Overview
Hive's Enterprise Security add-on includes the following:
1. Full Data Erasure
By default, when you leave Hive, your non-log data (Organization data) stays in an inactive state. Often, IT Administrators must request that this data is permanently erased. If you request full data erasure, we will completely purge the data for your Organization.
2. SSO Enablement
Hive is SAML-enabled. Your enterprise can use SSO through your main identity provider and track and control access from one central location. With Hive's SSO solution, you can turn off password sign-in for your team.
SAML-based single sign-on (SSO) gives users access to Hive through the identity provider (IDP) of their choice.
*NOTE: SSO is not supported for external users.
3. User permissions
You can restrict who can create certain items in your workspace, and choose who can see budgets and rates, delete actions, and change approval rounds.
Where to find the Security settings
Open Workspace settings.
Under Advanced, select Security.
Select User permissions or Authentication.
Note: If your workspace has the Enterprise Security add-on, only Admins can see the Security tab. If your workspace does not have the add-on, all members see the Security tab as a locked preview. Admins can select Get Enterprise Security. Other members can select Ask your admin.
Overview of Administrator Roles
Identity Provider (IdP) or IT Administrators:
Only your organization's Identity Provider (IdP) or IT Admins can adjust SAML/SSO settings in your IdP. This includes correct configuration and resolving related setup issues.
Hive Administrators
Who can edit the SSO/SAML settings depends on whether a System Admin exists in the workspace:
If a System Admin is present: only System Admins can edit SSO/SAML settings. Workspace Admins have view-only access to these settings.
If no System Admin exists: Admins in the workspace can edit SSO/SAML settings.
This keeps SSO/SAML changes with the highest-privileged role when that role exists, and still allows configuration when it does not.
How to set up SSO and SAML
Hive has direct support for some Identity Providers (IDPs). If you use one of them, follow the guide below:
One Login (Add the "Hive" SAML 2.0 app from the One Login app store)
Okta and One Login ask for your Workspace ID. You can copy it from the Authentication page.
If you do not use one of the IDPs above, you can configure SAML manually with the guide below.
Authentication Section
Step 1: Configure identity provider
To start, set up a connection (or connector) for Hive in your IDP. In your IDP, create a new SAML app. The SAML app needs the "ACS URL" for your Hive workspace. To find it:
Open Workspace settings.
Under Advanced, select Security, then select Authentication.
Under Your ACS URL, select Copy URL.
If your IDP can import metadata, use the SP metadata URL at the top of the page instead. Select Copy URL, or select Download XML.
In full, map the following values to the SAML app in your IDP:
ACS URL: see above
Entity ID (Audience): https://hive.com. If you connect more than one Hive workspace to the same IDP (for example, with Azure), select Use unique Service Provider Entity ID on the Authentication page. Then copy the value under Service Provider Issuer (Entity ID).
NameID: the user's email address. The default format is "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress". If you use ADFS, use the "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" format, and enter it in the Identifier format field in Hive.
Name attributes (optional, recommended):
"firstName" attribute: map it from the attribute your IdP uses for the first or given name.
"lastName" attribute: map it from the attribute your IdP uses for the last name or surname.
Hive also accepts standard names, such as "givenName" and "surname". Hive uses the name only when the user does not have a name in Hive yet, and only when your IdP sends both a first name and a last name. Send both.
Step 2: Set up SAML SSO for Hive
After you add all of the values from the previous step and save the new SAML app in your IDP, the IDP gives you these values:
SAML SSO URL
Identity Provider Issuer (optional, because not all IDPs give this)
An X.509 certificate
Copy these values from your SAML app and enter them into Hive:
Open Workspace settings.
Under Advanced, select Security, then select Authentication.
Paste the SAML SSO URL into the SAML SSO URL field.
Paste the Identity Provider Issuer into the Identity Provider Issuer field (if you have one).
Paste the text of the X.509 certificate into the Certificate field.
Hive saves each field when you click out of it. When the SAML SSO URL and Certificate fields are complete, SSO is ready.
What to expect after SSO is enabled
After you set up SSO, each member of your workspace sees a "Sign in with SSO" option when they sign in. They can still sign in with their Hive password. We recommend that you allow this until you know that the setup works.
The first time a person with a Hive account signs in with SSO, Hive sends them an email to verify the link to your IDP. If a person does not have a Hive account yet, Hive creates the account, adds the person to your workspace, and sends them the same verification email.
To turn off password sign-in for your workspace members, go to Force SSO on the Authentication page and select one option:
Do not force SSO: members can use SSO or their Hive password.
Force SSO for all workspace users: the Hive sign-in page no longer offers password sign-in to your workspace members. Google and Microsoft sign-in are not blocked. To block those, use your identity provider or your Google or Microsoft admin controls.
Force SSO for domain users: enter your email domain (for example, company.com). Only users with a matching email domain no longer get password sign-in. If the domain field is empty, this applies to all users. Google and Microsoft sign-in are not blocked.
User Permissions Section
The User Permissions section controls what users can and cannot do in a workspace. To open it, open Workspace settings. Under Advanced, select Security, then select User permissions.
Note: Some settings show only when the related feature is on in your workspace, for example Priority levels or Proofing.
Third-party integrations
Admins can select which file storage integrations members can use in the workspace: OneDrive, Dropbox, Google Drive, Box, and Hive file upload.
Allowed apps
Admins can control which Personal Apps are available: Messaging, Calendar, and Hive Mail.
Admin permissions
Restrict label creation to admins - When this setting is on, only Admins can create new labels in the workspace. When it is off, anyone can create new labels.
Restrict table creation to admins - When this setting is on, only Admins can create new tables in the workspace.
Restrict Time Category permissions to admins only - When this setting is on, only Admins can create a new Time Category in the workspace.
Restrict priority creation to admins - When this setting is on, only Admins can create a new Priority Level in the workspace. When it is off, anyone can create new priority levels.
Restrict admins from promoting members - When this setting is on, only System Admins can make other users Admins. This setting has an effect only when the workspace has a System Admin.
Restrict enabling/disabling apps - When this setting is on, only System Admins can turn workspace apps on or off and change the Allowed apps. This setting has an effect only when the workspace has a System Admin.
If your workspace has System Admins, only System Admins can change the last two settings. If it has no System Admins, Admins can change them.
Manage users
Allow full access users to share the workspace invite link - When this setting is on, full access members can see and share the workspace invite link. When it is off, only Admins can.
Allow full access users to invite external users - When this setting is on, any full access member can invite External Users into the workspace. When it is off, only Admins can invite External Users. Workspace members can request an invite, and Admins can approve pending invites from the Manage users tab.
Read our External Users article to learn more about External Users.Allow full access users to invite or remove users - This setting lets full access members invite new users to the workspace or remove users.
Custom fields
Restrict custom field creation to admins - When this setting is on, only Admins can create new Action Card or Project Custom Fields. When it is off, any full access member can create them.
Read our Custom Fields article to learn more about Custom Fields.
Projects
Restrict new status creation to admins and project owners - When this setting is on, only Admins and project owners can create a new Action Card Status. When it is off, any full access project member can create one.
No public projects - Users cannot make a project Public. When you turn this setting on, Hive asks you to make all existing public projects private. *Read about Project Access for more info on Public Projects.
Allow admins to see all projects without being added to the project - When this setting is on, Admins can see all projects in the workspace, even if they are not added to the project. *Note: Admins can see the project in the Project Navigator, but they cannot open the project.
Allow "Everyone in workspace" / All team members for projects and notebooks - This setting shows only in workspaces with more than 75 members. When it is on, users can share projects and notebooks with everyone in the workspace.
Budget / Other Costs (Read)
Select the roles that can see project budgets and other costs, for example the "Billable hours budget" section on the Project Overview page. By default, System Admins, Admins, and Workspace Members can see them.
Bill Rates
Select the roles that can see Bill Rate values, for example in the "Project bill rates" section on the Project Overview page. By default, only System Admins and Admins can see them.
Cost Rates
Select the roles that can see Cost Rate values, for example in the "Project bill rates" section on the Project Overview page. By default, only System Admins and Admins can see them.
Delete actions
Select the roles that can delete actions. By default, all roles can delete actions, including External Workspace Members.
For these four settings, the roles are System Admins, Admins, Workspace Members, and External Workspace Members. System Admins are always included. When you select a role, Hive also selects all roles above it in the list.
Proofing and Approvals
Disable External Approvers on Proofing Rounds - When this setting is on, Hive hides the Add External Approval button in the action card. Open external approvals are no longer accessible.
Lock approval round structure - When this setting is on, only workspace Admins can add, remove, or reorder rounds and stages on actions and in approval templates.
Workspace notification defaults and locks
With Enterprise Security enabled, workspace admins can manage notification delivery. Open Workspace settings. Under Advanced, select Security → User permissions, then go to External notifications.
For each notification type, select the available Banner, Email, and Mobile checkboxes.
Leave the row unlocked to use these choices as defaults for new members. Members can change unlocked choices in their personal notification settings.
Use the row’s Lock control to enforce its available channel choices. Locked choices apply to existing members too and cannot be changed in personal settings.
Users see Managed by your workspace admin for locked notification settings. Ask a workspace admin to change the policy if one of these options needs adjusting.
Daily and weekly due-action reminder emails remain separate personal preferences; they are not part of this workspace notification matrix.
Restricted members
Under Advanced → Security → User permissions, admins can enable the restricted member type, make it the default for new internal members, and configure permissions by category. Project controls include dates, custom field values, and baselines. See Configure restricted members for setup steps and invite-role behavior.