[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Step-by-step guides](../index.md) > Service access to user resources > Enabling and disabling services

# Enabling and disabling a service


In Yandex Identity and Access Management, you can enable and disable [service access](../../concepts/service-control.md) to user resources in a specific cloud.

Service access to resources can be managed by users with the [admin](../../../resource-manager/security/index.md#resource-manager-admin) or [owner](../../../resource-manager/security/index.md#resource-manager-clouds-owner) roles for the cloud.

## Enabling a service {#enable}

To grant access to user cloud resources to a service, you need enable the service:

{% list tabs group=instructions %}


- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  By default, the CLI uses the cloud specified in the CLI profile. If no cloud is specified in the CLI profile or you want to specify a different one, provide the ID of the cloud in the command using the `--cloud-id` property.

  1. View the description of the CLI command for enabling a service:

      ```bash
      yc iam service-control enable --help
      ```

  1. [Get](list-get.md#list) a list of services you can enable or disable with information on their [statuses](../../concepts/service-control.md#access-status).

  1. Run the command, specifying the ID of the service to enable:

      ```bash
      yc iam service-control enable <service_ID>
      ```

      Result:

      ```text
      done (31s)
      service_id: dspm
      resource:
        id: b1gmgc24pte8********
        type: resource-manager.cloud
      updated_at: "2024-03-12T13:21:12.331340Z"
      status: ENABLED
      ```

- API {#api}

  Use the [enable](../../api-ref/ServiceControl/enable.md) REST API method for the [ServiceControl](../../api-ref/ServiceControl/index.md) resource or the [ServiceControlService/Enable](../../api-ref/grpc/ServiceControl/enable.md) gRPC API call.

{% endlist %}

This will change the service [status](../../concepts/service-control.md#access-status) in the specified cloud to `ENABLED` and create the [service agents](../../concepts/service-control.md#service-agent) with permissions to manage user resources in this cloud.

## Disabling a service {#disable}

If a service has resources with access to the other user resources in this cloud, you cannot disable this service. To disable such a service, first delete all the service resources that have access to the other user resources.

To revoke the service's access to the user resources in the cloud, disable the service:

{% list tabs group=instructions %}


- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  By default, the CLI uses the cloud specified in the CLI profile. If no cloud is specified in the CLI profile or you want to specify a different one, provide the ID of the cloud in the command using the `--cloud-id` property.

  1. View the description of the CLI command for disabling a service:

      ```bash
      yc iam service-control disable --help
      ```

  1. [Get](list-get.md#list) a list of services you can enable or disable with information on their [statuses](../../concepts/service-control.md#access-status).

  1. Run the command, specifying the ID of the service to disable:

      ```bash
      yc iam service-control disable <service_ID>
      ```

      Result:

      ```text
      done (17s)
      service_id: dspm
      resource:
        id: b1gmgc24pte8********
        type: resource-manager.cloud
      updated_at: "2024-03-13T09:40:40.339678Z"
      status: DISABLED
      ```

- API {#api}

  Use the [disable](../../api-ref/ServiceControl/disable.md) REST API method for the [ServiceControl](../../api-ref/ServiceControl/index.md) resource or the [ServiceControlService/Disable](../../api-ref/grpc/ServiceControl/disable.md) gRPC API call.

{% endlist %}

As a result, the [status](../../concepts/service-control.md#access-status) of the service in the specified cloud will change to `DISABLED`, its [service agents](../../concepts/service-control.md#service-agent) will be deleted, and the service will lose access to user resources in this cloud.

#### See also {#see-also}

* [Getting the status of services](list-get.md)
* [Service access to user resources](../../concepts/service-control.md)