Skip to main content

​
Devin Desktop Guide for Enterprise Admins

Purpose This guide helps enterprise platform / developer-experience administrators plan, roll out, and operate Devin Desktop for organizations with large enterprise teams. It is intentionally opinionated and links out to detailed “how-to” docs per topic. Treat it both as a read-through guide and as a check-list when onboarding.

​
1. Audience & Pre-Requisites

​
2. Quick-Start Checklist

  1. Confirm organization-wide settings
  2. Set up SSO (Okta, Microsoft Entra ID, Google; see SAML docs for others)
  3. Enable SCIM & map IdP groups → Devin Desktop teams
  4. Define role & permission model (least privilege)
  5. Configure Admin Portal: team view & security controls
  6. Distribute Devin Desktop clients/extensions to end users
  7. View analytics dashboards & API access tokens
Use this list as your “Day 0” deployment tracker.

​
3. Core Devin Desktop Concepts

  • Team – flat collections of members; no nested teams. Teams (also called Groups) drive role assignment and analytics grouping, letting you scope permissions and view usage metrics per cohort.
  • Roles & Permissions – predefined RBAC; admins are primarily responsible for team management, Devin Desktop feature settings, and analytics. Built-in roles usually cover these needs, but creating a custom role with analytics-view permission lets team managers and leads see metrics for their own teams. (RBAC docs)
  • Admin Portal – centralized UI for user & team management, credit usage, SSO configuration, feature toggles (Web Search, MCP, Deploys), analytics dashboards/report export, service keys for API usage, and role/permission controls.
  • Agents & Workspaces – Devin Desktop IDE and JetBrains Plugins are Agentic

​
3.1 Admin Portal Overview

The Admin Portal provides centralized management for all Devin Desktop enterprise features through an intuitive web interface. Core capabilities include:

​
User & Team Management

  • Add, remove, and manage users across your organization
  • Configure teams with proper role assignments
  • User status and activity monitoring

​
Authentication & Security

  • Configure SSO integration with major identity providers
  • Set up SCIM provisioning for automated user lifecycle management
  • Manage role-based access controls (RBAC)
  • Create and manage service keys for API automations with scoped permissions

​
Feature Toggles & Controls

Important: These feature controls affect behavior for your entire organization and can only be modified by administrators. New major features with data privacy implications are released in the “off” state by default to ensure you have control over when and how they’re enabled.
Team settings let you enable, disable, or restrict Devin Desktop features for every member: available models and the default model, terminal auto-execution and command permissions, sandboxing, MCP servers and registries, web search, extensions and the extension marketplace, conversation sharing, Devin, and more. Manage them in the Devin app under Settings → Enterprise → Devin Desktop, or in the legacy Windsurf dashboard at windsurf.com/team/settings. See the Devin Desktop admin controls reference for every team setting, what it does, and which plans include it, along with the MDM device policies and system-level files you can deploy alongside them. Settings that store additional data or telemetry are noted there. The Admin Portal also manages these integrations: PR Reviews (GitHub Integration) Knowledge Base Management
  • Curate knowledge from Google Drive sources for your development teams
  • Upload and organize internal documentation and resources
  • Learn more about Knowledge Base

​
4. Identity & Access Management

Recommendation: Use SSO plus SCIM wherever possible for automated provisioning, de-provisioning, and group management.

​
4.1 Single Sign-On (SSO)

See the SSO & SCIM Setup Guide for step-by-step configuration for Okta, Microsoft Entra ID, Google, and Generic SAML.

​
4.2 SCIM Provisioning

  • Why – automated user lifecycle & team membership management at scale
  • Capabilities
    • Create / deactivate users automatically
    • Create teams automatically (or manage manually)
    • Users can belong to multiple teams
    • Custom team creation via SCIM API (docs)
  • Mapping strategies
    • 1 IdP group → 1 Devin Desktop team (simple, most common)
    • Functional vs. project-based group prefixes (e.g. proj-foo-devs)
  • Things to decide
    • Which groups to exclude (e.g. interns, contractors)
    • Renaming rules when IdP group names change
  • Caution: SCIM should remain your source of truth—mixing SCIM and manual / API updates can create drift. Use the API mainly for adding supplemental groups.

​
5. User & Team Management at Scale

  • Flat team → design team taxonomy carefully (no nesting to fall back on)
  • Users can belong to multiple groups. Groups are used to view analytics
  • Today, SCIM does not support assigning roles to users. SCIM only supports assigning users to Groups

​
6. Analytics & API Access

​
6.1 Built-In Analytics

Analytics shows the percentage of code written by Devin Desktop, helping quantify impact—see your dashboards at team analytics.

​
6.2 APIs

​
7. Operational Considerations

​
8. Setting Up End Users for Success

  1. Point end users to the Devin Desktop installation guide to install the appropriate extension or desktop client.
  2. Publish an internal “Getting Started with Devin Desktop” page (link to official docs)
  3. Hold live onboarding sessions / record short demos
  4. Curate starter project templates & sample prompts
  5. Collect feedback via survey after 2 weeks; iterate

​
9. Additional Resources