Inviting a new user and assigning roles

This tutorial will instruct you how to invite a new Yandex account user to your organization and grant them permissions to create a VM in a folder. The tutorial includes instructions for both the administrator and the user. For the steps the user must complete, see User actions.

To invite a user to your organization and grant them access to a folder and other resources:

1. Prepare Yandex Cloud.
2. Set up your infrastructure.
3. Invite the user to the organization and assign roles.
4. Make sure the user has accepted the invitation and can access the resources.

If you no longer need the paid resources you created, delete them.

Required paid resourcesRequired paid resources

The cost of infrastructure support includes fees for computing resources, OS, storage, amount of outgoing traffic, and VM public IP address (see Yandex Compute Cloud pricing).

Prepare Yandex CloudPrepare Yandex Cloud

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

Prepare your infrastructurePrepare your infrastructure

Organization is a workspace that consolidates various types of Yandex Cloud resources and users. Any Yandex user can create an organization in Yandex Identity Hub. After you create an organization, you become its owner and can manage its settings.

To create an organization, follow these steps:

1. Go to Yandex Identity Hub.

   Your next steps will depend on whether you are a member of any organization in Yandex Identity Hub.

2. Create an organization:

   You are not a member of an organization

   If you are a member of an organization

   If you are not yet a member of an organization in Yandex Identity Hub, when clicking the link, you will be prompted to create a new organization:

   1. Enter your organization name, e.g., Example organization.
   2. Click Create a new organization.

   If you are currently a member of an organization in Yandex Identity Hub, when clicking the link, you will see the Yandex Identity Hub interface in Cloud Center.

   To avoid tampering with the infrastructure in existing organizations, create a new organization:

   1. In the top-left corner, next to the organization name, click and select Create organization.
   2. In the window that opens, enter a name for the organization: Example organization.
   3. Click Create a new organization.

If you want to allocate isolated resources to a user within an organization:

1. Create a cloud named testing in Example organization.

2. Create a folder named test-folder in the testing cloud.

If the user does not need isolated resources, you can grant them access to existing clouds and folders, e.g., the default ones.

Invite the user to the organization and assign rolesInvite the user to the organization and assign roles

To provide users with access to cloud resources from the management console, assign them the resource-manager.clouds.member role for the testing cloud. To enable users to manage VMs, assign them the compute.editor role for the test-folder folder.

Assign to the user a role for a cloudAssign to the user a role for a cloud

The user needs this role to access resources in this cloud in the management console.

Assign the user a role for the folderAssign the user a role for the folder

{% note tip %}

You can also assign other roles depending on the actions you want to allow on folder resources. For the full list of roles, see the [Yandex Identity and Access Management](../../iam/roles-reference.md) documentation.

{% endnote %}

Then instruct the user to complete these steps.

To assign additional roles or revoke existing ones, use the guides in Setting up cloud access permissions and Setting up folder access permissions.

User actionsUser actions

Accept the invitation to the organizationAccept the invitation to the organization

1. In the invitation email, click Accept invitation.
2. On the page that opens, click Accept.
3. Select an account to log in.

You now have access to Example organization and its resources.

For more on first-time login for different user types, see First-time login to the console.

Check access to the cloudCheck access to the cloud

Check access to the folderCheck access to the folder

Make sure you have access to test-folder. Once you open the folder, create a VM in it:

If the VM is created successfully, you can access the cloud and use Compute Cloud resources. Report this to the administrator.

Delete the resources you createdDelete the resources you created

If the user no longer needs the VM they created, delete it to avoid paying the fee.