Manage members and teams

An organization has no passwords or sign-up form. People arrive through your identity provider and hold one of four roles. This guide covers the whole life of a member, from invitation to removal.

Before you beginCopy Anchor Link

• You need the admin or owner role in the organization. Only an owner can grant or remove the owner role.
• Creating invitations and organizations needs a signed-in person. An API token cannot do either, whatever its role.
• The control plane sends no email. You send each invitation link yourself.

Choose a roleCopy Anchor Link

Each role includes everything the roles listed before it can do.

Invite a personCopy Anchor Link

1. Open Settings > Members and select Invite.
2. Enter the person's Email and choose a Role: Admin, Deployer (the default) or Viewer. The console does not offer Owner; give someone the owner role by changing their role after they join.
3. Select Create invitation. The dialog shows Send this link to the address.
4. Select Copy link, then Done. Send the link to the person yourself.

The link works once and expires after 7 days. The pending invitation shows an invited badge in the member list, with its expiry.

The person opens the link, signs in at your identity provider with the invited address and selects Accept invitation. The address must match the invitation, ignoring case. Otherwise the control plane answers this invitation was sent to ADDRESS; you are signed in as OTHER.

A person who has never signed in does not need the link. If your identity provider reports their email as verified, the first sign-in accepts the newest unexpired invitation for that address automatically. Without an invitation or a SCIM grant, they see "signed in successfully, but has no invitation to an organization on this installation" and are signed out.

To cancel an invitation, select Revoke on its row, then Revoke invitation. The link stops working immediately.

Change a roleCopy Anchor Link

In Settings > Members, open the Role menu on the member's row and choose a role. Only an owner can grant or remove the owner role.

An organization must keep one owner. Demoting the last owner fails with this would leave the organization with 0 owners; make someone else an owner first. Lowering a member's role revokes every API token they created.

Remove a memberCopy Anchor Link

1. Select Remove on the member's row. Owners and your own row have no button.
2. Confirm with Remove member.

The member loses access immediately, and the API tokens they created in this organization are revoked. Their team memberships end. Audit history is kept. Their browser sessions stay open, but the control plane checks membership on every request, so they reach nothing.

Leave, hand over or delete an organizationCopy Anchor Link

Open Settings > General and use the danger zone. Each action asks you to type the organization's slug first.

• Leave… removes you from the organization. The only owner cannot leave: transfer ownership first.
• Transfer… (owners only) hands the owner role to another member and keeps you as an admin. It also revokes the API tokens you created.
• Delete… (owners only) removes the organization, its projects and their release history. It is refused while any cluster is still enrolled.

Group members into teamsCopy Anchor Link

A team names a group of members and owns projects. A team grants no access: roles come from the organization, so every member reaches every project unless an API token limits it.

1. Open Settings > Members and, under Teams, select New team.
2. Enter a Name and select Create team.
3. Select Members, tick the people, and select Save members.
4. Assign the team to a project in Owning team when you create the project, or under Team in the project's settings.

Rename and Delete are on each team row. Deleting a team leaves its projects without an owning team and keeps its members in the organization. A team provisioned by SCIM shows a SCIM badge and Managed by your identity provider; change it at the provider.

Require two-factor sign-inCopy Anchor Link

NebulaCtrl keeps no second factor of its own. It reads the amr claim of the ID token that your identity provider returns. A sign-in counts as two-factor when amr contains mfa, otp, hwk, swk, fpt, pop, sms or face. The 2FA column in Settings > Members shows on, off, or not reported when the provider sent no amr claim.

1. Sign in with a second factor yourself. Turning the requirement on is refused for a session that did not use one.
2. Open Settings > Security & policy. Under Authentication, switch on Require two-factor for everyone.
3. Read the count of members who signed in without one, then select Require two-factor.

From then on, every request from a session without a second factor is refused with this organization requires two-factor sign-in and you signed in without it; sign out, then sign in again using a second factor at your identity provider. The check runs on every request, so it applies to sessions that are already open. API tokens and cluster agents are not affected.

Provision members with SCIMCopy Anchor Link

SCIM lets your identity provider create, update and deactivate members, and sync its groups as teams. The endpoint is BASE_URL/scim/v2, where BASE_URL is the control plane's public URL. It supports Users and Groups, the eq filter and PATCH.

1. Open Settings > Security & policy. Under Authentication, find SCIM provisioning and select Turn on.
2. Copy SCIM endpoint URL and Bearer token. The token is shown once.
3. Paste both into your identity provider's SCIM provisioning settings.

An organization has one SCIM token. Rotate token replaces it, and the old one stops working at once. Turn off disables it; people and teams already provisioned stay as they are.

How the provider's data maps:

• A SCIM user is a grant, not an account. It binds to a person at their first sign-in, matched by email, and only when the identity provider reports the email as verified.
• roles sets the role: viewer, deployer or admin. The default is viewer. owner is rejected.
• A SCIM group becomes a team. Groups carry no role.
• Setting active to false, or deleting the user, removes the membership and revokes the API tokens that member created in the organization. It ends their sessions only when they belong to no other organization. Deprovisioning the only owner is refused.

The SCIM resource routes are not part of the OpenAPI document.

VerifyCopy Anchor Link

• A new member appears in Settings > Members with their role after they accept.
• After you switch on the requirement, a session without a second factor is refused and the 2FA column shows on for members who have one.
• SCIM-provisioned people and teams appear with a SCIM badge after the provider's next sync.
• Each change is an audit event. See the audit log.

Next stepsCopy Anchor Link