From c0ee298a0144597fd73db4a4585f6ab18ba8e207 Mon Sep 17 00:00:00 2001 From: katie Date: Tue, 14 Jul 2026 14:44:03 -0400 Subject: [PATCH 1/3] Organizations: add IdP federation, remove Enterprise-only badge, fix sub-org nesting depth - Remove badge from index.mdx (Orgs supports both Enterprise and MSSP/Distributor) - Add IdP federation bullet to Core features list on index.mdx - Add IdP federation paragraph to policy-sharing.mdx intro - Add IdP federation to Share policies section on for-enterprise.mdx and for-mssp-distributors.mdx - Fix sub-org nesting depth from 2 tiers to 5 levels on for-mssp-distributors.mdx and limitations.mdx --- .../docs/fundamentals/organizations/for-enterprise.mdx | 2 ++ .../fundamentals/organizations/for-mssp-distributors.mdx | 6 ++++-- src/content/docs/fundamentals/organizations/index.mdx | 5 ++--- src/content/docs/fundamentals/organizations/limitations.mdx | 2 +- .../docs/fundamentals/organizations/policy-sharing.mdx | 2 ++ 5 files changed, 11 insertions(+), 6 deletions(-) diff --git a/src/content/docs/fundamentals/organizations/for-enterprise.mdx b/src/content/docs/fundamentals/organizations/for-enterprise.mdx index 7e5de2dbac0..4392519811c 100644 --- a/src/content/docs/fundamentals/organizations/for-enterprise.mdx +++ b/src/content/docs/fundamentals/organizations/for-enterprise.mdx @@ -158,6 +158,8 @@ All users who will be Organization members must have [two-factor authentication Organizations allows you to share WAF custom rulesets and Zero Trust Gateway policies (DNS, Network, HTTP, Resolver) across accounts in your Organization. Shared policies are read-only in receiving accounts and automatically stay in sync when updated in the source account. +Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically managed as accounts join or leave your Organization. + For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/). :::note diff --git a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx index d08f9c4e4ee..c03381dba02 100644 --- a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx +++ b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx @@ -165,6 +165,8 @@ Organizations allows you to share WAF custom rulesets and Zero Trust Gateway pol For Distributor Organizations, policies can be shared across MSSP Organization boundaries within the same Distributor Organization. +Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically managed as accounts join or leave your Organization. + For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/). :::note @@ -235,5 +237,5 @@ If you encounter errors during setup or management, refer to [Troubleshooting](/ ### Assign existing accounts MSSP/Distributor Organizations cannot assign existing accounts. Use account creation to add new accounts to your Organization. -### Create nested sub-organizations -MSSP Organizations cannot create their own child Organizations. The hierarchy is limited to two tiers: Distributor → MSSP Organizations. +### Nested sub-organizations +MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations. diff --git a/src/content/docs/fundamentals/organizations/index.mdx b/src/content/docs/fundamentals/organizations/index.mdx index 91dde46305f..6e9a7a410ff 100644 --- a/src/content/docs/fundamentals/organizations/index.mdx +++ b/src/content/docs/fundamentals/organizations/index.mdx @@ -10,9 +10,7 @@ products: - fundamentals --- -import { DirectoryListing, Plan } from "~/components"; - - +import { DirectoryListing } from "~/components"; An Organization is a top-level container in Cloudflare for managing multiple accounts. It allows administrators to govern accounts, members, and resources from a single location rather than managing each account individually. Organization Super Administrators have implicit access to all accounts within the Organization. This means they do not need explicit membership on each account. @@ -71,6 +69,7 @@ Distributor Organization - **Aggregate analytics**: View, filter, and download aggregate HTTP analytics across all Organization child accounts. - **Organization-level membership**: Invite members to the Organization once, granting them access to all child accounts. - **WAF and Gateway policy sharing**: Create security policies once and share them across accounts in your Organization. +- **IdP federation**: Share a single identity provider configuration across all accounts in your Organization. Refer to [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/) for setup details. - **API, SDK, and Terraform support**: Manage Organizations programmatically with the [Cloudflare Organizations API](/api/resources/organizations/), SDKs, or Terraform provider. - **Enhanced account switcher**: Navigate between accounts with an Organization-aware account switcher in the dashboard. diff --git a/src/content/docs/fundamentals/organizations/limitations.mdx b/src/content/docs/fundamentals/organizations/limitations.mdx index 4555dfd2a60..7df81bce564 100644 --- a/src/content/docs/fundamentals/organizations/limitations.mdx +++ b/src/content/docs/fundamentals/organizations/limitations.mdx @@ -40,7 +40,7 @@ Each Organization supports a maximum of **500 accounts** and **5,000 zones**. Th | Organization creation | MSSP/Distributor Organizations are created by Cloudflare. Contact your account team to set up your Organization. | | Adding existing accounts | Assigning existing accounts is not available for MSSP/Distributor Organizations. Use account creation to add new accounts. | | Account creation | MSSP Organizations can self-serve create new customer accounts within their Organization. | -| Sub-Organizations | Distributors can create child MSSP Organizations. MSSP Organizations cannot create their own child Organizations — the hierarchy is limited to two tiers: Distributor → MSSP Organizations. | +| Sub-Organizations | Distributors can create child MSSP Organizations. MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations. | | Moving accounts | Accounts can be moved between MSSP Organizations within the same Distributor Organization. | | Roles | Organization Super Administrator is the only role available. Additional roles (read-only, billing, audit log) will be available in a future release. | | Organization deletion | To delete an Organization, use the [API](/api/resources/organizations/methods/delete). Dashboard support is not yet available. | diff --git a/src/content/docs/fundamentals/organizations/policy-sharing.mdx b/src/content/docs/fundamentals/organizations/policy-sharing.mdx index ede466343a2..89221fd3b9a 100644 --- a/src/content/docs/fundamentals/organizations/policy-sharing.mdx +++ b/src/content/docs/fundamentals/organizations/policy-sharing.mdx @@ -18,6 +18,8 @@ Organizations allows you to create security policies in one account and share th Policy sharing works the same way for both [Enterprise](/fundamentals/organizations/for-enterprise/) and [MSSP/Distributor](/fundamentals/organizations/for-mssp-distributors/) Organizations. +In addition to WAF and Gateway policies, Organizations supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization. + ## Prerequisites Policy sharing requires the appropriate product entitlements on the accounts involved. Organizations does not grant access to WAF or Gateway features — your accounts must already have the required SKUs. From 2a4fc309e768c3025eb913ca65e848e330a551cd Mon Sep 17 00:00:00 2001 From: katie Date: Tue, 14 Jul 2026 14:47:31 -0400 Subject: [PATCH 2/3] Fix sub-org nesting: update hierarchy diagrams, move out of 'cannot do' section - Update MSSP hierarchy diagrams in index.mdx and for-mssp-distributors.mdx to show nested sub-organizations (3 tiers) - Add '5 levels of nested sub-organizations' note under the hierarchy diagram on index.mdx - Add nesting capability to Key characteristics on for-mssp-distributors.mdx - Remove 'Nested sub-organizations' from 'What you cannot do' section (it is a supported capability, not a limitation) --- .../organizations/for-mssp-distributors.mdx | 29 ++++++++++--------- .../docs/fundamentals/organizations/index.mdx | 23 +++++++++------ 2 files changed, 29 insertions(+), 23 deletions(-) diff --git a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx index c03381dba02..816a5c23199 100644 --- a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx +++ b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx @@ -32,24 +32,28 @@ MSSP/Distributor Organizations use a **multi-tier structure**: ``` Distributor Organization ├── MSSP Organization A -│ ├── Customer Account 1 -│ │ ├── Zone A -│ │ └── Zone B -│ └── Customer Account 2 -│ └── Zone C +│ ├── Sub-Organization A1 +│ │ ├── Customer Account 1 +│ │ │ ├── Zone A +│ │ │ └── Zone B +│ │ └── Customer Account 2 +│ │ └── Zone C +│ └── Customer Account 3 +│ └── Zone D ├── MSSP Organization B -│ ├── Customer Account 3 -│ │ └── Zone D -│ └── Customer Account 4 -│ ├── Zone E +│ ├── Customer Account 4 +│ │ └── Zone E +│ └── Customer Account 5 │ └── Zone F └── MSSP Organization C - └── Customer Account 5 - └── Zone G + └── Sub-Organization C1 + └── Customer Account 6 + └── Zone G ``` **Key characteristics:** - Distributors create and manage child MSSP Organizations +- MSSP Organizations can create up to 5 levels of nested sub-organizations - Each MSSP Organization manages its own customer accounts - MSSP Organization members have [implicit access](#implicit-access) to their customer accounts - Accounts can be moved between MSSP Organizations @@ -236,6 +240,3 @@ If you encounter errors during setup or management, refer to [Troubleshooting](/ ### Assign existing accounts MSSP/Distributor Organizations cannot assign existing accounts. Use account creation to add new accounts to your Organization. - -### Nested sub-organizations -MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations. diff --git a/src/content/docs/fundamentals/organizations/index.mdx b/src/content/docs/fundamentals/organizations/index.mdx index 6e9a7a410ff..395ad6bac6c 100644 --- a/src/content/docs/fundamentals/organizations/index.mdx +++ b/src/content/docs/fundamentals/organizations/index.mdx @@ -50,18 +50,23 @@ Organization ``` Distributor Organization ├── MSSP Organization A -│ ├── Customer Account 1 -│ │ ├── Zone A -│ │ └── Zone B -│ └── Customer Account 2 -│ └── Zone C +│ ├── Sub-Organization A1 +│ │ ├── Customer Account 1 +│ │ │ ├── Zone A +│ │ │ └── Zone B +│ │ └── Customer Account 2 +│ │ └── Zone C +│ └── Customer Account 3 +│ └── Zone D └── MSSP Organization B - ├── Customer Account 3 - │ └── Zone D - └── Customer Account 4 - └── Zone E + ├── Customer Account 4 + │ └── Zone E + └── Customer Account 5 + └── Zone F ``` +MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations. + ## Core features - **Centralized account management**: Manage all accounts from a single dashboard. From 5bb39e15f00e829e5cb528d9f168e4794985e432 Mon Sep 17 00:00:00 2001 From: katie Date: Tue, 14 Jul 2026 14:52:23 -0400 Subject: [PATCH 3/3] Align IdP federation wording across all three pages Standardize on 'automatically provisioned or removed as accounts join or leave the Organization' (matching policy-sharing.mdx) instead of the slightly different phrasing used on for-enterprise.mdx and for-mssp-distributors.mdx. --- src/content/docs/fundamentals/organizations/for-enterprise.mdx | 2 +- .../docs/fundamentals/organizations/for-mssp-distributors.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/docs/fundamentals/organizations/for-enterprise.mdx b/src/content/docs/fundamentals/organizations/for-enterprise.mdx index 4392519811c..fe70af50035 100644 --- a/src/content/docs/fundamentals/organizations/for-enterprise.mdx +++ b/src/content/docs/fundamentals/organizations/for-enterprise.mdx @@ -158,7 +158,7 @@ All users who will be Organization members must have [two-factor authentication Organizations allows you to share WAF custom rulesets and Zero Trust Gateway policies (DNS, Network, HTTP, Resolver) across accounts in your Organization. Shared policies are read-only in receiving accounts and automatically stay in sync when updated in the source account. -Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically managed as accounts join or leave your Organization. +Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization. For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/). diff --git a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx index 816a5c23199..91cbaebab43 100644 --- a/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx +++ b/src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx @@ -169,7 +169,7 @@ Organizations allows you to share WAF custom rulesets and Zero Trust Gateway pol For Distributor Organizations, policies can be shared across MSSP Organization boundaries within the same Distributor Organization. -Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically managed as accounts join or leave your Organization. +Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization. For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/).