awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update docs to be multi-product

Browse Source
This commit is contained in:
Tuan Dang
2025-08-04 16:58:00 +07:00
parent 55e5360dd4
commit 6dd639be60
32 changed files with 867 additions and 654 deletions
Download Patch File Download Diff File Expand all files Collapse all files

106
docs/documentation/platform/organization.mdx
View File

@@ -3,74 +3,94 @@ title: "Organizations"
description: "Learn more and understand the concept of Infisical organizations."
---
An Infisical organization is a set of [projects](./project) that use the same billing. Organizations allow one or more users to control billing and project permissions for all of the projects belonging to the organization. Each project belongs to an organization.
Infisical is structured around organizations and [projects](/documentation/platform/project).
## Organizations
An organization represents a company or high-level entity (e.g. Acme Corp) and acts as the root scope for managing members and machine identities, projects, usage and billing, global integrations and configuration (such as single sign-on, provisioning, etc), and more.
Within an organization, you can create any number of projects—each tied to a specific product type such as Secrets Management or PKI that determines the functionality available.
![organization](/images/platform/organization/organization.png)
## Projects
The **Projects** page is where you can view the projects that you have access to within your organization
as well as create a new project.
The _Projects_ tab shows a list of projects that you have access to.
![organization](../../images/platform/organization/organization-projects.png)
If you're an organization admin, you also have the option to view _All Projects_—a complete view of every project within the organization, including those you are not currently a member of— and gain access to any project.
## Settings
Admins can gain access to any project in the organization by opening the options menu (⋮) next to a project and selecting Access. This will add you to the project as an admin and allow full visibility and control.
The **Settings** page lets you manage information about your organization including:
![organization projects](/images/platform/organization/organization-projects.png)
- **Name**: The name of your organization.
- **Slug**: The slug of your organization.
- **Default Organization Member Role**: The role assigned to users when joining your organization unless otherwise specified.
- **Incident Contacts**: Emails that should be alerted if anything abnormal is detected within the organization.
- **Enabled Products**: Products which are enabled for your organization. This setting strictly affects the sidebar UI; disabling a product does not disable its API or routes.
## Roles and Access Control
![organization settings general](../../images/platform/organization/organization-settings-general.png)
The _Access Control_ tab lets you view and manage roles and permissions for users, machine identities, and groups across your organization.
- Security and Authentication: A set of setting to enforce or manage [SAML](/documentation/platform/sso/overview), [OIDC](/documentation/platform/sso/overview), [SCIM](/documentation/platform/scim/overview), [LDAP](/documentation/platform/ldap/overview), and other authentication configurations.
Users are invited to an organization and assigned organization-level roles such as `Admin` or `Member`. You can also define [custom roles](/documentation/platform/access-controls/role-based-access-controls#creating-custom-roles) at the organization level to fit your permission model.
![organization settings auth](../../images/platform/organization/organization-settings-auth.png)
![organization users](/images/platform/organization/organization-users.png)
<Tip>
You can adjust the maximum time a user token will remain valid for your organization. After this period, users will be required to re-authenticate. This helps improve security by enforcing regular sign-ins.
</Tip>
Infisical supports [user identities](/documentation/platform/identities/user-identities) (representing people) and [machine identities](/documentation/platform/identities/machine-identities) (representing services, CI/CD pipelines, or agents). The same roles and permissions can be applied to either type of identity.
## Access Control
To manage access at scale, Infisical also supports [user groups](/documentation/platform/groups) — roles assigned to a group apply to all of its members automatically.
The **Access Control** page is where you can manage identities (both people and machines) that are part of your organization.
You can add or remove additional members as well as modify their permissions.
Note that Infisical distinguishes between organization-level and project-level access control:
![organization members](../../images/platform/organization/organization-members.png)
![organization identities](../../images/platform/organization/organization-machine-identities.png)
- [Organization-level access control](/documentation/platform/access-controls/role-based-access-controls#organization-level-access-controls): Roles and permissions governing access to organization-level resources and controls such as billing, member management, and identity provider configuration.
- [Project-level access control](/documentation/platform/access-controls/role-based-access-controls#project-level-access-controls): Roles and permissions governing access to resources and workflows within a specific project (e.g., secrets, certificates, SSH hosts).
In the **Organization Roles** tab, you can edit current or create new custom roles for members within the organization.
![organization roles](/images/platform/organization/organization-roles.png)
To learn more about how permissions work in detail, refer to the [access control documentation](/documentation/platform/access-controls/overview).
<Info>
Note that Role-Based Access Management (RBAC) is partly a paid feature.
Infisical provides immutable roles like `admin`, `member`, etc.
at the organization and project level for free.
Infisical provides immutable roles such as `admin` and `member` for free.
If you're using Infisical Cloud, the ability to create custom roles is available under the **Pro Tier**.
If you're self-hosting Infisical, then you should contact sales@infisical.com to purchase an enterprise license to use it.
</Info>
![organization roles](../../images/platform/organization/organization-members-roles.png)
As you can see next, Infisical supports granular permissions that you can tailor to each role.
If you need certain members to only be able to access billing details, for example, then you can
assign them that permission only.
![organization role permissions](../../images/platform/organization/organization-members-roles-add-perm.png)
## Usage & Billing
The **Usage & Billing** page applies only to [Infisical Cloud](https://app.infisical.com) and is where you can
manage your plan and billing information.
The _Usage & Billing_ tab provides an overview of your organization's billing information and platform usage.
This includes the following items:
Infisical calculates usage at the organization level—aggregating activity across all projects and product types (e.g., Secrets Management, SSH, PKI). From this tab, you can track usage, view billing details, and manage your Infisical Cloud subscription.
- Current plan: The current plan information such as what tier your organization is on and what features/limits apply to this tier.
- Licenses: The license keys for self-hosted instances of Infisical (if applicable).
- Receipts: The receipts of monthly/annual invoices.
- Billing: The billing details of your organization including payment methods on file, tax IDs (if applicable), etc.
![organization billing](/images/platform/organization/organization-billing.png)
![organization usage and billing](../../images/platform/organization/organization-usage-billing.png)
## Audit Logs
Infisical provides a unified view of [audit logs](/documentation/platform/audit-logs) at the organization level. All platform activity—including secret access, certificate issuance, platform logins across the organization —is recorded and searchable in a central log view.
Audit logs are also viewable at the project level, where they are scoped to show only events relevant to that specific project. This allows project administrators to monitor activity and investigate changes without requiring organization-wide access.
## App Connections
Infisical supports [app connections](/integrations/app-connections/overview) — integrations configured at the organization level with third-party platforms such as AWS, GCP, GitHub, and many others.
Once configured, these connections can be reused across multiple projects as part of any feature that requires third-party integrations—such as [secret syncing](/integrations/secret-syncs/overview) or [dynamic credential generation](/documentation/platform/dynamic-secrets/overview).
![organization app connections](/images/platform/organization/organization-app-connections.png)
To learn more, refer to the [app connections documentation](/integrations/app-connections/overview).
## Organization Settings
The _Organization Settings_ tab lets you configure global behavior and security controls for the organization.
Key configuration areas include:
- General: Manage the organization’s name, slug, and default role for newly invited members.
- Single Sign-On (SSO): Enable [SAML](/documentation/platform/sso/overview), [LDAP](/documentation/platform/ldap/overview), or [OIDC-based](/documentation/platform/sso/general-oidc/overview) authentication for user login.
- Provisioning: Enable [SCIM](/documentation/platform/scim/overview) to automatically provision and deprovision users and groups from an identity provider.
- Security Policies: Enforce MFA and configure session duration limits.
- Encryption: Integrate with external KMS systems or bring your own encryption keys (BYOK).
- [Audit Log Streaming](/documentation/platform/audit-log-streams/audit-log-streams): Forward audit events to third-party logging tools like SIEMs or cloud storage.
- Workflow Integrations: Trigger [Slack](/documentation/platform/workflow-integrations/slack-integration) or [Microsoft Teams](/documentation/platform/workflow-integrations/microsoft-teams-integration) notifications for events like access requests.
- [Project Templates](/documentation/platform/project-templates): Define default environments, roles, and settings to standardize project creation.
- KMIP (Enterprise): Connect to KMIP-compatible HSMs for hardware-backed key storage and operations.
![organization settings](/images/platform/organization/organization-settings.png)