[Yandex Cloud documentation](../index.md) > [Yandex Identity Hub](index.md) > Getting started > Creating your first organization

# Creating your first organization

An _organization_ is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. Organizations are also used to manage users and their authentication and authorization settings.

When working with Yandex Cloud services, you create resources, such as managed database clusters, virtual machines, disks, networks, etc. Most services store their resources in [folders](../resource-manager/concepts/resources-hierarchy.md#folder). Folders belong to [clouds](../resource-manager/concepts/resources-hierarchy.md#cloud), and clouds belong to organizations. A cloud may only belong to one organization, but you can move clouds between organizations. [Yandex Resource Manager](../resource-manager/concepts/resources-hierarchy.md) is a service that manages clouds and folders; Yandex Identity Hub manages organizations. Access to Yandex Cloud resources is managed via roles.


Yandex Cloud organization structure:

![users-and-resources](../_assets/overview/users-resources.svg "Users and resources hierarchy")

## Getting started {#before-you-begin}

1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or [sign up](../getting-started/index.md) if not signed up yet.
1. Accept the user agreement.
1. In [Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts), make sure you have a [billing account](../billing/concepts/billing-account.md) linked and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account yet, [create one](../billing/quickstart/index.md#create_billing_account).

## Create an organization {#create-organization}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  
  1. Read the Yandex Cloud terms of use and click **Log in**.
  
  1. Enter your company name and description.
  
  1. Click **Create a new organization**.

{% endlist %}

After registering, you will become the organization owner. You will be able to manage employee accounts, connect and disconnect services.

## Manage users {#manage-users}

### Add a user to your organization {#add-user-to-organization}

You can connect your employees using their Yandex accounts for access to the corporate services. If your company already uses a different account management system (such as Active Directory or Google Workspace), you can [create an identity federation](#create-federation) so that your employees can use their corporate accounts to access Yandex Cloud services.

To connect employees with Yandex accounts:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  
  1. In the left-hand panel, select ![icon-users](../_assets/console-icons/person.svg) **Users**.
  
  1. In the top-right corner of the screen, click ![person-plus](../_assets/console-icons/person-plus.svg) **Add user** and select ![person-planet-earth](../_assets/console-icons/person-planet-earth.svg) **Invite users with a Yandex account** from the drop-down list.
  
  1. Enter the email addresses of the users you want to invite to the organization (e.g., `login@yandex.ru`).
  
      You can send invitations to any email address. Invited users will be able to select the appropriate Yandex account once they accept the invitation.
  
  1. Click **Send invitation**.

{% endlist %}

The user will be connected to the organization as soon as they accept the invitation via the emailed link and select the appropriate account to log in. After that, you will be able to [assign them the required roles](#add-role).

For more information about users, see [Organization membership](concepts/membership.md).

### Create a user group {#create-group}

You can configure access for multiple users at once by adding them to a group and assigning a role to this group. You can grant access to any Yandex Cloud resources to the group.

To create a user group:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).

  1. In the left-hand panel, select ![groups](../_assets/console-icons/persons.svg) **Groups**.

  1. In the top-right corner of the page, click ![Circles3Plus](../_assets/console-icons/circles-3-plus.svg) **Create group**.

  1. Enter a name and description for the [group](concepts/groups.md).

      The name must be unique within the organization and satisfy the relevant requirements:

      * It must be from 1 to 63 characters long.
      * It may contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.

  1. Click **Create group**.

{% endlist %}

### Add the user to the group {#add-member-group}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).

  1. In the left-hand panel, select ![groups](../_assets/console-icons/persons.svg) **Groups** and click the row with the name of the [group](concepts/groups.md) you need.

  1. Navigate to the **Members** tab.

  1. Click **Add member**.

  1. In the window that opens, select the users or [service accounts](../iam/concepts/users/service-accounts.md). Use search, if required.

  1. Click **Save**.

{% endlist %}

## Manage access {#security}

### Assign a role to a user {#add-role}

To grant access to a resource, assign a role for the resource to the user. You can assign roles for an [organization](concepts/organization.md), [cloud](../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../resource-manager/concepts/resources-hierarchy.md#folder). The roles assigned to organizations, clouds, and folders also apply to their nested resources.
You can also assign roles to users to manage individual Yandex Cloud services using [Yandex Identity and Access Management](../iam/concepts/index.md).

To assign a role to a user:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) with an administrator or organization owner account.
  
  1. In the left-hand panel, select ![persons-lock](../_assets/console-icons/persons-lock.svg) **Access bindings**.
  
  1. If the user already has at least one role, click ![icon-context-menu](../_assets/console-icons/ellipsis.svg) and select **Assign roles** in the row with this user.
  
      If the user is not on the list, click **Assign roles** in the top-right corner. In the window that opens, select a user from the list or use the search bar.
  
  1. Click ![plus](../_assets/console-icons/plus.svg) **Add role** and select the [role](../iam/concepts/access-control/roles.md) you want to assign to the user. You can assign multiple roles.
  
      You can find the description of the available roles in the Yandex Identity and Access Management documentation in the [Yandex Cloud](../iam/roles-reference.md) role reference.
  
  1. Click **Save**.

{% endlist %}

### Assign a role for a cloud or folder to a user group {#group-add-role-cloud}

{% list tabs group=instructions %}

- Management console {#console}

  1. Log in to the [management console](https://console.yandex.cloud) with the cloud administrator or owner account.

  1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the [cloud](../resource-manager/concepts/resources-hierarchy.md#cloud) or [folder](../resource-manager/concepts/resources-hierarchy.md#folder) for which you want to assign a role to a user group.

  1. At the top of the screen, go to the **Access bindings** tab and click **Configure access**. In the window that opens:

      1. Go to the **Groups** tab and select the [group](concepts/groups.md) you need or search by group name.

          You can also assign a role to one of the [system](../iam/concepts/access-control/system-group.md) groups:

          * `All users in organization X`: The group includes all users in organization `X`.
          * `All users in federation N`: The group includes all users in federation `N`.

      1. Click ![plus](../_assets/console-icons/plus.svg) **Add role** and select the [role](../iam/concepts/access-control/roles.md) you want to assign to the group for the cloud or folder you selected earlier. You can assign multiple roles.

      1. Click **Save**.

{% endlist %}

### Assign a role for an organization to a user group {#group-add-role-organization}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.

  1. In the left-hand panel, select ![persons-lock](../_assets/console-icons/persons-lock.svg) **Access bindings**.

  1. At the top right, click **Assign roles**.

  1. Go to the **Groups** tab and select the [group](concepts/groups.md) you need or search by group name.

     You can also assign a role to one of the [system](../iam/concepts/access-control/system-group.md) groups:

     * `All users in organization X`: The group includes all users in organization `X`.
     * `All users in federation N`: The group includes all users in federation `N`.

  1. Click ![plus](../_assets/console-icons/plus.svg) **Add role** and select the [role](../iam/concepts/access-control/roles.md) for the organization you want to assign to the group. You can assign multiple roles.

  1. Click **Save**.

{% endlist %}

## Additional features {#additional-functionality}

### Create an identity federation or user pool {#create-federation}

If your company has a user and access management system (e.g., Active Directory or Google Workspace), you can use it to authenticate employees in Yandex Identity Hub. This way, employees will access Yandex Cloud services using their corporate accounts.

You do not need to use any third-party user and access management systems. You can create a [user pool](concepts/user-pools.md) to house [local user](../iam/concepts/users/accounts.md#local) accounts as you create them within your Yandex Identity Hub [organization](concepts/organization.md).

Moreover, Yandex Identity Hub can act as an identity provider for you to authenticate your users with third-party systems and solutions using [apps](concepts/applications/index.md).

For more information, see:
* [SAML-compatible identity federations](concepts/add-federation.md)
* [User pools](concepts/user-pools.md)
* [Applications in Yandex Identity Hub](concepts/applications/index.md)

### Enable access via OS Login {#os-login-access}

With OS Login, you can manage SSH access to VMs by relying solely on the [Yandex Identity and Access Management](../iam/concepts/index.md) mechanisms. There is no need to upload SSH keys to each new VM when creating it. You can use OS Login to access both [Yandex Compute Cloud VM instances](../compute/concepts/vm.md#project) and [individual nodes in node groups](../managed-kubernetes/concepts/index.md#node-group) within [Yandex Managed Service for Kubernetes clusters](../managed-kubernetes/concepts/index.md#kubernetes-cluster).

OS Login benefits:

* Instant update of user [access permissions](../iam/concepts/access-control/roles.md) within a VM when revoking or assigning roles. If you revoke the roles, the user will lose access to all VMs with OS Login access enabled.
* Multiple available options to access VMs: you can use both short-lived SSH certificates and SSH keys including those added to the organization user profile.

For more information, see [OS Login](concepts/os-login.md).

## What's next {#what-is-next}

* [Learn more about the relationships between organizations and other services](concepts/organization.md)
* [Managing organizations](operations/organizations-overview.md)
* [Managing user groups](operations/manage-groups.md)
* [Managing identity federations](operations/manage-federations.md)
* [Access control for user groups with different roles](tutorials/user-group-access-control.md)
* [Authentication and authorization security checklist](../security/domains/iam-checklist.md)