Single sign-on
One SAML or OpenID Connect connection per workspace, with verified domains and an owner password break-glass if enforcement locks people out.
Security and admin
These controls live in Workspace Settings. They are not a daily sidebar item, and they are not locked to a pricing tier.
SCIM
Users and groups provision members and teams. Deactivating someone in the directory deactivates them in the workspace.
Audit
Who did what, to which object, and when. Plan changes are included.
Backup
Export the workspace and restore it. Backup is not reserved for a higher plan.
Retention and guests
Trash, read notifications, activity, and chat can expire. Guests can be limited by domain and by how long the access lasts, and they only see the projects you grant.