Open WebUI in the team: users, groups, rights and single sign-on

Open WebUI comes with its own user management system with roles, groups and permissions per model and knowledge collection. Employees log in OIDC or LDAP, and with their existing company account via users and groups can be automatically synchronized via SCIM 2.0. This means that an AI chat remains controllable for the entire team – who is allowed to use which model, who sees what knowledge.

As soon as more than a handful of people use a shared AI chat, questions arise: Who gets access? Who is allowed to use the expensive large model? Who sees the HR guidelines? This post shows how Open WebUI responds to this (as of October 2026, according to Open WebUI documentation).

Roles: Admin, User, Pending

New accounts default to pending status until an admin approves them. This prevents anyone from registering without verification. Admins manage models, settings, and groups; regular users chat with the models that are shared with them.

Groups and permissions

You control who is allowed to do what via groups. Typical division in a medium-sized company:

Individual functions can also be restricted, such as web search or uploading your own files. This is helpful if you AI policy. have defined rules for handling data in an

Single sign-on: Login with the company account

Single sign-on (SSO) means that employees log in with the same account as with other company applications. Open WebUI supports OIDC (e.g. with Microsoft Entra ID, Keycloak or Authentic) and LDAP (e.g. Active Directory). Advantages:

• No additional password for the team
• Anyone who leaves the company also loses AI access with the company account
• Multi-factor login from the existing account system also applies here

How to set up a central account system for several tools is shown in the articles Single Sign-on for SMEs and Keycloak or Authenticity.

Automatic matching via SCIM

SCIM 2.0 is a standard with which an account system automatically transfers users and groups to other applications. If someone is assigned to the "Sales" group in the account system, he automatically appears in the appropriate group in Open WebUI – without manual maintenance.

Traceability

Open WebUI offers usage evaluations and API keys for technical access. Clarify with data protection and the works council which evaluations you use before the chat is activated for everyone.

Setup with us

We set up Open WebUI with groups, model access and login via your existing account system and train the team in safe use, if desired as part of our AI training.

Counselling and accompanied implementation is eligible for funding: Through INQA coaching, the federal government covers 80% of the consulting costs of up to €1,200 per day for up to 12 days, i.e. up to €11,520 subsidy. In Mecklenburg-Western Pomerania and the other new federal states, BAFA consulting funding is also eligible at 80% until 31.12.2026 (50% in the old federal states). Funding is provided for consulting, not software. The funding check shows which program fits.

Frequently Asked Questions

Does Open WebUI support single sign-on?

Yes, via OIDC and LDAP. This allows employees to log in with their existing company account, for example from Microsoft Entra ID, Keycloak or Active Directory.

Can I only share individual models with certain employees?

Yes. Models can be limited to selected users or groups, as well as knowledge collections.

What happens if someone leaves the company?

With SSO, the person also loses access to Open WebUI when the company account is blocked. With SCIM, the account is also automatically reconciled.

Do I need an Enterprise license for Open WebUI?

Not for user management and SSO. According to the license, an enterprise license is needed if you want to remove the Open WebUI branding from more than 50 users.

Would you like to set up an AI chat for your team? Write to us via the contact page.