Managing Cursor Teams Plans

Running Cursor for a team changes how you think about the product: instead of one person managing one subscription, an administrator manages a pool of seats, a shared usage budget, and a set of policies that apply to every developer. This guide walks through the day-to-day administration of a Cursor Teams plan, including adding and removing seats, assigning roles, upgrading seats to higher tiers, configuring SSO, reading the usage dashboards, and handling the billing problems that come up most often.

Teams Plan Overview

A Teams subscription is priced per seat, billed monthly or annually, and administered from the web dashboard rather than from inside the editor. Each seat includes a usage allowance, and the team's usage-based spending is pooled and controlled centrally so administrators can see where budget goes.

Aspect	How it works on Teams
Pricing model	Per seat per month, with annual billing options
Usage	Each seat includes an allowance; usage-based spend is pooled at the team level
Administration	Web dashboard for seats, roles, billing, and usage
Roles	Admin and member; admins manage seats, billing, and policies
Privacy	Team-wide privacy mode can be enforced by an admin
SSO	SAML-based single sign-on for the team's email domain
Support	Priority support channels for billing and account issues

How the Shared Usage Pool Works

On a Teams plan there are two layers of usage to understand:

1. Per-seat allowance. Every seat includes a base allowance of model usage that renews with the billing cycle. A developer who stays within the allowance does not generate extra charges.
2. Shared usage-based budget. When a member exceeds the per-seat allowance, additional usage is billed against the team's shared budget at usage-based rates. Admins can set spending limits and receive notifications as the pool is consumed.

This design means one heavy agent user cannot silently blow up their own bill, but they can draw down the shared pool. Treat the shared budget as a team resource you monitor like any other cloud spend.

Watch the pool, not individual seats

Individual seat allowances renew each cycle, but usage-based spending draws from the shared pool. Check the team-level usage view before running expensive long-horizon agent workloads near the end of a billing period.

Adding and Removing Seats

All seat operations happen in the admin dashboard, under the team or members section. You must be signed in with an account that has the admin role.

Adding a Seat

1. Sign in at cursor.com and open the team dashboard with your admin account.
2. Go to the members or seats section and choose the invite option.
3. Enter the developer's work email address and send the invitation.
4. The seat is reserved as soon as the invite is sent (or accepted, depending on your plan's configuration), and any mid-cycle charge is prorated.
5. The developer accepts the invite and signs in with that email address to pick up the seat.

Removing a Seat

1. Open the members list in the dashboard.
2. Find the member who is leaving and remove their membership.
3. If you also want to stop paying for the seat, remove the seat itself in the billing section. Deleting a membership without releasing the seat is the most common cause of paying for people who have left.
4. Access ends either immediately or at the end of the current cycle, depending on the option you choose.

Action	Billed as	Access ends
Add seat mid-cycle	Prorated for the remainder	Immediately on acceptance
Remove membership only	Seat keeps billing	Depends on seat release
Remove seat	Stops at next renewal or prorated, per plan terms	Per the option selected

Roles: Admins and Members

Teams plans have two built-in roles. The person who created the team is an admin by default.

Capability	Admin	Member
Invite and remove members	Yes	No
Add or release seats	Yes	No
View and change billing	Yes	No
Configure SSO	Yes	No
Enforce team privacy mode	Yes	No
View team usage dashboards	Yes	Usually limited to their own usage
Use all IDE features	Yes	Yes

Choosing Who Becomes an Admin

Keep the admin role small: typically the engineering manager who owns the budget and one backup. Admins can change billing, so every extra admin is another person who can accidentally add seats or change the payment method. Promote a member from the members list in the dashboard; the change takes effect on their next sign-in.

Upgrading a Seat to a Higher Tier

Beyond the standard seat, Cursor offers higher tiers (for example Ultra, and in some billing contexts a top tier referred to as Super) that raise the included usage and unlock the most capable models and long-running agent features. On a Teams plan, these upgrades are handled per seat and are managed by an admin, not by the individual member.

How to Upgrade a Seat

1. Open the team dashboard and locate the member whose seat you want to upgrade.
2. Open the seat or subscription options for that member.
3. Choose the higher tier and confirm. The charge is either prorated immediately or applied at the next renewal, depending on the billing option shown during checkout.
4. Ask the member to sign out and back in to the IDE so the new limits appear on their account panel.

Common Billing Issues After an Upgrade

• Proration confusion. A mid-cycle upgrade produces a one-off prorated line on the next invoice in addition to the regular renewal. This is expected, not a duplicate charge.
• Upgrade applied to the wrong seat. Seat lists grow over time and often contain stale entries. Confirm the email address on the seat before confirming the upgrade.
• Limits not visible immediately. Tier changes can take effect at the next cycle. The member's IDE account panel shows which limits are currently active.
• Payment failure. If the team card is declined, the upgrade can silently fail. Check the billing history for a failed transaction before retrying.

Upgrades can wait for the next cycle

Depending on how your team's billing is configured, a seat upgrade may take effect immediately with a prorated charge, or at the start of the next billing period. If the new tier's limits are not visible right away, check the billing cycle date before assuming the upgrade failed.

SSO Setup Basics

SAML single sign-on ties every seat to your identity provider, so joining and leaving the company automatically controls who can use Cursor. Setup happens from the admin dashboard's security settings.

1. In the dashboard, open the security or authentication settings.
2. Choose SAML SSO and copy the service provider details Cursor gives you (entity ID and ACS URL).
3. In your identity provider (Okta, Entra ID, Google Workspace, and similar), create a new SAML application with those values.
4. Paste your identity provider's metadata URL or XML back into the Cursor dashboard.
5. Assign the application to a test group first, verify sign-in, then roll it out to the whole team.

<!-- Example SAML attribute mapping most identity providers accept -->
<Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
  <AttributeValue>[email protected]</AttributeValue>
</Attribute>

The email attribute must match the email on the member's seat. If SSO users cannot sign in, the mismatch between the identity provider email and the seat email is the first thing to check.

Pilot SSO with two accounts

Enable SSO for one admin and one member before enforcing it team-wide. If the attribute mapping is wrong you can lock everyone out, so validate with accounts you can still reach by password.

Usage Dashboards and Privacy Mode

Reading the Usage Dashboard

The team dashboard's usage section shows, for the current cycle:

• Total team usage against the shared pool, with spending limits you configured.
• Per-member breakdown showing request and token consumption, so you can identify heavy users before the pool is exhausted.
• Model distribution, which tells you whether expensive long-context models are dominating your spend.
• Trend lines across cycles, useful for forecasting whether the current plan tier still fits the team.

Enforcing Privacy Mode for the Team

Privacy mode prevents your code from being stored on Cursor servers beyond what is needed to serve the request. On Teams plans an admin can enforce privacy mode for everyone, which removes the ability of individual members to turn it off.

1. Open the privacy settings in the admin dashboard.
2. Enable enforcement for the whole team.
3. Confirm in the IDE: members should see privacy mode shown as enforced and greyed out in their settings.

For teams handling customer data or regulated code, enforce privacy mode at the team level rather than trusting individual settings. Note that agent features that run in the cloud have their own data-handling terms, so review those separately if that matters for your compliance posture.

Managing Payment Methods and Invoices

Updating Payment Details

Open the billing section of the dashboard to change the card on file, update the billing email, or edit the company name and tax details that appear on invoices. Changes apply to the next invoice; already-issued invoices keep the details they were generated with.

Reconciling Invoices

Invoices list per-seat charges and any usage-based overage as separate lines. When the numbers do not match your mental model of the team, export the invoice and your current members list and compare them:

# reconcile.py - compare an exported invoice CSV against the active members CSV
import csv

def load_rows(path):
    with open(path, newline="", encoding="utf-8") as f:
        return list(csv.DictReader(f))

invoice = load_rows("invoice.csv")       # columns: email, line_type, amount
members = load_rows("members.csv")       # columns: email, role, status

billed = {r["email"] for r in invoice if r["line_type"] == "seat"}
active = {m["email"] for m in members if m["status"] == "active"}

print("Billed but not active:", sorted(billed - active))
print("Active but not billed:", sorted(active - billed))
total = sum(float(r["amount"]) for r in invoice if r["line_type"] != "tax")
print(f"Invoice total excluding tax: {total:.2f}")

Anything in the "billed but not active" list is a stale seat: release it so it stops renewing.

Troubleshooting Common Issues

Seat Upgrade Not Applying

Work through this checklist before contacting support:

1. Confirm the upgrade was purchased from the admin account, not a member account.
2. Check the billing history for a completed (not failed) transaction.
3. Check whether the plan terms show the upgrade as effective at the next cycle.
4. Have the member fully sign out of the IDE and sign back in; cached credentials can show stale limits.
5. Verify the upgrade landed on the seat with the correct email address.

If all of the above are fine and the tier still shows as standard, email [email protected] with the team name, the seat email, and the invoice ID for the upgrade.

Team Seat Cannot Be Upgraded to Super

Some Teams configurations do not expose the top tier as a self-serve per-seat upgrade, or the option appears but fails at checkout. In practice:

• Make sure the billing owner (the admin who set up payments) performs the upgrade, since per-seat tier changes are tied to the payment method.
• Try the upgrade from the billing section rather than the members list, or the reverse; the option lives in different places depending on plan version.
• If checkout fails repeatedly, contact support or sales and ask for the seat tier change to be applied manually. Include the seat email and desired tier.
• As a workaround, some teams run that one heavy user on a higher-tier individual subscription and keep the rest of the team on the Teams plan. It is not elegant, but it unblocks the developer while billing is sorted out.

Duplicate Charges

Common causes and fixes:

Cause	How to confirm	Fix
Payment retry after a timeout	Two transactions, one marked pending or failed	The pending one usually resolves automatically; if both settle, contact support
Individual and team subscriptions on one email	Billing history shows two products	Cancel the individual plan or ask support to consolidate
Seat added twice in one cycle	Two prorated seat lines for the same email	Release the extra seat; support can refund the overlap
Card vaulted twice by a browser autofill mistake	Two payment methods, both charged	Remove one method and request a refund for the wrong one

Always open a support ticket with the invoice IDs and transaction timestamps. Refunds for genuine duplicates are routine, but they need the specific charges identified.

Removed Member Still Consuming a Seat

This almost always means the membership was removed but the seat itself was not released, or an SSO group assignment immediately re-provisioned the user. To fix it:

1. In the dashboard, check whether the person appears as an inactive or pending member. Pending invites reserve seats.
2. Cancel any pending invite, then release the seat in the billing section.
3. If SSO re-creates the membership automatically, remove the user from the Cursor application group in your identity provider.
4. Re-run your seat reconciliation against the invoice to confirm the seat no longer renews.

# Quick audit: list seats from the exported members CSV where last_active is over 30 days old
import csv
from datetime import datetime, timedelta

with open("members.csv", newline="", encoding="utf-8") as f:
    for row in csv.DictReader(f):
        last = datetime.strptime(row["last_active"], "%Y-%m-%d")
        if datetime.now() - last > timedelta(days=30):
            print("candidate for seat release:", row["email"])

Usage Not Resetting Weekly

The most common misunderstanding on Teams plans is the reset schedule. In general:

• Seat allowances renew on the billing cycle, which is monthly unless you chose otherwise at signup. There is no weekly reset of the main allowance.
• Shared usage-based budgets are tracked per billing period, and the pool drawdown you see in the dashboard reflects the current period only.
• Individual features can have their own windows. Some agent and preview features have shorter rolling limits that are independent of the billing cycle, which is why two numbers in the dashboard may reset at different times.

If your pool appears not to reset after the renewal date has clearly passed, check the billing anchor: the reset follows the original subscription date, not the calendar month, and a mid-cycle seat change can shift what you expect. When the dashboard stays stale for more than a day after renewal, contact support with your team name and last invoice ID.

Keep exactly one billing owner

Name one admin as the single point of contact for billing, keep the payment method on a company card, and reconcile the invoice against the members list every cycle. Nearly every Teams billing problem in this guide becomes a five-minute fix when someone is actually watching the invoice.

Quick Reference

Task	Where	Notes
Add a seat	Dashboard, members section	Prorated mid-cycle
Release a seat	Dashboard, billing section	Membership removal alone does not stop billing
Upgrade a seat tier	Dashboard, seat or billing options	Admin only; may apply next cycle
Enforce privacy mode	Dashboard, privacy settings	Team-wide, members cannot disable
Configure SSO	Dashboard, security settings	Pilot with two accounts first
Read usage	Dashboard, usage section	Pool view plus per-member breakdown
Billing disputes	[email protected]	Include invoice IDs and timestamps

Understanding Seat Allocation and Billing Certificates

A seat is a licence assigned to a named person, so your bill follows how many seats are assigned, not how many installs there are. Seats fall into four states: assigned to a member, reserved by a pending invite, released and no longer billed, and billable when assigned plus reserved is counted at invoice time. A pending invite reserves the seat before the developer accepts, which is why abandoned invites quietly inflate the next invoice.

Mid-Cycle Seat Changes and Proration

Adding or releasing a seat partway through a cycle prorates it to the remaining days of that cycle. A prorated add bills the remaining fraction, while a prorated release credits the unused days (usually as a negative line rather than cash), and the next renewal returns to the full quantity you now hold.

Invoicing Basics

Invoices generate at the start of each cycle for the seats you hold at that moment, with previous-cycle overage added as its own line. Mid-cycle changes to company name, tax ID, or billing email apply to the next invoice only.

Billing certificates versus invoices

A billing certificate (sometimes called a receipt) confirms a payment was captured, while an invoice itemises what was charged. Finance often needs both, so download them from the billing section rather than forwarding the confirmation email.

Setting Up SSO and Domain Verification

SSO ties every seat to your identity provider so joining or leaving the company controls access automatically. Work through four stages in order.

Step 1 — Verify Your Domain

Add the DNS TXT record Cursor gives you and wait for it to propagate before clicking verify. A typical record looks like a _cursor-verification.example.com TXT entry whose value is cursor-domain-verification=8f3c1a90b7e44d2fa1c6, published in your DNS host.

Step 2 — Configure the Identity Provider

Cursor speaks SAML 2.0 and OIDC. Copy the service provider values Cursor gives you, create the application in your provider, and paste your provider's metadata back (for OIDC the same values map to a client ID, secret, redirect URI, and an email claim, which must match the seat email):

{
  "protocol": "SAML",
  "sp_entity_id": "https://cursor.com/saml/metadata",
  "acs_url": "https://cursor.com/saml/acs",
  "attribute_mapping": { "email": "user.email", "groups": "user.groups" },
  "signature": "required"
}

Step 3 — Map Attributes and Provision Members

Assign the application to a pilot group of one admin and one member, then confirm the email attribute matches the seat email exactly before widening. Providers that support SCIM provisioning create and remove members automatically, so Cursor becomes the source of truth for seats.

Step 4 — Enforce SSO for Everyone

1. Confirm at least two admins can sign in through SSO, not only by password, and that a recovery path exists if the application misbehaves.
2. Turn on enforcement, then have a member test a fresh sign-in.

Enforcement can lock out your admins

Once SSO is enforced, a broken attribute mapping or a failing application in your identity provider locks out the whole team, including you. Keep at least one admin who can still reach the billing dashboard, verify the mapping with two pilot accounts first, and check your identity provider's admin account separately before enforcing.

Role and Permission Reference

Cursor Teams ships with an admin role, a member role, and on some plans a billing-only role for finance staff. Use the narrowest role that still does the job, and keep the admin role to the budget owner plus one backup, because every extra admin can change billing. Billing-only access cannot add seats or change member access, which is the least privilege finance actually needs.

Capability	Admin	Billing-only	Member
Invite and remove members	Yes	No	No
Add or release seats	Yes	No	No
Change seat tier	Yes	No	No
Update payment method	Yes	Yes	No
Configure SSO and domain verification	Yes	No	No
Enforce team privacy mode	Yes	No	No
View team usage dashboards	Yes	Read-only	Own usage
Use editor and agent features	Yes	No seat	Yes

Role changes apply on the affected person's next sign-in, so ask them to sign out and back in rather than assuming the change failed.

Usage Analytics and Reporting

Dashboard Metrics

Metric	What it tells you	Typical action
Team tokens and requests	Total consumption against the shared pool	Compare against the budget
Per-member breakdown	Who draws the pool fastest	Coach or upgrade heavy users
Spend against limit	Headroom before the soft or hard cap	Adjust the cap

Exporting Usage and Aggregating Per Member

The export is a per-row file that is awkward to read at team scale, so aggregate it locally with an awk pipeline (or the equivalent jq -r '.members[] | [.email, .tokens] | @csv' usage.json when it is JSON):

# Export the cycle, then rank members by token consumption
curl -s -H "Authorization: Bearer $CURSOR_ADMIN_TOKEN" \
  "https://api.cursor.com/teams/usage/export?cycle=2026-09" -o usage.csv

awk -F, 'NR>1 {tok[$1]+=$4} END {for (u in tok) printf "%s,%d\n", u, tok[u]}' usage.csv \
  | sort -t, -k2 -nr | head -20

Setting Soft Alerts

Soft alerts warn you before the shared pool is exhausted without blocking anyone. Set one at roughly 70 percent and another at roughly 90 percent (a config such as alerts: {soft: [70, 90], hard_cap: 100}), deliver them to a channel the team reads, and keep the hard cap above both so an alert always precedes a lockout.

Enforcing Privacy Mode for a Team

Privacy mode stops your code from being stored on Cursor servers beyond what is needed to serve the request. An admin can enforce it org-wide, which removes each member's ability to disable it.

1. Open the privacy settings in the admin dashboard.
2. Enable enforcement for all members on the team, then save and confirm the dashboard reports it as enforced.

Enforcement greys out the member's editor toggle, stops requests being retained for training under the team policy, and leaves cloud agent features on their own data-handling terms. Verify it in three places rather than trusting one: the dashboard, the enforced state on a member's settings, and your admin policy view.

Privacy mode is a team policy, not a legal guarantee

Enforcing privacy mode sets how your team's requests are handled; it does not replace your own data-retention review. Document where the setting is enforced and who owns it so an auditor can trace the control.

Automating Seat Audits

Turn manual reconciliation into a scheduled audit that flags inactive seats and prints what it would remove, so a human approves every change.

# seat-audit.sh -- flag seats with no activity for more than N days
#!/usr/bin/env bash
set -euo pipefail
CSV="${1:-members.csv}"; STALE="${2:-30}"; NOW=$(date +%s)
awk -F, -v s="$STALE" -v n="$NOW" 'NR>1 {
  split($4, d, "-")
  age = int((n - mktime(d[1]" "d[2]" "d[3]" 00 00 00")) / 86400)
  if (age > s && $3 == "active") printf "%s,%s,%d days,REVIEW\n", $1, $2, age
}' "$CSV"

Feed that output into a dry-run removal workflow that only acts with an explicit flag:

# remove-seats.sh -- dry run unless --apply is passed
MODE="dry-run"; [[ "${2:-}" == "--apply" ]] && MODE="apply"
while IFS=, read -r email role age action; do
  [[ "$MODE" == "dry-run" ]] \
    && echo "would release: $email (inactive $age)" \
    || curl -s -X DELETE -H "Authorization: Bearer $CURSOR_ADMIN_TOKEN" \
       "https://api.cursor.com/teams/seats?email=$email"
done < <(./seat-audit.sh "$1")

Run the dry run weekly, review the output, then apply the removals. Skip any seat reserved by a pending invite so an active hire is never cut off.

Schedule the audit, not the removal

Automate the audit and leave removal behind a manual flag. A job that both audits and deletes will eventually remove a seat during a holiday before anyone notices the lost access.

Renewal, Cancellation and Downgrades

At renewal the plan reseats at the quantity you hold, renews the shared allowance, and bills previous-cycle overage, so reconcile members against the invoice a week before the date. Downgrading mirrors upgrading: release seats for people who left, drop unneeded tiers, reduce the seat quantity in billing, and confirm the new number on the next invoice, usually effective at the next cycle.

Change	Members keep	Members lose
Replace a member	Remaining members unaffected	The removed member's seat and access
Downgrade a seat tier	Core editor features	Higher included usage and top-tier models
Reduce seat quantity	Seats up to the new count	Seats beyond the new count are released
Cancel the plan	Access to the end of the paid cycle	Team dashboard, SSO, and shared pool

Cancelling is not reversible the same way

Cancelling a team plan does not refund the current cycle; access runs to the end of the period you already paid for and then stops. Re-creating the team later means setting up seats, SSO, and privacy again, so export your members list and invoices before you cancel.

Frequently Asked Questions

Are seats billed per person or per installation?

Per person. One seat covers one named member across any number of machines. Sharing one login saves a seat but cannot be audited per person, so avoid it.

What happens if I add one seat and remove another in the same cycle?

Both prorate to the remaining days and often cancel out to a small net change. Look for a matching add line and release line before assuming you were double-charged.

Can a member upgrade their own seat?

No. Seat tier changes are made by an admin from the team dashboard against the team payment method.

Why is the pool not resetting on the first of the month?

The pool follows your billing anchor, the date you originally subscribed, not the calendar month. Check the cycle start date on the latest invoice before treating a stale dashboard as a bug.

What should I do if SSO locks everyone out?

Keep a recovery path before enforcing. If it goes wrong, fix the mapping or application in your identity provider and re-enable sign-in rather than disabling SSO entirely.

Can finance pay the bill without a seat?

Yes, on plans that offer a billing-only role. It grants payment and invoice access without seat or member administration, the least privilege finance actually needs.