Team rollout: shared Bots, templates, and admin controls

One-sentence goal: complete the Grok Bot team rollout, turning the Bot from a personal tool into one the whole team can use—confirm plan availability, bring members in, and then use admin controls to keep the permission boundaries in check.

Prepare

• Your team is on a Teams or Enterprise plan. Paid Cursor plans, SuperGrok links, and self-serve Grok Business seats are individual channels and do not provide the team management covered on this page. If you're not sure whether your plan includes it, see Subscriptions and pricing: which plans include Grok Bot and how usage is counted.
• You have admin permissions. Teams admins can invite members; only Enterprise admins can toggle Grok Bot on or off in the dashboard.
• First read Multi-Bot collaboration: group chats, handoffs, and shared Bots to understand how members share Bots with each other.

Follow along

Step 1: Pre-launch checks—don't let old settings get in the way

Go through the five checks in the Cursor dashboard: Privacy Mode (Legacy), shared egress IPs, gateway allowlisting, login methods, and inheritance policies. The most critical is the first one—Privacy Mode (Legacy) completely blocks Grok Bot (Grok Bot requires cloud data storage, which is incompatible with that legacy mode), and the system will prompt you to migrate; legacy request-based plans likewise cannot enable it.

Expected result: your team is not on Privacy Mode (Legacy) or a legacy request-based plan, and Grok Bot lights up normally.

Step 2: Enable access and invite members

The Teams plan requires no action: Grok Bot is enabled by default and available to everyone, usage counts against each seat's quota, and there is no off switch. On the Enterprise plan, an admin enables it on the Cursor dashboard's Grok Bot page, then uses Manage Group Access to decide whether to grant it to everyone or only specific groups. Admins on both plans can click Invite Team on the Grok Bot page: existing Cursor users receive an email with a download link; new users receive a Cursor team invitation (email or invite link); teams that manage members with SCIM only see the existing-user option.

Expected result: after signing in, members can see Grok Bot and create their first Bot.

Step 3: Tighten permissions with admin controls

Go through the five categories of controls in the dashboard one by one: Access (who can use it), Agent capabilities (what Bots can do), Rules (rule constraints), Computers (cloud computers), and Logging (logs). Note that several of these are Enterprise-only and not visible in the self-serve Teams interface. In terms of the security model, each member's Bot runs in an isolated Firecracker microVM, cannot access company resources by default, and sensitive operations must pass through an approval gate. Template sharing is managed by the Public template sharing toggle on the Grok Bot page: when turned off, members can only share templates within their own team; it is off by default for Enterprise teams and allowed by default for other teams. For how members save a configured Bot as a template to share, see Bot templates: sharing a configured Bot with your team.

Expected result: there are clear answers to who can use it, what Bots can touch, and where to check logs when something goes wrong.

Verify

• Have a regular member sign in: they can create a Bot and run a simple task to completion.
• Confirm in the dashboard that usage is recorded against seat quotas, with no anomalies concentrated on a single account.
• For Enterprise teams, use Manage Group Access to move a test group out of the access scope and confirm that group's members are blocked—their cloud computers will not be deleted.

Common pitfalls

• Assuming Teams has a toggle: there isn't one. Teams is enabled for everyone by default and can't be turned off; to restrict it, you can only rely on member management or move to Enterprise.
• Worrying that turning it off deletes data: turning off Grok Bot on Enterprise only blocks access; members' cloud computers will not be deleted.
• Stuck on Privacy Mode (Legacy): without migrating, your team can never enable it.
• New users not receiving invitations: check whether you use SCIM—SCIM teams only have the existing-user invitation option, and new members must have accounts created in your member system first.

Next lesson

With permissions in place, the next step is IT rollout: MDM bulk installation of the desktop app, network allowlisting, and identity integration—see Enterprise IT deployment: MDM, network allowlisting, and identity integration.