Organization templates

SecureAuth Connect organization templates let you configure a partner or customer organization once and reuse that configuration for every new organization. A template is an organization marked as a template. When you create an organization from it, SecureAuth copies the template configuration into the new organization.

Use templates when you onboard many similar organizations, such as partner agencies that all use the same sign-in methods, user attributes, and applications.

What a template copies

The copy happens once, when you create the organization. The new organization gets its own copy of each item. Most copies get new IDs, including user populations, applications, scopes, policies, scripts, and services. Some keep the ID they have in the template, including identity providers, custom applications, and webhooks.

Copied	Not copied
Organization settings: sign-in methods, email domains, and the custom attributes schema and values (see the exceptions below the table).	Users.
User populations (identity pools) with their full configuration: sign-in and sign-up methods, password policy, MFA, and activation and reset settings. Each new organization gets its own copy.	Groups.
Identity providers, except static identity providers (test identity providers with a fixed list of users and passwords).	Administrator role assignments. The new organization has no administrators until you add them.
Applications (clients), except dynamically registered clients.	Secrets and credentials, such as client secrets and identity provider client secrets. Webhook API keys are the exception: they are copied (see Limits and behavior).
Scopes, services, and APIs.	The template parent. The new organization gets the parent you set when you create it.
Policies, scripts, and claims.	The template flag. The new organization is a regular organization unless you mark it as a template.
Consent settings, webhooks, custom applications, and the theme binding.

Themes, MFA methods, and other tenant-level settings are shared across the tenant, so the new organization refers to the same ones as the template.

Values you send when you create the organization override the template values:

• Email domains – The admin console and the delegated admin portal always send the domains you enter, even none, so they never copy the template's domains. An API request without domains copies them. Leave Email domains empty on the template, because a domain routes sign-in to one organization.
• Custom attribute values – The template value is kept for every attribute you leave empty when you create the organization. An API request without metadata copies no values.
• Sign-in methods – The authentication_mechanisms you send replace the ones from the template.

How template changes affect existing organizations

They don't. A template is not linked to the organizations created from it. Changing a template after you create organizations from it affects only organizations you create later. To change an existing organization, edit that organization directly.

Limits and behavior

• Use template organizations for configuration only. Don't add real users to a template or use it for sign-in. Nothing in the product prevents it, so it is up to you.
• The Default organization template setting applies only when you create organizations in the admin console or the delegated admin portal. An API call without template_id creates an organization with no template, even when a default template is set. The same applies to the Default organization parent setting and parent_id.
• Secrets aren't copied. After you create an organization from a template, enter the client secrets for any identity providers copied from the template.
• Webhooks keep the API key they have in the template, so every organization created from the template sends the same key in the X-Api-Key header. To give an organization its own key, set a new api_key on its webhook after you create the organization. See Secure the receiving endpoint.

Create a template

You need the Super Admin (admin) or Business Admin (business_admin) tenant role.

1. Go to Tenant Settings > Organizations > Templates.

   

2. Click CREATE TEMPLATE.

3. Enter a Name. Optionally, under Copy existing configuration, select an organization to start from. Its configuration is copied into the template.

4. Click Create.

   

You can also turn an existing organization into a template, or remove the template flag, from the organization menu in the organizations list.

The following sections walk you through configuring the user population, authentication methods, and business attributes, and retrieving the template ID.

Configure the user population

A user population (identity pool) stores the users of an organization and their sign-in settings. Some buttons, such as CREATE POOL, call it a pool. Create one user population in your template so every organization created from it has a place to store its users.

Create exactly one user population. With none or more than one, the admin console skips the Send Invite step when you create an organization, and you add the first administrator afterwards.

1. Go to Tenant Settings > Organizations > Templates and select your template.

2. In the left navigation, select Users.

3. Click CREATE POOL.

   

4. Define the Pool name and Description.

5. Click Create.

Configure authentication methods

Select which authentication methods are available for organizations created from this template. Users of the new organizations sign in and activate their accounts with these methods.

1. Within your identity pool, click the Sign-in and Sign-up tab.

   

2. Under First-Factor Authentication Methods, Password is configured by default.

3. Click Add method to add more methods (for example, Passkey).

4. Save your changes.

To make passkeys the default sign-in method, keep Password enabled and select Make Preferred in the Passkey menu. The login page then offers the passkey first and shows the other methods as alternatives, so users who lose their passkey can still sign in. When an invited user activates their account, the activation page also opens on the preferred method and lets them switch to another enabled method. If Passkey is the only first-factor method, activation asks the user to register a passkey. See Set up sign-in and sign-up methods.

Under Second-Factor Authentication Methods, you can add any method, including Push and Symbol from the SecureAuth Authenticate app. Users can pick their own preferred second factor in the end user portal, but that choice can't be Push or Symbol.

Configure business attributes

Business attributes allow you to store custom organization-specific data. Use them to link organizations to external systems, store entitlements, and track business metadata. They are the same thing as the organization Custom Attributes, and the API stores their values in metadata.payload.

1. In the template, go to Settings.

2. Click the Custom Attributes tab.

   

3. Define your schema in the JSON editor. For example:

   {
     "properties": {
       "orgEntitlements": {
         "description": "List of features/services this organization has access to",
         "type": "array",
         "items": {
           "type": "string"
         }
       },
       "region": {
         "description": "Geographic region or country",
         "type": "string"
       },
       "salesforceId": {
         "description": "Salesforce Account ID for bidirectional mapping",
         "type": "string",
         "maxLength": 18
       }
     },
     "description": "B2B Customer Organization Attributes",
     "additionalProperties": false,
     "type": "object"
   }

4. On the right side of the editor, form fields appear for each schema property. You can enter test values to check the schema, but clear them before you save. Values saved on the template are copied into every new organization for each attribute left empty when the organization is created.

   

For more on schemas, see Configure organization details.

Retrieve the template ID

You need the template ID to reference this template when creating organizations via the API.

1. In the left sidebar, select Settings.

2. Click the General tab.

3. Locate the id field and copy this value. The ID is generated when you create the template, for example a13ee0f6236f4d7f89085945c3f75cd1.

   

Set a default template

Set a default template so that administrators don't need to pick one every time they create an organization in the admin console or the delegated admin portal.

1. Go to Tenant Settings > Organizations > Settings.
2. Select a template in Default organization template.
3. Save your changes.

Example: onboard partner organizations from one template

This example sets up a partner template once and then creates three partner organizations from it with the System API.

1. Create a template named partner-template and configure it as described on this page:

   • A user population with Password and Passkey sign-in methods.
   • A custom attributes schema with an agencyCode property.

2. Copy the template ID, for example a13ee0f6236f4d7f89085945c3f75cd1. See Retrieve the template ID.

3. Get a System API access token with the manage_organizations scope. See Create organizations via API.

4. Create one organization per partner. Pass template_id and parent_id in every call, because the API doesn't apply the default template or the default parent.

   for partner in north-county east-county west-county; do
     curl -X POST "https://{tenant-id}.{region-id}.connect.secureauth.com/api/system/{tenant-id}/organizations" \
       -H "Authorization: Bearer {access-token}" \
       -H "Content-Type: application/json" \
       -d "{
         \"id\": \"${partner}\",
         \"name\": \"${partner}\",
         \"template_id\": \"a13ee0f6236f4d7f89085945c3f75cd1\",
         \"parent_id\": \"{workspace-id}\",
         \"metadata\": { \"payload\": { \"agencyCode\": \"${partner}\" } }
       }"
   done

5. Invite the first administrator of each organization. See Add the first organization administrator.

Each new organization has its own user population, sign-in methods, and attribute schema copied from the template, and no users or administrators yet. If you later add a sign-in method to the partner-template template, add it to north-county, east-county, and west-county yourself.

See also

• Create organizations via API
• Organization administrator roles and permissions
• Create organizations and suborganizations
• Configure organization details
• Organizations overview