diff --git a/src/content/docs/fundamentals/organizations/for-enterprise.mdx b/src/content/docs/fundamentals/organizations/for-enterprise.mdx index 7e5de2dbac0..fe70af50035 100644 --- a/src/content/docs/fundamentals/organizations/for-enterprise.mdx +++ b/src/content/docs/fundamentals/organizations/for-enterprise.mdx @@ -158,6 +158,8 @@ All users who will be Organization members must have [two-factor authentication Organizations allows you to share WAF custom rulesets and Zero Trust Gateway policies (DNS, Network, HTTP, Resolver) across accounts in your Organization. Shared policies are read-only in receiving accounts and automatically stay in sync when updated in the source account. +Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization. + For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/). :::note diff --git a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx index d08f9c4e4ee..91cbaebab43 100644 --- a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx +++ b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx @@ -32,24 +32,28 @@ MSSP/Distributor Organizations use a **multi-tier structure**: ``` Distributor Organization ├── MSSP Organization A -│ ├── Customer Account 1 -│ │ ├── Zone A -│ │ └── Zone B -│ └── Customer Account 2 -│ └── Zone C +│ ├── Sub-Organization A1 +│ │ ├── Customer Account 1 +│ │ │ ├── Zone A +│ │ │ └── Zone B +│ │ └── Customer Account 2 +│ │ └── Zone C +│ └── Customer Account 3 +│ └── Zone D ├── MSSP Organization B -│ ├── Customer Account 3 -│ │ └── Zone D -│ └── Customer Account 4 -│ ├── Zone E +│ ├── Customer Account 4 +│ │ └── Zone E +│ └── Customer Account 5 │ └── Zone F └── MSSP Organization C - └── Customer Account 5 - └── Zone G + └── Sub-Organization C1 + └── Customer Account 6 + └── Zone G ``` **Key characteristics:** - Distributors create and manage child MSSP Organizations +- MSSP Organizations can create up to 5 levels of nested sub-organizations - Each MSSP Organization manages its own customer accounts - MSSP Organization members have [implicit access](#implicit-access) to their customer accounts - Accounts can be moved between MSSP Organizations @@ -165,6 +169,8 @@ Organizations allows you to share WAF custom rulesets and Zero Trust Gateway pol For Distributor Organizations, policies can be shared across MSSP Organization boundaries within the same Distributor Organization. +Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization. + For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/). :::note @@ -234,6 +240,3 @@ If you encounter errors during setup or management, refer to [Troubleshooting](/ ### Assign existing accounts MSSP/Distributor Organizations cannot assign existing accounts. Use account creation to add new accounts to your Organization. - -### Create nested sub-organizations -MSSP Organizations cannot create their own child Organizations. The hierarchy is limited to two tiers: Distributor → MSSP Organizations. diff --git a/src/content/docs/fundamentals/organizations/index.mdx b/src/content/docs/fundamentals/organizations/index.mdx index 91dde46305f..395ad6bac6c 100644 --- a/src/content/docs/fundamentals/organizations/index.mdx +++ b/src/content/docs/fundamentals/organizations/index.mdx @@ -10,9 +10,7 @@ products: - fundamentals --- -import { DirectoryListing, Plan } from "~/components"; - - +import { DirectoryListing } from "~/components"; An Organization is a top-level container in Cloudflare for managing multiple accounts. It allows administrators to govern accounts, members, and resources from a single location rather than managing each account individually. Organization Super Administrators have implicit access to all accounts within the Organization. This means they do not need explicit membership on each account. @@ -52,18 +50,23 @@ Organization ``` Distributor Organization ├── MSSP Organization A -│ ├── Customer Account 1 -│ │ ├── Zone A -│ │ └── Zone B -│ └── Customer Account 2 -│ └── Zone C +│ ├── Sub-Organization A1 +│ │ ├── Customer Account 1 +│ │ │ ├── Zone A +│ │ │ └── Zone B +│ │ └── Customer Account 2 +│ │ └── Zone C +│ └── Customer Account 3 +│ └── Zone D └── MSSP Organization B - ├── Customer Account 3 - │ └── Zone D - └── Customer Account 4 - └── Zone E + ├── Customer Account 4 + │ └── Zone E + └── Customer Account 5 + └── Zone F ``` +MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations. + ## Core features - **Centralized account management**: Manage all accounts from a single dashboard. @@ -71,6 +74,7 @@ Distributor Organization - **Aggregate analytics**: View, filter, and download aggregate HTTP analytics across all Organization child accounts. - **Organization-level membership**: Invite members to the Organization once, granting them access to all child accounts. - **WAF and Gateway policy sharing**: Create security policies once and share them across accounts in your Organization. +- **IdP federation**: Share a single identity provider configuration across all accounts in your Organization. Refer to [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/) for setup details. - **API, SDK, and Terraform support**: Manage Organizations programmatically with the [Cloudflare Organizations API](/api/resources/organizations/), SDKs, or Terraform provider. - **Enhanced account switcher**: Navigate between accounts with an Organization-aware account switcher in the dashboard. diff --git a/src/content/docs/fundamentals/organizations/limitations.mdx b/src/content/docs/fundamentals/organizations/limitations.mdx index 4555dfd2a60..7df81bce564 100644 --- a/src/content/docs/fundamentals/organizations/limitations.mdx +++ b/src/content/docs/fundamentals/organizations/limitations.mdx @@ -40,7 +40,7 @@ Each Organization supports a maximum of **500 accounts** and **5,000 zones**. Th | Organization creation | MSSP/Distributor Organizations are created by Cloudflare. Contact your account team to set up your Organization. | | Adding existing accounts | Assigning existing accounts is not available for MSSP/Distributor Organizations. Use account creation to add new accounts. | | Account creation | MSSP Organizations can self-serve create new customer accounts within their Organization. | -| Sub-Organizations | Distributors can create child MSSP Organizations. MSSP Organizations cannot create their own child Organizations — the hierarchy is limited to two tiers: Distributor → MSSP Organizations. | +| Sub-Organizations | Distributors can create child MSSP Organizations. MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations. | | Moving accounts | Accounts can be moved between MSSP Organizations within the same Distributor Organization. | | Roles | Organization Super Administrator is the only role available. Additional roles (read-only, billing, audit log) will be available in a future release. | | Organization deletion | To delete an Organization, use the [API](/api/resources/organizations/methods/delete). Dashboard support is not yet available. | diff --git a/src/content/docs/fundamentals/organizations/policy-sharing.mdx b/src/content/docs/fundamentals/organizations/policy-sharing.mdx index ede466343a2..89221fd3b9a 100644 --- a/src/content/docs/fundamentals/organizations/policy-sharing.mdx +++ b/src/content/docs/fundamentals/organizations/policy-sharing.mdx @@ -18,6 +18,8 @@ Organizations allows you to create security policies in one account and share th Policy sharing works the same way for both [Enterprise](/fundamentals/organizations/for-enterprise/) and [MSSP/Distributor](/fundamentals/organizations/for-mssp-distributors/) Organizations. +In addition to WAF and Gateway policies, Organizations supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization. + ## Prerequisites Policy sharing requires the appropriate product entitlements on the accounts involved. Organizations does not grant access to WAF or Gateway features — your accounts must already have the required SKUs.