Organizations

Use organizations to manage multiple Ably accounts by centralizing user access and roles under a single organizational structure. Organizations streamline user provisioning through Single Sign-On (SSO) configuration and utilize SCIM System for Cross-domain Identity Management for group-based access control.

Organizations enable the primary account to assign and adjust the roles of users and groups across all accounts.

You can separate accounts within an organization to create isolated environments, such as production, staging, and development. Assign each environment a package that meets its specific needs. For example, production may need high capacity with an Enterprise package, staging might use a Standard package, and development a Free package.

The primary account is an organization’s main account and holds the following privileges:

• The highest level of access to the organization.
• Ownership of all all accounts within the organization.
• The default account used for provisioning.

Create accounts in an organization:

• Open the Account navigation dropdown.
  • Click Organization Accounts.
  • Click New account.
  • Add an account name and Create account.

Manage access to multiple Ably accounts through a single identity provider. To enable this, configure both SSO with your chosen identity provider and SCIM. Once configured, Ably automatically provisions and deprovisions users with access to the Ably app in your identity provider, either individually or through assigned groups. New users are added to Ably’s default provisioning account with the role of Developer.

Ably only recognizes one registered email domain per organization, unrecognized email domains will result in rejected provisioning attempts.

Users provisioned through SCIM cannot modify their name or email address within Ably. All personal information updates must be made through your identity provider, and changes will sync to Ably on the next SCIM update cycle.

The following steps outline the process for provisioning users through SCIM:

• Configure SSO by enabling and setting up SSO between Ably and your identity provider.

• Copy Ably SCIM configuration values:
  • Open the Account navigation dropdown in the Ably dashboard.
  • Select Organization Settings from the menu.
  • Navigate to the Users & Groups Provisioning (SCIM) section and copy:
  • Service Provider Configuration Endpoint.
  • SCIM Username.
  • SCIM Password.
• In your identity providers provisioning app, paste the following values from Ably:
  • Service Provider Configuration Endpoint.
  • SCIM Username.
  • SCIM Password.
• Ensure that any additional setup required by your identity provider is completed to finalize the SCIM configuration.

Manage user and group roles across accounts within your organization. User and group roles include those assigned directly to the user and through the groups the user belongs to. Use the Organization Users page as a central point of control, rather than managing access individually within each account.

When organizations and your identity provider are configured, the groups you create in the identity provider are synchronized with Ably. This allows you to manage group-based access centrally. Assign roles to these groups and all users in a group will inherit those roles.

To manage group roles in Ably:

• Open the Account navigation dropdown.
  • Click Organization Users.
  • Under Ably Realtime identity provider groups, click Manage account access.
  • Select the group whose access you want to manage.
  • Specify the required Roles for the group — and all users in this group inherit these roles automatically.