Organizations
Organizations list
Section titled “Organizations list”The organizations page (/organizations) shows all organizations in your tenant. From here you can create new organizations or open an existing one.
Organization detail
Section titled “Organization detail”The organization detail page (/organizations/[orgId]) shows:
- Organization name and metadata
- Member list with roles
- Pending invitations
- Provider-specific settings
Create organization
Section titled “Create organization”From the organizations list, click Create organization. Provide a name and optional metadata. On the Team plan, only one organization is allowed — the create button is disabled once the limit is reached.
Provider implementation
Section titled “Provider implementation”| Provider | Implementation |
|---|---|
| Auth0 | Native Auth0 organizations |
Roles and permissions
Section titled “Roles and permissions”Access is checked on the server for every action, based on your role in the active AUMS organization. Instance admins can do everything.
| Action | Member | Admin | Owner |
|---|---|---|---|
| View users, organizations, audit logs | ✅ | ✅ | ✅ |
| Create and edit users, block and unblock | ❌ | ✅ | ✅ |
| Create and edit organizations, invitations | ❌ | ✅ | ✅ |
| Delete users and organizations | ❌ | ❌ | ✅ |
| Change provider settings | ❌ | ❌ | ✅ |
On the Lite plan there are no organizations: every signed-in user has full access, so restrict who can sign in with your OIDC provider or the allowed email list.
Data isolation
Section titled “Data isolation”One AUMS deployment manages one identity provider tenant (one Auth0 tenant, Keycloak realm, Cognito user pool, Entra tenant, and so on). AUMS organizations are teams of admins sharing that deployment: they are not isolated from each other.
- Users: every AUMS organization sees the whole user directory, except with Auth0, where an organization’s connection setting limits its admins to users of that connection (listing, viewing, editing, deleting and sessions).
- Provider organizations: not scoped. Admins with organization permissions can manage every organization in the provider tenant.
- Admin actions audit trail: scoped. Organization members only see actions made within their active organization.
Changes to unscoped records. While more than one AUMS organization exists, only instance admins can create, edit, block or delete users and provider organizations that aren’t separated per organization. Organization owners and admins keep read access. For users, an organization counts as separated only with Auth0 and its own connection setting. With a single organization, roles apply as described above.
To isolate customers or business units from each other, run one AUMS deployment per provider tenant (or, with Auth0, per connection).