[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > Concepts > Organization

# Organization

An _organization_ is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. Organizations are also used to manage users and their authentication and authorization settings.

When working with Yandex Cloud services, you create resources, such as managed database clusters, virtual machines, disks, networks, etc. Most services store their resources in [folders](../../resource-manager/concepts/resources-hierarchy.md#folder). Folders belong to [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud), and clouds belong to organizations. A cloud may only belong to one organization, but you can move clouds between organizations. [Yandex Resource Manager](../../resource-manager/concepts/resources-hierarchy.md) is a service that manages clouds and folders; Yandex Identity Hub manages organizations. Access to Yandex Cloud resources is managed via roles.

Yandex Cloud organization structure:

![users-and-resources](../../_assets/overview/users-resources.svg "Users and resources hierarchy")

## Access management in an organization {#access-management}

Within an organization, users deal with Yandex Cloud resources. Organizations do not interact with one another, which is why an organization's resources are available only to [its members](membership.md). This does not apply to resources authorized to be accessed from the [public groups](../../iam/concepts/access-control/public-group.md) titled `All users` and `All authenticated users`.

You can set up access to an organization's resources for individual users or user groups. You have the following tools for that:

* [User groups](groups.md): Allow issuing identical access permissions to several users at the same time.
* [Identity federations](add-federation.md): Implement a single sign-on system for users within an organization, even without a Yandex account.
* [User pools](user-pools.md): Allow grouping [local users](../../iam/concepts/users/accounts.md#local) into containers.
* [Yandex Identity and Access Management](../../iam/concepts/index.md): Enables you to enforce restrictions on operations via [access policies](../../iam/concepts/access-control/access-policies.md) and provides users with roles they need to perform specific operations with a particular Yandex Cloud resource.

## Organization security management {#security}

These practices can help you manage security of your organization:

* [Use refresh tokens in the Yandex Cloud CLI](../operations/enable-refresh-tokens.md).
* [Set up OS Login access](../operations/os-login-access.md).
* [Require two-factor authentication](../operations/enable-2fa-access.md).
* [Block users from viewing information about organization members](../operations/hide-user-info.md).

## Service management {#service-management}

Most Yandex Cloud services store their resources in [folders](../../resource-manager/concepts/resources-hierarchy.md#folder) within an [organization](organization.md). However, some services are separate from the common resource and role model. They operate at the organization level and can exchange data with other services within the same organization. These services include:

* [Yandex Tracker](https://tracker.yandex.com/)
* [Yandex DataLens](https://datalens.ru/promo)
* [Yandex Wiki](https://wiki.yandex.com/)
* [Yandex Forms](https://forms.yandex.com/cloud/admin)
* [Yandex DataSphere](https://datasphere.yandex.cloud)
* [Yandex SpeechSense](https://speechsense.yandex.cloud/)

To start managing the services:

1. [Log in](https://passport.yandex.ru/) as the organization administrator or owner.

1. Go to [Cloud Center](https://center.yandex.cloud).

1. If you want to manage one of the separate services, find and click it in the list of services on the right-hand panel.

   To manage other services, click **Cloud Console** in the top-right corner.

## Use cases {#examples}

* [Access control for user groups with different roles in Yandex Identity Hub](../../tutorials/security/user-group-access-control.md)
* [Google Workspace authentication](../../tutorials/security/integration-gworkspace.md)
* [Authentication via Microsoft Entra ID](../../tutorials/security/integration-azure.md)
* [Authentication via Active Directory](../../tutorials/security/integration-adfs.md)

## What's next {#what-is-next}

* [Organization membership](membership.md)
* [Managing organizations](../operations/organizations-overview.md)
* [Managing user groups](../operations/manage-groups.md)
* [Managing identity federations](../operations/manage-federations.md)
* [OS Login](os-login.md)
* [Getting started with Yandex Security Deck](../../security-deck/quickstart-overview.md)
* [Access control for user groups with different roles in Yandex Identity Hub](../tutorials/user-group-access-control.md)
* [Authentication and authorization security checklist](../../security/domains/iam-checklist.md)