Enable Organizations and Manage Members

Switch the container on

Organizations are a container inside an Environment: each of your customers gets one, with its own members, invitations, and optionally its own hierarchy beneath it. The container is switched on from Access Control → Overview; the Organizations page itself explains the state until then.

Application: Developer Console
Path: Access ControlOverview
Opens with: applications.view Read the Account's Applications and Environments, and open an Environment's Overview.
Context: Select an Application and an Environment in the switcher first; the page belongs to that Environment.

Switch the container on

Open Access Control → Overview for the Environment in the switcher. Beneath the access-model cards, the Organizations card reads Available; click Enable Organizations. A toast reads Organizations enabled. The tier under the root now belongs to organizations. and the card reads Active with Manage Organizations.

On an Environment already running a hierarchy, the confirmation Enabling replaces your hierarchy explains that the tier under the root becomes the organizations; confirm with Revert and enable.

Disable Organizations on the same card removes every organization and membership; its confirmation, Disabling removes your organizations, asks for Remove and disable.

Create an organization and manage its members

Access Control → Organizations lists the Environment's organizations. Opening one shows its Hierarchy, Roles, Members, Invitations, Policy, and Directory sync tabs. The organization's role pickers offer the Environment's roles and the organization's own (see roles of its own below). A member may hold several roles in the organization, at its node or beneath, or none, and the tabs stay current as roles change elsewhere: a group mapped in the organization's portal, or a person its identity provider pushes, shows here without a reload.

Application: Developer Console
Path: Access ControlOrganizations
Opens with: env_organizations.view Read the Environment's organizations, their members, and their invitations.
Context: Select an Application and an Environment in the switcher first; the page belongs to that Environment.

Create an organization and manage its members

Open Organizations from the left nav under Access Control and click Create Organization. Enter the Organization name and click Create Organization; a … created toast appears and it is listed with 0 members. Open it.

Rename in the header changes the name; the slug badge stays the same. Confirm with Rename.

On Members, click Add Member. In Identity, type a name or email to search, or click Browse at the end of the field to page through every identity; someone already in the organization reads Already a member and cannot be chosen. Pick the Role in the organization and click Add Member. The Console always gives a new member a role at the organization; to add someone who should hold nothing yet, call POST /api/v1/organizations/{org_id}/members without role_id (see Organizations). A … added toast appears and the header's member count updates. The row's Roles column lists every role the member holds, the organization's own first and those beneath it as place and role, or No roles; Status reads Active or Deactivated, and the status filter shows active members, those who left, or all.

On a member's row, the pencil opens Change Role when the member holds one role at the organization itself; pick the new role and click Change Role. The bin opens Remove Member; confirm with Remove Member. Their membership ends and every role they hold in this organization goes with it; the identity itself is untouched.

On Invitations, click Invite Member, enter the email and name, pick a role or No role, choose where it applies when the organization has places beneath it, optionally set the role's start and end dates, and click Send Invite. The row reads Pending, and its Type reads Join organization for someone who already has an account here, who confirms it is them when they accept. Resend invitation issues a fresh link, no more than once every 5 minutes; Revoke Invitation stops the link working and the row reads Revoked.

The header's Delete opens Delete Organization, which names the memberships and pending invitations that go, and asks you to type the organization's slug. Confirm with Delete Organization; member identities survive and keep what they hold elsewhere.

Give an organization roles of its own

Most organizations use the Environment's roles. When one needs a role the others should not see, such as its own Compliance Lead, create it on the organization's Roles tab. That role is held only at the organization or beneath it, and its name only has to be unique inside it, so it can share a name with an Environment role. Its permissions are set on Access Control → Roles, under the Organizations tab, the same way as any role's.

Application: Developer Console
Path: Access ControlOrganizations
Opens with: env_organizations.view Read the Environment's organizations, their members, and their invitations.
Context: Select an Application and an Environment in the switcher first; the page belongs to that Environment.

Give an organization roles of its own

Open the organization and click Roles. The table lists its own roles with Role, Members, Permissions, and Status; sort by any column and search by name. With none yet, it reads No roles of its own.

Click Create Role. The Create Custom Role dialog opens for this organization. Enter a Role Name and an optional Description, and under Start From pick No permissions or a role to copy: an Environment role or one of this organization's own. The copy is a new role; changing one never changes the other.

Click Create Role. A Role created toast appears and the new role opens on Access Control → Roles, where you tick its permissions and click Save Changes. Clicking a row on the Roles tab opens that role there too.

To rename a role or change its description, open the row's menu and click Edit. The Edit Role dialog holds Role Name and Description; click Save Changes and a Role updated toast appears. If someone changed the role meanwhile, it shows the latest and asks you to edit again.

To delete one, open the row's menu and click Delete. The Delete Role dialog warns that the role is removed from every identity assigned it; confirm with Delete and a Role deleted toast appears. Deleting the organization deletes its own roles with it.

If you don't see this

Each control on this page exists only for someone who may use it. When something described above is missing, one of these is why:

Organizations is not in the left nav. Either no Application and Environment is selected yet, or your administrator role does not carry env_organizations.view.

The page reads Organizations are not enabled, with Go to Access Control. The container is off in this Environment; enable it from Overview.

There is no Enable Organizations, Create Organization, Add Member, or Invite Member. You hold env_organizations.view but not env_organizations.manage.

The page says Organizations is a Pro feature. The Account is on the Free plan; upgrade from the Admin Workspace's Billing page.

There is no Roles tab, or no Create Role and no row menu on it. The tab needs env_roles.view; creating, editing and deleting a role need env_roles.manage.

A member's row has no pencil. Change Role replaces the one role held at the organization itself; a member holding none there, or several, changes roles from the identity's drawer.

How organizations, tokens, and the org switcher work →

Connect an organization's directory sync →

Enable and build a hierarchy →

Environment

API version

v1.0

On this page

Was this page helpful?

Tell us how we can improve this guide.