# Org management glossary

Glossary of terms used in org management endpoints.

### Internal user

A user whose email domain is one of the email domains belonging to the enterprise account.

### External user

A user whose email domain is NOT one of the email domains belonging to the enterprise account but is a collaborator on one of the enterprise account's workspaces or bases.

### Provisioned user

User can login to Airtable.

### Deactivated user

User is blocked from logging in to Airtable.

### Managed user

The user is considered to be administered by the enterprise account.

### Unmanaged user

A user whose email domain is one of the email domains belonging to the Organization, but is not owned by the organization. The most common example of unmanaged users is customers with multiple Organizations (multiple enterprise accounts).

### SSO-only external user

A user who is administered by the enterprise account via an SSO identity provider link but whose primary email is NOT on one of the enterprise's verified email domains. The user has an SSO identity row tying them to the enterprise's IdP, so the enterprise can administer their account (deactivate / reactivate, change name, change email, sign out of sessions, delete personal access tokens) and operate on them via SCIM. They are NOT considered claimed or members of the enterprise — they cannot be assigned to groups or org units, and they are not granted enterprise admin privileges. If the user's email domain is later verified and claimed by another enterprise, that enterprise takes precedence and the SSO link from the original enterprise is auto-removed. SSO-only external users are typically provisioned via SCIM with the `urn:airtable:params:scim:schemas:extension:sso:2.0:User` extension, or created on first SSO login when an IdP with `emailAttribute` configured returns a real email on an off-domain user.

### Outstanding invite

An invite that is either (1) single use and has not been accepted or is (2) multi use.