Organization administrator roles and permissions

SecureAuth Connect uses roles to delegate administration of B2B organizations. You, as the tenant or workspace administrator, keep control of the workspace. Each partner or customer organization gets its own administrators, who manage only their own organization and its users.

This page lists every role you can assign, what each role can and cannot do, and how to grant, add, and revoke organization administrators in the admin console and through the API.

Where roles apply

A role is always granted on a resource. There are three resource levels:

Level	Roles	Typical holder
Tenant	Super Admin (admin), Business Admin (business_admin), Auditor (auditor), Member (member)	Your own staff.
Organization (or workspace)	Organization Admin (manager), Admin (admin), User Manager (user_manager), Auditor (auditor), Member (member)	Administrators of one partner organization.
User population (identity pool)	User Population Manager (user_manager on the population)	A person who manages users in one population only.

A role on a parent organization also applies to its suborganizations for user and group management. For example, an Organization Admin (manager) of a parent organization can manage users in every suborganization below it.

Role names and API values

Each role has the same name in the admin console and the delegated admin portal. The docs write every role as its name followed by its API value, for example Organization Admin (manager).

Role name	API value	What it can do
Super Admin	admin (tenant)	Full access to every workspace, organization, and tenant setting.
Business Admin	business_admin (tenant)	Onboard and manage all organizations through the delegated admin portal.
Auditor	auditor (tenant)	Read-only access to every workspace and organization.
Member	member (tenant)	No tenant-wide administration permissions. Lets you assign the person a role on specific workspaces or organizations.
Admin	admin	Full access to the organization configuration, including sign-in, identity providers, applications, and policies.
Organization Admin	manager	Manages the organization users, groups, and details, and grants roles to other users. On a workspace that is not an organization, this role is named Workspace Admin.
User Manager	user_manager	Manages users and groups in the organization.
Auditor	auditor	Read-only access to the organization configuration and users.
Member	member	Not an administrator role. Marks the user as a member of the organization for application access.
User Population Manager	user_manager (user population)	Manages users in one user population. Appears only when the organization has more than one user population.

Permissions by organization role

The following table shows what the three administrator roles can do in one organization.

Action	Admin (admin)	Organization Admin (manager)	User Manager (user_manager)
View users and groups	Yes	Yes	Yes
Create, update, and delete users and groups	Yes	Yes	Yes
Send activation emails, reset passwords, and manage user identifiers and addresses	Yes	Yes	Yes
Edit custom attribute values	Yes	Yes	No
Edit organization name and email domains	Yes	No	No
Manage identity providers, applications (clients), policies, claims, scripts, webhooks, and secrets	Yes	No	No
View organization configuration, analytics, and audit events	Yes	No	No
Create user populations (identity pools)	Yes	No	No

The other roles fit around this table:

• Auditor (auditor) can view users, groups, organization configuration, analytics, and audit events, and can change nothing.
• Business Admin (business_admin) is a tenant role. In every organization in the tenant it can do everything Organization Admin (manager) can, plus edit the organization name and email domains, create user populations, and create and delete organizations. It can't manage identity providers or other configuration.
• Super Admin (admin) can do everything listed, including creating and deleting organizations.

Who can grant which role

Your role	You can grant and revoke
Super Admin (admin) or Admin (admin)	Every organization role.
Organization Admin (manager) or Business Admin (business_admin)	Organization Admin (manager), User Manager (user_manager), User Population Manager, and Member (member).
User Manager (user_manager)	User Manager (user_manager), User Population Manager, and Member (member).
User Population Manager (user_manager on the population)	User Population Manager on the same user population, through the API only.
Auditor (auditor)	None.

A few rules apply to every role:

• You can't change your own roles. Another administrator must grant or revoke them.
• A user can hold roles only in organizations under the same top-level workspace as their own organization. Tenant administrators are exempt.
• Creating an organization, including a suborganization, requires the Super Admin (admin) or Business Admin (business_admin) tenant role.

A User Population Manager has the user management permissions in the table (view, create, update, and delete users and groups, send activation emails, reset passwords) for their population only. They can grant the User Population Manager role on that population to other users through the API with Grant identity pool role. The delegated admin portal doesn't show them the Roles field.

Add the first organization administrator

Use this flow when you onboard a new partner organization. The administrator is created as a user inside the organization, receives an activation email, and sets up their own credentials.

Prerequisites:

• To create the organization, you need the Super Admin (admin) or Business Admin (business_admin) tenant role.
• To add an administrator to an existing organization, you need one of those roles, or the Admin (admin) or Organization Admin (manager) role on the organization.
• The organization has a user population. Organizations created in the admin console without a template get one named Users.

In the admin console

You can create the administrator while you create the organization, or later.

While you create the organization:

1. Go to Organizations and click Create Organization.
2. Enter the organization details and click Create.
3. In the second step, Create new Organization Admin, enter the administrator's Email, First name, and Last name.
4. Click Send Invite.

The administrator is created with status new, granted the Organization Admin (manager) role on the new organization, and sent an activation email. The second step appears only when the new organization has exactly one user population. Otherwise, add the administrator to the existing organization as described below.

For an existing organization:

1. Open the organization and go to Users.
2. Click CREATE USER.
3. Under Select identifier, select Email and enter the administrator's email address and name.
4. If the user population allows passwords, a Mode option appears. Keep Send invitation selected.
5. In the Roles field, select Organization Admin (manager).
6. Click Create.

The user list shows the status Invite Sent until the administrator activates the account. To send the email again, open the user and click Resend Activation Email.

Through the API

The same flow takes three calls. Use an admin access token and replace {tid}, {region}, {org-id}, and {pool-id} with your values.

1. Create the user in the organization user population with status new. See Create user.

   curl -X POST "https://{tid}.{region}.connect.secureauth.com/api/identity/{tid}/admin/pools/{pool-id}/users" \
     -H "Authorization: Bearer {access-token}" \
     -H "Content-Type: application/json" \
     -d '{
       "status": "new",
       "payload": { "first_name": "Ana", "last_name": "Lee" },
       "identifiers": [ { "identifier": "ana.lee@partner.example", "type": "email" } ],
       "verifiable_addresses": [
         { "address": "ana.lee@partner.example", "type": "email", "status": "active", "verified": false }
       ]
     }'

   The response contains the new user id.

2. Grant the Organization Admin (manager) role on the organization. See Grant workspace role.

   curl -X POST "https://{tid}.{region}.connect.secureauth.com/api/admin/{tid}/servers/{org-id}/roles/grant" \
     -H "Authorization: Bearer {access-token}" \
     -H "Content-Type: application/json" \
     -d '{
       "role": "manager",
       "type": "identity_pool_user",
       "tenant_id": "{tid}",
       "identity_pool_id": "{pool-id}",
       "identity_pool_user_id": "{user-id}"
     }'

   A successful call returns 204 No Content. Use user_manager instead of manager to grant the User Manager (user_manager) role.

3. Send the activation email. Pass the organization ID as server_id so the email and the activation page use the organization branding. See Send activation message.

   curl -X POST "https://{tid}.{region}.connect.secureauth.com/api/identity/{tid}/admin/pools/{pool-id}/users/{user-id}/activation/send?server_id={org-id}" \
     -H "Authorization: Bearer {access-token}" \
     -H "Content-Type: application/json" \
     -d '{}'

   The call fails if the user status is not new. It invalidates any earlier activation link for the same user.

How the administrator accepts

1. The administrator opens the activation email and follows the link.
2. They complete account activation and set up their credentials, using the sign-in methods enabled for the organization user population.
3. Their status changes from new to active.
4. They sign in to the delegated admin portal for their organization and manage it with the role you granted.

The activation link is valid for 7 days by default. To change this, open the organization user population, select the Sign-in and Sign-up tab, and set Verification Code Settings > Activation OTP > Time To Live. If the link expires, send a new activation email from the user profile or with the API call above. To change the email content, edit the Activate Account With Link template. See Configure email message templates.

Add a second administrator

An organization can have any number of administrators. Repeat the steps in Add the first organization administrator for each person.

The first Organization Admin (manager) can also add the second one. An Organization Admin (manager) can grant the Organization Admin (manager) and User Manager (user_manager) roles to other users in their own organization, so you don't need to be involved after the first invitation.

To give an existing user an administrator role:

1. Open the organization and go to Users.
2. Select the user.
3. In the Roles field, add Organization Admin (manager) or User Manager (user_manager).
4. Save your changes.

Revoke an administrator role

Revoke the role when a person should stay a user but no longer administer the organization.

In the admin console:

1. Open the organization and go to Users.
2. Select the user.
3. Remove the role from the Roles field.
4. Save your changes.

Through the API: call Revoke workspace role with the same body you used to grant it.

curl -X DELETE "https://{tid}.{region}.connect.secureauth.com/api/admin/{tid}/servers/{org-id}/roles/revoke" \
  -H "Authorization: Bearer {access-token}" \
  -H "Content-Type: application/json" \
  -d '{
    "role": "manager",
    "type": "identity_pool_user",
    "tenant_id": "{tid}",
    "identity_pool_id": "{pool-id}",
    "identity_pool_user_id": "{user-id}"
  }'

To remove the person's access entirely, deactivate or delete the user instead. A user with status inactive can't sign in.

Workspace administrators with access to an organization

Your own staff can also administer an organization without being a user inside it. Open the organization, go to Settings > Administrators, and click Invite Admin. This list holds tenant administrators (stored in the tenant administrator pool) who have a role on this organization. Organization administrators created through Users don't appear here.

To manage administrators for your whole tenant, see Manage tenant administrators.

See also

• Delegated administration
• Delegated admin portal
• Create organizations and suborganizations
• Organization templates
• Assigning roles to SecureAuth administrators