[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Managing users > Adding a user

# Adding a user

# Adding a user to an organization

Add a user to your [organization](../../overview/roles-and-resources.md) and [assign](../../iam/operations/roles/grant.md) a relevant [role](../../iam/concepts/access-control/roles.md) for access to Yandex Cloud resources. Users need roles, for example, to create managed database clusters or keep track of current VM status.

You can add [users with a Yandex account](../../iam/concepts/users/accounts.md#passport), [federated users](../../iam/concepts/users/accounts.md#saml-federation), and [local users](../../iam/concepts/users/accounts.md#local). New users will become members of the organization, and you will be able to assign roles to them. An organization user without roles assigned has no access to resources in that organization's clouds. To learn how to grant a role to a user, see [Assigning roles](../../iam/operations/roles/grant.md).

To add users to an organization, you must be an administrator (`organization-manager.admin` role) or owner (`organization-manager.organizations.owner` role) of that organization, or have an administrator's role for the type of user accounts you want to add.

{% note info %}

To enable a user to access the [management console](https://console.yandex.cloud), assign them a role for the [cloud](../security/index.md#access-binding-cloud) or [organization](../security/index.md#access-binding-organization). For added security, you can assign one of the least priveleged roles, such as `resource-manager.clouds.member`. However, you may also assign other roles if you know which permissions you want to grant to the invited users.

To grant these permissions to all the organization users at once, assign the role to the `All users in organization X` [system group](../../iam/concepts/access-control/system-group.md#allOrganizationUsers). When using the CLI or API, no additional roles are required.

{% endnote %}

## Yandex account users {#useraccount}

## Yandex account users {#useraccount}

If your employees have Yandex accounts, e.g., `login@yandex.ru`, they can use them to access Yandex Cloud services enabled in your organization.

You can invite a user to an organization via the management console or the Cloud Center interface. An invitation to join your organization will be sent to the user's email address.

Users with any of the following [roles](../security/index.md) can invite new users with Yandex accounts to an organization and delete such invitations: `organization-manager.passportUserAdmin`, `organization-manager.admin`, or `organization-manager.organizations.owner`.

{% note info %}

Inviting users with a Yandex account to an organization may be prohibited by the `organization.denyMemberInvitation` [access policy](../../iam/concepts/access-control/access-policies.md) assigned for the [organization](../concepts/organization.md).

{% endnote %}

### Send an invitation {#send-invitation}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  
  1. In the left-hand panel, select ![icon-users](../../_assets/console-icons/person.svg) **Users**.
  
  1. In the top-right corner of the screen, click ![person-plus](../../_assets/console-icons/person-plus.svg) **Add user** and select ![person-planet-earth](../../_assets/console-icons/person-planet-earth.svg) **Invite users with a Yandex account** from the drop-down list.
  
  1. Enter the email addresses of the users you want to invite to the organization (e.g., `login@yandex.ru`).
  
      You can send invitations to any email address. Invited users will be able to select the appropriate Yandex account once they accept the invitation.
  
  1. Click **Send invitation**.

- Management console {#console}

    1. Log in to the [management console](https://console.yandex.cloud) with the cloud administrator account.

    1. Click ![image](../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud.

    1. In the top-right corner, click ![icon-users](../../_assets/console-icons/ellipsis.svg) and select ![person-plus](../../_assets/console-icons/person-plus.svg) **Invite users**.

    1. Enter the email addresses of the users you want to invite to the organization (e.g., `login@yandex.ru`).

        You can send invitations to any email address. Invited users will be able to select the appropriate Yandex account once they accept the invitation.

    1. Click **Send invitation**.

{% endlist %}

The user will be able to log in to the organization upon accepting the invitation via the emailed link and selecting an account for log-in. To access the services enabled for the organization, the users you invited simply need to log in to their Yandex account.

You can delete or resend your invitation only via Yandex Identity Hub.

### Delete the invitation {#delete-invitation}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Yandex Identity Hub](https://center.yandex.cloud/organization).

  1. In the left-hand panel, select ![icon-users](../../_assets/console-icons/person.svg) **Users**.

  1. Select the **Invitations** tab in the center of the screen.

  1. In the row with the invitation, click ![ellipsis](../../_assets/console-icons/ellipsis.svg) and select **Delete invitation**.

  1. In the window that opens, confirm the deletion.

{% endlist %}

### Resend your invitation {#resend-invitation}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Yandex Identity Hub](https://center.yandex.cloud/organization).

  1. In the left-hand panel, select ![icon-users](../../_assets/console-icons/person.svg) **Users**.

  1. Select the **Invitations** tab in the center of the screen.

  1. In the row with the invitation, click ![ellipsis](../../_assets/console-icons/ellipsis.svg) and select **Resend**.

  1. In the window that opens, confirm resending the invitation.

{% endlist %}

{% note info %}

To better safeguard your resources from unauthorized access:

1. Enable [two-factor authentication](https://yandex.com/support/passport/authorization/twofa.html) for your Yandex account.
1. Request users you add to your organization to enable two-factor authentication as well.
1. In the organization security settings, [enable the two-factor authentication requirement](enable-2fa-access.md). This way, only users with two-factor authentication enabled will be able to access resources.

{% endnote %}

## Federated users {#user-sso}

## Federated users {#user-sso}

If you did not enable the **Automatically create users** option when [setting up the federation](../concepts/add-federation.md#federation-usage), you will have to add federated users to your organization manually.

To do this, you need to know the users’ name IDs returned by the identity provider (IdP) server together with the successful authentication response. This will usually be the user's email address. To find out what the server returns as the name ID, contact the administrator who configured authentication for your federation.

If the **Automatically create users** option is enabled, a federation will only add users logging in to a cloud for the first time. If a federated user has been deleted, they can only be added again manually.

You do not need to invite federated users to the organization; they are added automatically on their first login.

Users with any of the following [roles](../security/index.md) can add or remove federated users from the organization: `organization-manager.federations.userAdmin`, `organization-manager.federations.admin`, `organization-manager.admin`, or `organization-manager.organizations.owner`.

### Add federated users {#add-user-sso}

### Add federated users {#add-user-sso}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Go to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    
    1. In the left-hand panel, select ![icon-users](../../_assets/console-icons/person.svg) **Users**.
    
    1. In the top-right corner, click ![person-plus](../../_assets/console-icons/person-plus.svg) **Add user** and select ![key](../../_assets/console-icons/key.svg) **Add federated users** from the drop-down list.
    
    1. In the **Federation** field, select the identity federation you want to add users from.
    
    1. In the **Users** field, list the name IDs of users, separating them with spaces or line breaks.
    
    1. Click **Add**. This will give the users access to the organization.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. View the description of the add user command:

        ```bash
        yc organization-manager federation saml add-user-accounts --help
        ```

    1. Add users by listing their name IDs separated by a comma:

        ```bash
        yc organization-manager federation saml add-user-accounts \
           --name <federation_name> \
           --name-ids <list_of_user_name_IDs>
        ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the relevant documentation on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file, describe the resources you want to create:

      ```hcl
      resource "yandex_organizationmanager_saml_federation_user_account" "some_account" {
        federation_id = "<federation_ID>"
        name_id       = "<user_name_ID>"
      }
      ```

      Where:
      * `federation_id`: ID of the federation to add the user to.
      * `name_id`: Name ID of the user.

      For more information about `yandex_organizationmanager_saml_federation_user_account` properties, see [this provider guide](../../terraform/resources/organizationmanager_saml_federation_user_account.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      Terraform will create all the required resources. You can check the new resources in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../cli/index.md) command:

      ```bash
      yc organization-manager federations saml \
        --organization-id <organization_ID> list-user-accounts \
        --id <federation_ID>
      ```

- API {#api}

  Use the [addUserAccounts](../saml/api-ref/Federation/addUserAccounts.md) REST API method for the [Federation](../saml/api-ref/Federation/index.md) resource or the [FederationService/AddUserAccounts](../saml/api-ref/grpc/Federation/addUserAccounts.md) gRPC API call and provide the following in the request:

  * Federation ID in the `federationId` parameter.
  * List of user name IDs in the `nameIds` parameter.

{% endlist %}

{% note info %}

The federated user's [attributes](setup-federation.md#claims-mapping) are loaded into their profile in the Yandex Identity Hub [organization](../concepts/organization.md) after the user's first authentication to Yandex Cloud.

{% endnote %}

## Local users {#local-users}

## Local users {#local-users}

You must add [local users](../../iam/concepts/users/accounts.md#local) to your organization manually. Each user is assigned a unique username within the selected [user pool](../concepts/user-pools.md).

Users with any of the following [roles](../security/index.md) can add or remove local users from the organization: `organization-manager.userpools.userAdmin`, `organization-manager.userpools.admin`, `organization-manager.admin`, or `organization-manager.organizations.owner`.

### Add local users {#add-local-user}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  1. In the left-hand panel, select ![userpool](../../_assets/organization/userpool.svg) **User pools** and select the [user pool](../concepts/user-pools.md).
  1. Go to the **Users** tab and click ![person-plus](../../_assets/console-icons/person-plus.svg) **Add user**.
  1. In the **Username** field, enter the user login and select the [domain](../concepts/domains.md) from the list. The login must be unique for the current user pool.
  
      If the domain is not on the list, [create a new one](user-pools/add-domain.md).
  1. In the **Full name** field, specify the user first and last name in any format.  
  1. Optionally, add the user’s email.
  1. In the **Password** field, you can view the automatically generated user password and generate a new one.
  
      The user must change this password on their first login to Yandex Cloud.
  1. Enable **Account is active** if you need to activate the user immediately upon adding them. Activated users gain access to the organization resources.
  1. Optionally, expand the **Personal information** section and specify the user's first name, last name, and phone number.
  1. Click **Add user**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for adding a user to a [pool](../concepts/user-pools.md):

     ```bash
     yc organization-manager idp user create --help
     ```
  1. To get a list of pools in an organization, provide its [ID](organization-get-id.md) in this command:
     
     ```bash
     yc organization-manager idp userpool list \
       --organization-id <organization_ID>
     ```
     
     Result:
     
     ```text
     +----------------------+--------------+-------------+----------------------+---------------------+
     |          ID          |     NAME     | DESCRIPTION |   ORGANIZATION ID    |     CREATED AT      |
     +----------------------+--------------+-------------+----------------------+---------------------+
     | ek0o6g0irskn******** | sample-pool1 |             | bpf2c65rqcl8******** | 2025-05-17 10:01:04 |
     | ek03mf01jr4z******** | sample-pool2 |             | bpf2c65rqcl8******** | 2025-06-28 16:30:23 |
     +----------------------+--------------+-------------+----------------------+---------------------+
     ```
  1. To create a new user, run this command:

     ```bash
     yc organization-manager idp user create \
       --userpool-id <pool_ID> \
       --username <login_and_domain> \
       --full-name <name_and_last_name> \
       --given-name <name> \
       --family-name <last_name> \
       --email <email_address> \
       --phone-number <phone_number> \
       --password <password>
     ```

     Where:
     
     * `--userpool-id`: ID of the user pool you need to add the user to.
     * `--username`: User login and domain in `login@domain` format. The login must be unique for the current user pool.
     * `--full-name`: User first and last name in any format.
     * `--given-name`: Username. This is an optional parameter.
     * `--family-name`: User last name. This is an optional parameter.
     * `--email`: User email. This is an optional parameter.
     * `--phone-number`: User phone number. This is an optional parameter.
     * `--password`: Password. This is an optional parameter. If no password is set, it will be generated automatically. The user must change this password on their first login to Yandex Cloud.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the relevant documentation on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).
 
  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.
 
  1. Describe the user parameters in the configuration file:
 
     ```hcl
     resource "yandex_organizationmanager_idp_user" "example_user" {
       userpool_id  = <pool_ID>
       username     = "<login_and_domain>"
       full_name    = "<name_and_last_name>"
       given_name   = "<name>"
       family_name  = "<last_name>"
       email        = "<email_address>"
       phone_number = "<phone_number>"
       is_active    = true
       password_spec = {
         password = "<password>"
       }
     }
     ```
 
     Where:
 
     * `userpool_id`: ID of the [user pool](../concepts/user-pools.md) you need to add the new user to.
     * `username`: User login and domain in `login@domain` format. The login must be unique for the current user pool.
     * `full_name`: User first and last name in any format.
     * `given_name`: Username. This is an optional parameter.
     * `family_name`: User last name. This is an optional parameter.
     * `email`: User email. This is an optional parameter.
     * `phone_number`: User phone number. This is an optional parameter.
     * `password`: Password. This is an optional parameter. If no password is set, it will be generated automatically. The user must change this password on their first login to Yandex Cloud.
     * `is_active`: Activation flag. Set to `true` to activate the user.
 
     For more information about `yandex_organizationmanager_idp_user` properties, see [this provider guide](../../terraform/resources/organizationmanager_idp_user.md).
 
  1. Create the resources:
 
     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.
 
     Terraform will create all the required resources. You can check the new resources and their settings in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../cli/index.md) command:
 
     ```bash
     yc organization-manager idp user list --userpool-id <pool_ID>
     ```

- API {#api}

  Use the [User.Create](../idp/api-ref/User/create.md) REST API method for the [User](../idp/api-ref/User/index.md) resource or the [UserService/Create](../idp/api-ref/grpc/User/create.md) gRPC API call.

{% endlist %}

#### What's next {#what-is-next}

* [Assign roles to the new users](../../iam/operations/roles/grant.md).