Account administrator
You run an account: you open and close its tenants, give its people roles and publishing rights, and keep an eye on its policy and configuration.
The account administrator runs an organization's account. You open, suspend or close tenants; you give roles in the account's own scope; you decide who can publish (builder).
The account sits between the platform and its tenants. You can tighten the floors that come from the platform but you cannot relax them; a role you give in the account also works in the account's tenants. For teams, your package includes only reading (team.read): creating a team and placing people in it is the job of that tenant's own administrator.
Before you can give someone anything in the account, they must be a member of one of the account's tenants. Account configuration is read-only today; values are written in a tenant scope.
Start here
- On the Account Administration screen, see the account's tenants, open a new tenant, suspend one or close one.
- Give someone a role in the account's own scope; the person must already be a member of one of the account's tenants.
- On the account people screen, give someone publishing rights (builder) or take them back.
- In the account's policy, read the floors coming from the platform side by side with the account's own values.
- See on the Configuration screen whether a setting comes from the account or from the Platform.
Getting started
Concepts
- ConceptPlatform, account and tenant
- ConceptCapability, solution and activation: a capability's path
- ConceptRoles, permission keys and why an action was refused
- ConceptHow policy and configuration flow down: inheritance and floors
- ConceptParts of the console: menu, scope switcher, ⌘K, account menu and Help
- ConceptThe four states a screen can show
My account and security
Studio
Applications and data
Platform governance
Account governance
Audit
When things go wrong
- CaseA section is in the menu but opens locked
- CaseA button is disabled, or was refused when pressed
- CaseThe value I wrote in the tenant was refused: the higher scope's floor
- CaseI signed in but no area opens
- CaseThe screen says “This screen works in a tenant scope”
- CaseI can't revoke someone's permission here
- CaseI tried to give a role and it said “not a member”
- CaseI have `config.write` but I can't change the configuration
Troubleshooting
- Troubleshooting“You don't have access to this surface”
- Troubleshooting`NOT_PERMITTED: … default_deny_no_matching_rule`
- Troubleshooting“… cannot be weaker than the scope above's value”
- TroubleshootingErrors when granting or revoking a role
- Troubleshooting“This screen works in a tenant scope” and similar
- TroubleshootingSession and sign-in errors
