Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Getting started with IAM

Written by
Updated at October 29, 2026
View in Markdown

To get started with IAM, add a user to your organization and grant them access to a resource in one of your clouds. Learn more about organizations, resources, and users.

Getting started

  1. Log in to the management console. If you have not signed up yet, navigate to the management console and follow the on-screen instructions.

  2. Make sure that you have the required roles:

    1. In the management console, click or in the top panel and select the cloud.

    2. Navigate to the Access bindings tab.

    3. Specify your account in the search bar.

    4. Check that your account has the following roles:

      • Organization owner (organization-manager.organizations.owner) or administrator (organization-manager.admin)
      • Cloud owner (resource-manager.clouds.owner) or administrator (admin)

  3. On the Yandex Cloud Billing page, make sure you have an ACTIVE or TRIAL_ACTIVE billing account. If you do not have a billing account yet, create one.

  4. If you do not have any users to add to the cloud, you can create a new Yandex account and grant this account access to the cloud.

Add users with a Yandex account to your organization and assign them roles

  1. Log in to the cloud administrator account.

  2. In the management console, click or in the top panel and select the cloud.

  3. Navigate to the Access bindings tab.

  4. In the top-right corner, click and select Invite users.

  5. Enter the email addresses of the users you want to invite to the organization (e.g., login@yandex.com).

    You can send invitations to any email address. Invited users will be able to select the appropriate Yandex account once they accept the invitation.

  6. To send an invitation, click Next. This will open the window for assigning roles and adding users to the group.

  7. To assign roles for resources:

    1. Select Assign roles.
    2. In the Resource field, specify a resource to assign a role for.
    3. Click Add role and select the required role from the list. To assign users multiple roles for the same resource, repeat this step.
    4. To assign roles for another resource, click Add resource and role and repeat the previous steps.

    For example, to grant users access to viewing cloud resources in the management console, select the relevant cloud in the Resource field and specify the resource-manager.viewer role when assigning roles.

    To manage a folder, select the relevant folder in the Resource field and specify the resource-manager.editor role when assigning roles.

  8. To add users to a group:

    1. Click Add to group.
    2. Select the group from the drop-down list.

  9. Click Save.

The user will be able to log in to the organization upon accepting the invitation via the emailed link and selecting an account for log-in. To access the services enabled for the organization, the users you invited simply need to log in to their Yandex account.

Revoke assigned roles

If the assigned roles are no longer needed, revoke them:

  • To revoke a role only in the folder:

    1. In the management console, click or in the top panel and select the folder.
    2. Navigate to the Access bindings tab.
    3. Select a user from the list and click next to the username.
    4. Click Edit roles.
    5. Click next to the role to revoke.
    6. Click Save.

  • To revoke a role in the cloud:

    1. In the management console, click or in the top panel and select the cloud.
    2. Navigate to the Access bindings tab.
    3. Select a user from the list and click next to the username.
    4. Click Edit roles.
    5. Click next to the role to revoke.
    6. Click Save.

What's next

Previous
Overview
Next
How to work with service accounts