Organizations

Use an organization to group CDF projects and facilitate their management. An organization contains users, projects, and potentially other organizations. Users enter the organization ID when logging into Cognite apps, such as Cognite Data Fusion. Each organization has one IdP configuration used for both interactive login and service account authentication across all projects in the organization.

​

External identity providers (IdP)

CDF supports interfacing with external IdPs to manage users and groups. The following vendors are supported:

• Microsoft Entra ID (formerly known as Azure AD or Azure Active Directory)
• Auth0
• Keycloak

​

Users

If a user can log into the external IdP configured for the organization, they have access to the CDF organization. Project access settings determine which of the organization’s projects a user can access and what actions they can perform. After a user logs into the organization for the first time, they appear in the organization’s user list. Users can see each other, enabling collaboration on projects.

​

Organization hierarchy

An organization can have child organizations. The ownership relationship is materialized through the parentId field of the organization resource.

​

Projects

An organization holds CDF projects. Users logged into the organization can see all projects in the organization. However, the project’s access control lists (ACLs) and other access control settings control what actions users can perform within each project.

​

Create a child organization

You can create a child organization when you are an admin of the parent, or of an ancestor, and adminsCanCreateOrgsInSubtree is true on that organization. Listing children requires the same admin access and does not require the flag. For org-a → org-b → org-c, an admin of org-a, org-b, or org-c can create a child of org-c when the flag is set on the organization where that admin right applies.

​

Delete an organization

Delete locks users out immediately, including you. The organization must have no child organizations and no projects. Delete is reversible through Cognite Support. An admin of the organization or of an ancestor can delete it.

​

Allowed clusters

An organization has a list of clusters where it can hold projects. This is defined in the allowedClusters field on the resource. Replacing the list overwrites the current set. The new set must be a subset of the parent organization’s allowed clusters. The call fails if the organization still has a project on a cluster you remove. Removing a cluster also removes it from every descendant. Adding a cluster does not add it to descendants. Changing allowed clusters for an organization requires an admin of an ancestor. An admin of that organization alone cannot change the list. This operation is alpha-only.

​

Organization admins

An organization can have admins, who are identified principals authorized to perform an extended set of modifications on the organization, such as creating projects or changing admins. Admins are identified by the adminGroupId field on the organization resource, which is the ID of a group managed in the external IdP. Different organization API endpoints have specific access rules documented under each endpoint. Generally, organization admins control most aspects of the organization itself and have full control over any sub-organizations.

​

Admin group

adminGroupId is the external identity provider group that contains the organization admins. If you set a group you are not in, you lose admin access immediately. An admin of the organization or of an ancestor can change it. This operation is alpha-only.

​

Subtree permissions

adminsCanCreateOrgsInSubtree and adminsCanCreateProjectsInSubtree allow or block admins from creating child organizations or projects anywhere under that organization. Only an admin of an ancestor can change these flags. An admin of the organization itself cannot. These operations are alpha-only.

​

Identity provider configuration

Updating the IdP configuration logs out every current principal and invalidates every token, including yours. If you change the IdP of the organization that issued your token, the admin group ID usually does not match a group in the new IdP. Contact Cognite Support before you change the IdP of your own organization. An admin of the organization or of an ancestor can update it. This operation is alpha-only.

​

Authentication for this API

Organizations are global and not tied to specific projects or clusters. Direct API requests against organizations to auth.cognite.com instead of a specific cluster and projects used for other resources. The organizations API accepts only OAuth tokens issued by https://auth.cognite.com (such as those issued when logging into Fusion). You can also obtain a token by initiating a login flow against the authorization server directly. See the “Authorizations” sections for more information.