[Yandex Cloud documentation](../../index.md) > [Tutorials](../index.md) > [Security](index.md) > Inviting a new user and assigning roles

# Inviting a new user and assigning roles

This tutorial will instruct you how to invite a new Yandex account user to your organization and grant them permissions to create a VM in a folder. The tutorial includes instructions for both the administrator and the user. For the steps the user must complete, see [User actions](#user-actions).


{% note info %}

To invite Yandex account users, see [Adding a user](../../organization/operations/add-account.md). For federated and local users, see [Managing a user account](../../organization/operations/user-account/index.md).

{% endnote %}


To invite a user to your organization and grant them access to a folder and other resources:

1. [Prepare Yandex Cloud](#before-begin).
1. [Set up your infrastructure](#prepare-infrastructure).
1. [Invite the user to the organization and assign roles](#add-account).
1. Make sure the user has [accepted the invitation and can access the resources](#user-actions).

If you no longer need the paid resources you created, [delete them](#clear-out).

## Required paid resources {#paid-resources}

The cost of infrastructure support includes fees for computing resources, OS, storage, amount of outgoing traffic, and VM public IP address (see [Yandex Compute Cloud pricing](../../compute/pricing.md)).

## Prepare Yandex Cloud {#before-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):

1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md).

## Set up your infrastructure {#prepare-infrastructure}

[_Organization_](../../overview/roles-and-resources.md) is a workspace that consolidates various types of Yandex Cloud resources and users. Any Yandex user can create an organization in Yandex Identity Hub. After you create an organization, you become its [owner](../../organization/security/index.md#organization-manager-organizations-owner) and can manage its settings.

To create an organization, follow these steps:

1. [Go](https://center.yandex.cloud/organization) to Yandex Identity Hub.

    Your next steps will depend on whether you are a member of any organization in Yandex Identity Hub.

1. Create an organization:

    {% list tabs %}

    - You are not a member of an organization

      If you are not yet a member of an organization in Yandex Identity Hub, when clicking the link, you will be prompted to create a new organization:

      1. Enter your organization name, e.g., `Example organization`.
      1. Click **Create a new organization**.

    - If you are a member of an organization

      If you are currently a member of an organization in Yandex Identity Hub, when clicking the link, you will see the [Yandex Identity Hub](https://center.yandex.cloud/organization) interface in Cloud Center.

      To avoid tampering with the infrastructure in existing organizations, create a new organization:

      1. In the top-left corner, next to the organization name, click ![chevron-down](../../_assets/console-icons/chevron-down.svg) and select ![circle-plus](../../_assets/console-icons/circle-plus.svg) **Create organization**.
      1. In the window that opens, enter a name for the organization: `Example organization`.
      1. Click **Create a new organization**.

    {% endlist %}

If you want to allocate isolated resources to a user within an organization:

1. [Create a cloud](../../resource-manager/operations/cloud/create.md) named `testing` in `Example organization`.

1. [Create a folder](../../resource-manager/operations/folder/create.md) named `test-folder` in the `testing` cloud.

If the user does not need isolated resources, you can grant them access to existing clouds and folders, e.g., the default ones.

## Invite the user to the organization and assign roles {#add-account}

{% note tip %}

To make sure the user gets all required permissions the first time they log in, assign roles immediately after sending the invitation. Once the invitation is accepted, you will be able to assign more roles or revoke those already assigned.

{% endnote %}

### Send an invitation to the user {#send-invitation}

For the user to access Yandex Cloud resources, invite them to the organization you created:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Go to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![icon-users](../../_assets/console-icons/person.svg) **Users**.
    1. In the top-right corner, click ![person-plus](../../_assets/console-icons/person-plus.svg) **Add user** and select ![person-planet-earth](../../_assets/console-icons/person-planet-earth.svg) **Invite users with a Yandex account**.
    1. Enter the user's email.

        You can send invitations to any email address. Invited users will be able to select the appropriate Yandex account once they accept the invitation.
    1. Click **Send invitation**.

{% endlist %}

### Assign the user a role for a cloud {#add-cloud-role}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), [select](../../resource-manager/operations/cloud/switch-cloud.md) the `testing` cloud.
    1. Navigate to the **Access bindings** tab.
    1. Click **Configure access**.
    1. In the window that opens, select **Invitee accounts**.
    1. Select a user from the list or use the user search option.
    1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select the `resource-manager.clouds.member` role.
    1. Click **Save**.

{% endlist %}

### Assign the user a role for the folder {#add-folder-role}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), navigate to `test-folder`.
    1. Navigate to the **Access bindings** tab.
    1. Click **Configure access**.
    1. In the window that opens, select **Invitee accounts**.
    1. Select a user from the list or use the user search option.
    1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select the `compute.editor` role.

       {% note tip %}

       You can also assign other roles depending on the actions you want to allow on folder resources. For the full list of roles, see the [Yandex Identity and Access Management](../../iam/roles-reference.md) documentation.

       {% endnote %}

    1. Click **Save**.

{% endlist %}

Then instruct the user to complete [these steps](#user-actions).


## User actions {#user-actions}


{% note info %}

For detailed user instructions on first-time login and account management, see [Managing a user account](../../organization/operations/user-account/index.md).

{% endnote %}


### Accept the invitation to the organization {#accept-invitation}

1. In the invitation email, click **Accept invitation**.
1. On the page that opens, click **Accept**.
1. Select an account to log in.

You now have access to `Example organization` and its resources.


For more on first-time login for different user types, see [First-time login to the console](../../organization/operations/user-account/first-login.md).


### Check access to the cloud {#cloud-access-user-action}

{% list tabs group=instructions %}

- Management console {#console}

  1. Go to the [management console](https://console.yandex.cloud) and click your profile image in the left-hand panel.
  1. Select `Example organization`.
  1. In the left-hand panel, select the `testing` cloud. You will see the list of cloud folders.

     This means you have access to the `testing` cloud.

{% endlist %}

### Check access to the folder {#catalog-access-user-action}

Make sure you have access to `test-folder`. Once you open the folder, create a VM in it:

{% list tabs group=instructions %}

- Management console {#console}

  1. Go to the [management console](https://console.yandex.cloud) and click your profile image in the left-hand panel.
  1. Select `Example organization`.
  1. In the left-hand panel, select `test-folder`.
  1. Navigate to **Compute Cloud**.
  1. Select ![image](../../_assets/console-icons/server.svg) **Virtual machines**.
  1. Click **Create virtual machine** and set the VM parameters:

     1. Under **Operating systems and products**, select **Ubuntu 24.04 LTS**.
     1. Under **Computing resources**, specify the computing resource configuration for the VM.
     1. Under **Disks**, specify the size and type of the disk.
     1. Enter the **VM name**.
     1. Set the **Login** of the VM administrator.
     1. In the **SSH key** field, click **Add key**. In the window that opens:
        1. Enter a **Name** for the SSH key.
        1. Under **SSH key**, select **Enter manually**, then upload or paste the contents of the public SSH key. You need to [create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) a key pair for the [SSH](https://en.wikipedia.org/wiki/Secure_Shell) connection to the VM on your own.
        1. Click **Add**.

           The system will add the SSH key to your organization user profile.

           If, due to organization restrictions, you cannot add SSH keys to your user profile, the system will save the key to the VM user profile.
     1. Click **Create VM**.

{% endlist %}

If the VM is created successfully, you can access the cloud and use Compute Cloud resources. Report this to the administrator.

## Delete the resources you created {#clear-out}

If the user no longer needs the VM they created, [delete it](../../compute/operations/vm-control/vm-delete.md) to avoid paying the fee.