Organizations: add IdP federation, remove Enterprise-only badge, fix sub-org nesting depth

src/content/docs/fundamentals/organizations/for-enterprise.mdx

@@ -158,6 +158,8 @@ All users who will be Organization members must have [two-factor authentication
 
 Organizations allows you to share WAF custom rulesets and Zero Trust Gateway policies (DNS, Network, HTTP, Resolver) across accounts in your Organization. Shared policies are read-only in receiving accounts and automatically stay in sync when updated in the source account.
 
+Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization.
+
 For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/).
 
 :::note

src/content/docs/fundamentals/organizations/for-mssp-distributors.mdx

@@ -32,24 +32,28 @@ MSSP/Distributor Organizations use a **multi-tier structure**:
 ```
 Distributor Organization
 ├── MSSP Organization A
-│   ├── Customer Account 1
-│   │   ├── Zone A
-│   │   └── Zone B
-│   └── Customer Account 2
-│       └── Zone C
+│   ├── Sub-Organization A1
+│   │   ├── Customer Account 1
+│   │   │   ├── Zone A
+│   │   │   └── Zone B
+│   │   └── Customer Account 2
+│   │       └── Zone C
+│   └── Customer Account 3
+│       └── Zone D
 ├── MSSP Organization B
-│   ├── Customer Account 3
-│   │   └── Zone D
-│   └── Customer Account 4
-│       ├── Zone E
+│   ├── Customer Account 4
+│   │   └── Zone E
+│   └── Customer Account 5
 │       └── Zone F
 └── MSSP Organization C
-    └── Customer Account 5
-        └── Zone G
+    └── Sub-Organization C1
+        └── Customer Account 6
+            └── Zone G
 ```
 
 **Key characteristics:**
 - Distributors create and manage child MSSP Organizations
+- MSSP Organizations can create up to 5 levels of nested sub-organizations
 - Each MSSP Organization manages its own customer accounts
 - MSSP Organization members have [implicit access](#implicit-access) to their customer accounts
 - Accounts can be moved between MSSP Organizations
@@ -165,6 +169,8 @@ Organizations allows you to share WAF custom rulesets and Zero Trust Gateway pol
 
 For Distributor Organizations, policies can be shared across MSSP Organization boundaries within the same Distributor Organization.
 
+Organizations also supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization.
+
 For detailed instructions, refer to [Policy sharing](/fundamentals/organizations/policy-sharing/).
 
 :::note
@@ -234,6 +240,3 @@ If you encounter errors during setup or management, refer to [Troubleshooting](/
 
 ### Assign existing accounts
 MSSP/Distributor Organizations cannot assign existing accounts. Use account creation to add new accounts to your Organization.
-
-### Create nested sub-organizations
-MSSP Organizations cannot create their own child Organizations. The hierarchy is limited to two tiers: Distributor → MSSP Organizations.

src/content/docs/fundamentals/organizations/index.mdx

@@ -10,9 +10,7 @@ products:
   - fundamentals
 ---
 
-import { DirectoryListing, Plan } from "~/components";
-
-<Plan type="enterprise" />
+import { DirectoryListing } from "~/components";
 
 An Organization is a top-level container in Cloudflare for managing multiple accounts. It allows administrators to govern accounts, members, and resources from a single location rather than managing each account individually. Organization Super Administrators have implicit access to all accounts within the Organization. This means they do not need explicit membership on each account.
 
@@ -52,25 +50,31 @@ Organization
 ```
 Distributor Organization
 ├── MSSP Organization A
-│   ├── Customer Account 1
-│   │   ├── Zone A
-│   │   └── Zone B
-│   └── Customer Account 2
-│       └── Zone C
+│   ├── Sub-Organization A1
+│   │   ├── Customer Account 1
+│   │   │   ├── Zone A
+│   │   │   └── Zone B
+│   │   └── Customer Account 2
+│   │       └── Zone C
+│   └── Customer Account 3
+│       └── Zone D
 └── MSSP Organization B
-    ├── Customer Account 3
-    │   └── Zone D
-    └── Customer Account 4
-        └── Zone E
+    ├── Customer Account 4
+    │   └── Zone E
+    └── Customer Account 5
+        └── Zone F
 ```
 
+MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations.
+
 ## Core features
 
 - **Centralized account management**: Manage all accounts from a single dashboard.
 - **Implicit access**: Organization Super Administrators can access any account in the Organization without requiring explicit per-account membership.
 - **Aggregate analytics**: View, filter, and download aggregate HTTP analytics across all Organization child accounts.
 - **Organization-level membership**: Invite members to the Organization once, granting them access to all child accounts.
 - **WAF and Gateway policy sharing**: Create security policies once and share them across accounts in your Organization.
+- **IdP federation**: Share a single identity provider configuration across all accounts in your Organization. Refer to [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/) for setup details.
 - **API, SDK, and Terraform support**: Manage Organizations programmatically with the [Cloudflare Organizations API](/api/resources/organizations/), SDKs, or Terraform provider.
 - **Enhanced account switcher**: Navigate between accounts with an Organization-aware account switcher in the dashboard.
 

src/content/docs/fundamentals/organizations/limitations.mdx

@@ -40,7 +40,7 @@ Each Organization supports a maximum of **500 accounts** and **5,000 zones**. Th
 | Organization creation | MSSP/Distributor Organizations are created by Cloudflare. Contact your account team to set up your Organization. |
 | Adding existing accounts | Assigning existing accounts is not available for MSSP/Distributor Organizations. Use account creation to add new accounts. |
 | Account creation | MSSP Organizations can self-serve create new customer accounts within their Organization. |
-| Sub-Organizations | Distributors can create child MSSP Organizations. MSSP Organizations cannot create their own child Organizations — the hierarchy is limited to two tiers: Distributor → MSSP Organizations. |
+| Sub-Organizations | Distributors can create child MSSP Organizations. MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations. |
 | Moving accounts | Accounts can be moved between MSSP Organizations within the same Distributor Organization. |
 | Roles | Organization Super Administrator is the only role available. Additional roles (read-only, billing, audit log) will be available in a future release. |
 | Organization deletion | To delete an Organization, use the [API](/api/resources/organizations/methods/delete). Dashboard support is not yet available. |

src/content/docs/fundamentals/organizations/policy-sharing.mdx

@@ -18,6 +18,8 @@ Organizations allows you to create security policies in one account and share th
 
 Policy sharing works the same way for both [Enterprise](/fundamentals/organizations/for-enterprise/) and [MSSP/Distributor](/fundamentals/organizations/for-mssp-distributors/) Organizations.
 
+In addition to WAF and Gateway policies, Organizations supports [IdP federation](/cloudflare-one/integrations/identity-providers/idp-federation/), which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization.
+
 ## Prerequisites
 
 Policy sharing requires the appropriate product entitlements on the accounts involved. Organizations does not grant access to WAF or Gateway features — your accounts must already have the required SKUs.