[Yandex Cloud documentation](../index.md) > [Yandex Identity and Access Management](index.md) > Getting started > How to manage access to resources

# Getting started with IAM

To get started with IAM, add a user to your organization and grant them access to a resource in one of your clouds. [Learn more about organizations, resources, and users](../overview/roles-and-resources.md).

## Getting started {#before-you-begin}

1. Log in to the [management console](https://console.yandex.cloud). If not signed up yet, navigate to the management console and follow the instructions.
1. Make sure that you have the required [roles](concepts/access-control/roles.md):

    1. In the management console, click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud.
    1. Navigate to the **Access bindings** tab.
    1. Specify your account in the search bar.
    1. Check that your account has the following roles:

        * Organization owner (`organization-manager.organizations.owner`) or administrator (`organization-manager.admin`)
        * Cloud owner (`resource-manager.clouds.owner`) or administrator (`admin`)

1. On the [**Yandex Cloud Billing**](https://center.yandex.cloud/billing/accounts) page, make sure you have a linked [billing account](../billing/concepts/billing-account.md) with the `ACTIVE` or `TRIAL_ACTIVE` status. If you do not have a billing account yet, [create one](../billing/quickstart/index.md#create_billing_account).
1. If you do not have any users to add to the cloud, you can [create a new Yandex account](https://passport.yandex.ru/registration) and grant this account access to the cloud.

## Add a user with a Yandex account to your organization {#add-organization-member}

{% list tabs group=instructions %}

- Management console {#console}
  
    1. [Log in](https://passport.yandex.com/auth) to the cloud administrator account.
    1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud.
    1. Navigate to the **Access bindings** tab.
    1. In the top-right corner, click ![icon-users](../_assets/console-icons/ellipsis.svg) and select **Invite users**.
    1. Enter the email addresses of the users you want to invite to the organization (e.g., `login@yandex.com`).

        You can send invitations to any email address. Invited users will be able to select the appropriate Yandex account once they accept the invitation.

    1. Click **Send invitation**.

{% endlist %}

The user will be able to log in to the organization upon accepting the invitation via the emailed link and selecting an account for log-in. To access the services enabled for the organization, the users you invited simply need to log in to their Yandex account.

## Assign roles to the user {#assign-role}

To specify which operations the user can perform, assign relevant roles to the user. For example, allow the user to view cloud resources and manage a folder:

{% list tabs group=instructions %}

- Management console {#console}

    1. Assign the user a role in the cloud:
        
        1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud.
        1. Navigate to the **Access bindings** tab.
        1. Click **Configure access**.
        1. In the window that opens, select **User accounts**.
        1. Select a user from the list or use the user search option.
        1. Click ![image](../_assets/console-icons/plus.svg) **Add role**.
        1. Select the `resource-manager.viewer` role. This role enables you to read cloud information, including the access rights list.
        1. Click **Save**.

    1. Assign the user a role in the folder:

        1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../resource-manager/concepts/resources-hierarchy.md#folder).
        1. Navigate to the **Access bindings** tab.
        1. Click **Configure access**.
        1. In the window that opens, select **User accounts**.
        1. Select a user from the list or use the user search option.
        1. Click ![image](../_assets/console-icons/plus.svg) **Add role**.
        1. Select the `resource-manager.editor` role. This role enables you to read folder information, including the list of access permissions, as well as edit and delete the folder.
        1. Click **Save**.

{% endlist %}

## Revoke assigned roles {#revoke-roles}

If the assigned roles are no longer needed, revoke them:

{% list tabs group=instructions %}

- Management console {#console}

    * To revoke a role only in the folder:

        1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../resource-manager/concepts/resources-hierarchy.md#folder).
        1. Navigate to the **Access bindings** tab.
        1. Select a user from the list and click ![image](../_assets/console-icons/ellipsis.svg) next to the username.
        1. Click **Edit roles**.
        1. Click ![image](../_assets/console-icons/xmark.svg) next to the role to revoke.
        1. Click **Save**.

    * To revoke a role in the cloud:

        1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud.
        1. Navigate to the **Access bindings** tab.
        1. Select a user from the list and click ![image](../_assets/console-icons/ellipsis.svg) next to the username.
        1. Click **Edit roles**.
        1. Click ![image](../_assets/console-icons/xmark.svg) next to the role to revoke.
        1. Click **Save**.

{% endlist %}

## What's next {#what-is-next}

* The [step-by-step guides](operations/index.md) will help you perform specific tasks in Identity and Access Management.
* Learn about [access management in Yandex Cloud](concepts/access-control/index.md).
* See the [best practices for using Yandex Cloud securely](best-practices/using-iam-securely.md).
* Learn [how to get started with Yandex Identity Hub](../organization/quickstart.md).
* Learn about [authentication in Yandex Cloud](concepts/authorization/index.md#authentication).
* [Learn how to work with service accounts](quickstart-sa.md).
* Use [authentication and authorization security checklist](../security/domains/iam-checklist.md).
* See [answers to frequently asked questions](qa/index.md).