Invite and manage members
Invite people to your organization with a role and a scope, manage pending invitations, and deactivate or remove members who no longer need access.
Invite people to your organization by email. When you invite someone, you choose the role they get and where it applies: the whole subscription, or the current project. They set their own password from the invitation link before they sign in for the first time.
Before you begin
- To invite and manage members, you need the Owner role, or a custom role with Manage access to Identity & Access. To view the member list, any role with Read access to Identity & Access is enough.
- You can grant only a role that ranks no higher than your own and whose permissions you hold yourself. See Use built-in and custom roles.
- You can invite only at a scope where you can grant roles yourself. To invite at the subscription, your Owner role, or your custom role with Manage access to Identity & Access, must be granted on the subscription, not only on a project. A custom role can be granted only at the scopes it allows.
- Some addresses can't be invited. See If the person can't be invited.
Invite a member
In the console, go to Identity & AccessUsers.
Select Invite user.
Under Identity, enter the member's First name, Last name, and Email address.
Under Role & scope, select a Role. The list contains the built-in roles and your organization's custom roles. The default is Reader.
In Scope, select the subscription to grant the role across the whole subscription, or the current project to grant it in that project only. The default is the subscription.
Under Invitation, keep Send invitation email turned on. Optionally, enter a Personal message to include in the email.
Select Send invitation.
| Field | Rules |
|---|---|
| First name | Required. 1–255 characters. |
| Last name | Required. 1–255 characters. |
| Email address | A valid email address, stored in lowercase. It can't belong to a member of your organization already. |
| Role | A built-in or custom role that you're allowed to grant. |
| Scope | The current subscription, or the current project. If you can't grant the role at the scope that you select, the invitation is refused, and nothing is created. |
| Personal message | Optional. Kept only when the invitation email is sent. |
Result
The member appears in the list with the status Invited. The role assignment is created at once, before the member accepts.
The member receives an invitation email with a link to set a password and activate the account. The link works once and expires 7 days after you send the invitation. When the member activates the account, the status changes to Active.
Add a member without an email
If you turn off Send invitation email, the button changes to Add member. The member is added with the status Invited, but no link is sent, so they can't activate the account yet. When you're ready, send the link with Resend invite. See Manage pending invitations.
If the person can't be invited
If the person can't be invited, nothing is created and no email is sent, and the person doesn't appear in the member list. Check the email address, or ask the person for another one.
If you invite an address that's already a member of your organization, the console shows Invitation failed.
What the invited member does
Open the link in the invitation email. The page Set your password opens.
Enter a password in Password, and enter it again in Confirm password.
Select Activate account. The console confirms that the account is ready and returns to the sign-in page.
Sign in with the email address and the new password.
The password must be at least 12 characters long. The page shows any other rules as you type.
If your organization requires two-factor authentication, the member sets it up the first time they sign in. See What members see at sign-in.
If the link can't be used, the page says why:
| Message | Cause | What to do |
|---|---|---|
| This invitation has expired. Ask your administrator to send you a new one. | The link is more than 7 days old. | Ask an owner to resend the invitation. |
| This invitation has already been used. If you set your password, sign in with it. | The account was already activated with this link. | Sign in with the password you set. |
| This invitation link isn't valid. Make sure you opened the full link from the email, or ask your administrator for a new invitation. | The link is incomplete, or the invitation was canceled. | Open the full link from the email, or ask for a new invitation. |
Manage pending invitations
An invitation that isn't accepted stays Invited, also after its link expires.
Resend an invitation. In Identity & AccessUsers, open the menu on the member's row, and select Resend invite. The member receives a new email with a new link that's valid for 7 days. You can resend only while the member is Invited. On the member's page, the same action is Resend invite.
Cancel an invitation. Open the menu on the member's row, select Cancel invite, and confirm. The link in the email stops working at once, and the role assignment is removed.
Deactivate, reactivate, or remove a member
| Action | Where | What happens |
|---|---|---|
| Deactivate | Row menu, or Disable on the member's page | The member loses access to your organization at once. Their role assignments are kept. Their API tokens stop working, and their OpenStack application credentials are deleted. Their sessions end, and they can't sign in. |
| Reactivate | Row menu, or Enable on the member's page | The member gets the access of their kept role assignments back. Deleted OpenStack application credentials don't come back. |
| Remove member | Row menu, or Remove on the member's page | The member is removed from your organization permanently. All their role assignments are removed, their API tokens are revoked, and their OpenStack application credentials are deleted. You can't undo this. |
- You can deactivate only an Active member. You can select several members and deactivate them together; only the active ones in the selection are deactivated.
- You can't deactivate or remove yourself, or a member who holds the Owner role. To remove an owner, first remove their Owner role on the Roles & access tab of their page.
- You can't deactivate or remove a member who ranks above you at any scope.
- A member marked Locked by platform operator can't be reactivated from your organization. Only the platform operator can lift the lock.
Send a password-reset link
Go to Identity & AccessUsers, and select the member.
Select Reset password.
Select Send reset link to confirm.
The member receives an email with a link to choose a new password, and the link works once. The member's current password keeps working until they set a new one. Setting a new password signs the member out of all their sessions, and it lifts a lock that too many failed sign-ins put on the account. For what the member does with the link, see Reset a forgotten password.
Export the member list
In Identity & AccessUsers, select the members, and then select Export. The console downloads a CSV file with each member's name, email, title, status, and whether two-factor authentication is on.