track total active users, daily engagement |
| **Team Activity** | Team usage |

Analytics shows the **percentage of code written by Devin Desktop**, helping quantify impact—see your dashboards at <a href="https://windsurf.com/team/analytics" target="_blank">team analytics</a>.

### 6.2   APIs

| API | Typical admin scenarios |
| - | - |
| **REST** | SCIM management, analytics |

* Generate service keys under <a href="https://windsurf.com/team/settings" target="_blank">**Team Settings → Service Keys**</a>. Scope keys to *least privilege* needed.
* More advanced reporting: see the <a href="/desktop/accounts/api-reference/api-introduction" target="_blank">Analytics API Reference</a>.
* For team management: see the <a href="/desktop/accounts/sso-scim" target="_blank">SCIM API – Custom Teams</a>.

***

## 7.   Operational Considerations

* **Status Pages** – monitor live service health: <a href="https://status.windsurf.com/" target="_blank">Devin Desktop</a>, <a href="https://status.anthropic.com/" target="_blank">Anthropic</a>, <a href="https://status.openai.com/" target="_blank">OpenAI</a>
* **Support Channels** – windsurf.com/support

***

## 8.   Setting Up End Users for Success

1. Point end users to the <a href="/desktop/getting-started" target="_blank">Devin Desktop installation guide</a> to install the appropriate extension or desktop client.
2. Publish an internal “Getting Started with Devin Desktop” page (link to official docs)
3. Hold live onboarding sessions / record short demos
4. Curate starter project templates & sample prompts
5. Collect feedback via survey after 2 weeks; iterate

***

## 9.   Additional Resources

* <a href="/desktop/accounts/sso-scim" target="_blank">SSO & SCIM Setup Guide</a>
* <a href="/desktop/accounts/sso-scim" target="_blank">SCIM API – Custom Teams</a>
* <a href="/desktop/accounts/api-reference/api-introduction" target="_blank">Analytics API Reference</a>
* <a href="/desktop/accounts/rbac-role-management" target="_blank">RBAC Controls</a>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.