---
title: "Enterprise"
description: "What the Shorebird Enterprise plan includes and how to get started"
---

The Enterprise plan is for teams that need Shorebird to fit an existing security, procurement, and identity setup. Everything in Pro and Business is included, plus the capabilities below.

Tip

Shorebird is trusted by engineering teams at companies of all sizes. See [Shorebird Success Stories](https://shorebird.dev/success-stories) for examples of how teams are shipping with Shorebird.

## What is included

* **The enterprise console**: your domains, organizations, people, activity, billing and security in one place, on the **Enterprise** page of the [Shorebird console](https://console.shorebird.dev/enterprise). See [Enterprise Roles](/enterprise/roles/) for who can reach it.
* **SAML single sign-on.** Members sign in to the Shorebird Console through your identity provider instead of a personal Google or Microsoft account. See [SAML Single Sign-On](/enterprise/saml/) for the setup process.
* **Required sign-in for your domains.** Make SSO, or your company’s Google or Microsoft accounts, the only way anyone at your email domains signs in. See [Require a sign-in method for your domains](/enterprise/saml/#require-a-sign-in-method-for-your-domains).
* **SCIM provisioning.** Okta or Microsoft Entra ID adds people to your enterprise and deactivates them when they leave. See [SCIM Provisioning](/enterprise/scim/).
* **An audit log** of changes in your organization, in the console and as OCSF events your SIEM can poll with an Auditor service account, for each organization and for the enterprise as a whole. See [Audit Logs](/enterprise/audit-logs/).
* **Enterprise roles** for the people who manage your account, sign-in and people across every organization, separate from the roles that ship apps. See [Enterprise Roles](/enterprise/roles/).
* **An access report**: a CSV of everyone who can reach your apps, and how, for access reviews. See [Access report](/enterprise/roles/#access-report).
* **One-step Deactivate.** Remove someone from every organization and app in your enterprise and revoke their sessions, API keys and invitations. See [Deactivate someone](/enterprise/roles/#deactivate-someone).
* **A company-wide guest policy.** Allow no guests, only guests from the domains you list, or anyone. See [Guest policy](/enterprise/roles/#guest-policy).
* **The full set of organization roles**, including the App Manager role. See [Member roles](/account/orgs#member-roles) for what each role can do.
* **Invoice billing**, tax support, alternative payment methods, and custom contract or procurement processes. See [Billing](/account/billing/) for how Shorebird bills.
* **Volume pricing** for patch installs beyond the 1,000,000 a month included in the Business plan.
* **Support for Flutter versions older than the [supported minimum](/getting-started/flutter-version#supported-flutter-versions)**, negotiated as part of the contract.

## Security reviews

[Security](/system/security/) covers what Shorebird stores and where, how it protects your app’s updates, and where to get compliance documents for a vendor review. [What Shorebird Collects](/system/what-shorebird-collects/) lists exactly what your app and the CLI send to Shorebird.

## Manage your enterprise from the CLI

`shorebird enterprise` (Shorebird 1.6.136 or newer) works on your enterprise and across every organization in it. Anyone in an enterprise can run it, and on its own it shows the enterprise and your role in it. What else you can read or change depends on your [enterprise role](/enterprise/roles/): most commands need an Owner or Admin, and `usage` needs an Owner or Billing manager.

```
# Every app in every organization of your enterprise
shorebird enterprise apps list
```

Run `shorebird enterprise --help` for the other commands, such as `members`, `guests`, `orgs`, `usage`, `service-accounts`, and `audit-log`. For which credentials it accepts in CI, see [Running in CI and scripts](/code-push/ci/scripting/#json-output).

## Getting started

Pro and Business plans are self-service and need no contact with Shorebird. If your team needs any of the above, [reach out regarding an Enterprise Plan](https://shorebird.dev/talk-to-sales) and Shorebird will follow up to set up your account.

Once your organization is on the Enterprise plan, SAML SSO is configured by the Shorebird team. [SAML Single Sign-On](/enterprise/saml/) lists exactly what to send.